A method for detecting that an ascon algorithm is resistant to impossible statistical fault analysis

Abstract

The application relates to a method for detecting that an Ascon algorithm resists impossible statistical fault analysis, first, a plaintext to be processed is randomly generated, an Ascon authentication encryption algorithm is used to process the plaintext message, in this stage, the processing process is interfered with to induce faults, error output is obtained to obtain an error label; then, through a decryption algorithm and a statistical method, an intermediate state value is calculated, the probability of occurrence of each value is counted, key candidate values leading to intermediate state values which are theoretically impossible to obtain are excluded, key candidate values making the probability of occurrence of the intermediate state values most conform to ideal conditions are selected, the fault introduction and analysis process are repeated for multiple times, and then, a complete key is recovered. The application is easy to implement, fast and high in accuracy, and provides a good analysis basis for the security research of the Ascon authentication encryption algorithm resisting impossible statistical fault attacks.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method for detecting Ascon algorithms against impossible statistical failure analysis. Background Technology

[0002] In recent years, the Internet of Things (IoT) and mobile communications have developed rapidly, gradually covering all aspects of people's lives, and people's reliance on information is constantly increasing. Information security issues are becoming increasingly prominent, and people are paying more and more attention to the privacy protection functions of devices. Encryption algorithms, as a core technology for ensuring information security, have always received much attention. The Ascon authentication encryption algorithm is a lightweight encryption algorithm designed by a team from the Technical University of Graz in Austria. It was initially proposed in the international cryptography competition CAESAR and was selected as one of the lightweight cryptography standards by the National Institute of Standards and Technology (NIST) in 2020. Its applicable scenarios include resource-constrained IoT devices. The Ascon authentication encryption algorithm has high security and can resist various known attacks, such as linear attacks and differential attacks. As a new type of lightweight encryption technology, it has broad application prospects.

[0003] Statistical Fault Analysis (SFA) is a cryptanalysis technique that exploits deliberately introduced faults (such as hardware failures) during the execution of cryptographic algorithms to analyze and attack them. This method does not require the attacker to possess internal information about the algorithm; instead, it infers weaknesses in the key or algorithm by observing the algorithm's behavior when faults occur. Currently, there are no publicly available research results evaluating the Ascon authentication encryption algorithm's ability to resist impossible statistical fault attacks. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a method for detecting the Ascon algorithm's resistance to impossible statistical failure analysis, which can evaluate the Ascon authentication encryption algorithm's ability to resist impossible statistical failure analysis.

[0005] The technical solution adopted by this invention to solve its technical problem is: to provide a method for detecting the Ascon algorithm's resistance to impossible statistical fault analysis, comprising the following steps:

[0006] Step S1: Randomly generate a plaintext message;

[0007] Step S2: The plaintext message is encrypted using the Ascon-128 encryption algorithm and a fixed master key. In the final round of the encryption process, a 2-bit random fault (excluding the 0b11 state) is introduced to obtain the error tag set.

[0008] Step S3: Perform a Cartesian product between the set of 2-bit key candidate values ​​corresponding to the imported fault location and the set of error labels. Group the elements in the Cartesian product according to the key candidate values ​​to generate 4 sets, each set containing multiple tuples.

[0009] Step S4: Calculate the intermediate state at the point of import failure based on each pair of tuples;

[0010] Step S5: Construct an impossible analysis path with a probability of 0, and exclude the tuples corresponding to the candidate values ​​of the erroneous key based on the impossible analysis path;

[0011] Step S6: For the intermediate state values ​​obtained by calculating the tuples corresponding to the remaining key candidate values, use statistical methods to calculate the probability of the intermediate state values ​​that may occur, and select the key corresponding to the tuple that best matches the theoretical probability value as the 2-bit key for importing the fault location.

[0012] Step S7: Repeat steps S1-S6 until the 2-bit key for all positions is obtained.

[0013] Between steps S2 and S3, the following is also included:

[0014] Determine whether the number of error tags in the error tag set has reached a preset number;

[0015] If the number of error tags in the error tag set does not reach the preset number, then return to step S1;

[0016] If the number of error tags in the error tag set reaches a preset number, proceed to step S3.

[0017] The intermediate state in step S4 is calculated in the following way: Where S is the intermediate state, T i K represents the error label value in the tuple. j PL is a 2-bit key candidate value. -1 This is the inverse operation of linear diffusion. This is an XOR operation.

[0018] The impossible analysis path in step S5 is represented as follows:

[0019] The theoretical probability value in step S6 is expressed as follows: Where n is the number of bits injected with the fault, β is all possible values ​​of the intermediate state, and hw(β) represents the Hamming weight of all possible values ​​β of the intermediate state.

[0020] In step S2, a 2-bit random fault, excluding the 0b11 state, is introduced through software simulation or by means of laser, electromagnetic, and voltage interference.

[0021] Beneficial effects

[0022] By employing the above-described technical solution, this invention, compared with existing technologies, possesses the following advantages and positive effects: Firstly, this invention processes plaintext messages using the Ascon authentication encryption algorithm. During the algorithm's processing, interference is introduced to induce malfunctions, resulting in an incorrect set of output tags. Through decryption algorithms and statistical methods, the probability of each intermediate state is calculated, and partially correct key values ​​are determined. By repeatedly importing the malfunction and analyzing the process, the correct master key can be derived. The method provided by this invention is easy to implement, fast, and highly accurate, offering crucial analytical basis for testing the Ascon authentication encryption algorithm's ability to resist impossible statistical fault attacks. Attached Figure Description

[0023] Figure 1 Flowchart of steps to enable Ascon authentication encryption algorithm to resist impossible statistical failure analysis;

[0024] Figure 2 This is a diagram illustrating the propagation path of a fault during the encryption process of the Ascon authentication encryption algorithm after the fault is imported.

[0025] Figure 3 Flowchart of the encryption algorithm for Ascon authentication;

[0026] Figure 4 A schematic diagram of the experimental environment for implementing this verification scheme on the Ascon authentication encryption algorithm. Detailed Implementation

[0027] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined by the appended claims.

[0028] Basic symbol explanation:

[0029] K: Master key, K∈{0,1} k k ≤ 160 bits;

[0030] N: A random number, N∈{0,1} 128 ;

[0031] T: Label value, T∈{0,1} 128 ;

[0032] T: Error label value, T∈{0,1} 128 ;

[0033] T * : The set of valid error tags output after importing a fault;

[0034] P: Plaintext, of arbitrary length, P∈{0,1} * ;

[0035] C: Ciphertext, with the same length as the plaintext, C∈{0,1} * ;

[0036] C: Error ciphertext, with the same length as the plaintext, C∈{0,1} * ;

[0037] IV: Initial vector;

[0038] A: Related data, any length;

[0039] S: intermediate state, S∈{0,1} 320 ;

[0040] S r The first r bits of the intermediate state S;

[0041] S c The last c bits of the intermediate state S;

[0042] p a Round a is a full permutation process consisting of three processes: PC, PS, and PL. Ascon-128 specifies that a is 12, meaning that 12 rounds are required.

[0043] p b The b-round is a full permutation process consisting of three processes: PC, PS, and PL. Ascon-128 specifies that b is 6, meaning that it requires 6 rounds of cycling.

[0044] PC: Cyclic constant addition process;

[0045] PS: S-box replacement process;

[0046] PL: Linear diffusion process;

[0047] X0,…,X4: The 320-bit state S is divided into 5 groups of data, each group consisting of 64 bits;

[0048] 0 k : A k-bit bitstream where all values ​​are 0 (the length is variable if k is *);

[0049] |x|: The length of the bit string x, in bits;

[0050] The bit string x is truncated to the first k bits;

[0051] The bit string x is truncated to the last k bits;

[0052] ⊥: Error message, authentication and encryption failed;

[0053] mod: Modulo operation;

[0054] >>>: Circular right shift;

[0055] XOR operation;

[0056] ||: Cascade.

[0057] Figure 1 A flowchart illustrating the steps for detecting the Ascon authentication encryption algorithm's resistance to impossible statistical failure analysis, provided as an embodiment of the present invention, describes a detection method comprising the following steps:

[0058] Step 1: Randomly generate a plaintext message, denoted as P∈{0,1} 128 The message length is 128 bits;

[0059] Step 2: Encrypt the plaintext message using the Ascon-128 encryption algorithm and a fixed master key, and during the encryption process (see...). Figure 3 In the final round of the Ascon-128 encryption algorithm, a 2-bit random fault (excluding the 0b11 state) is introduced to obtain the error label set. To ensure the accuracy of the experimental results, the experimental environment needs to be strictly controlled to obtain the corresponding output. The specific operation method is as follows: Input a random number N, associated data A, plaintext message P, and master key K, each 128 bits in length. During the Ascon-128 encryption algorithm, a 2-bit random fault (excluding the 0b11 state) is introduced. The fault location is the last round of the final full permutation process. The error label set calculated after the introduced fault is applied is obtained, denoted as T. * .

[0060] This step can be selected as follows: Figure 4 The experimental environment shown utilizes a computer to generate the input plaintext message P, and to process and analyze the output of the Ascon-128 encryption algorithm. A device encapsulating the Ascon-128 encryption algorithm is used to process the input message and obtain the corresponding output. A fault-introducing device is used to perform fault-introducing actions during the Ascon-128 encryption algorithm's operation, thereby obtaining a set of error tags. The fault-introducing device can introduce random 2-bit faults through software simulation or by using laser, electromagnetic, and voltage interference methods.

[0061] Step 3: Determine whether the number of error tags in the error tag set has reached the preset number. If not, repeat steps 1 and 2 until enough error tags are obtained. If the preset number has been reached, proceed to step 4.

[0062] Ascon is an international encryption standard for lightweight applications, designed by a team at the Technical University of Graz in Austria. It supports both AE encryption and hashing modes, and has achieved significant success in competitions at CAESAR and NIST. Taking the Ascon-128 authentication encryption algorithm as an example, both the master key K and the random number N are 128 bits long during the encryption process. During encryption, S... r To extract the first 64 bits of state S, i.e., r = 64. After encrypting the plaintext to obtain the complete ciphertext, the algorithm performs 12 rounds of full permutation operations on state S. Each round of permutation consists of three steps: adding the round constant PC, replacing PS with the S-box, and linearly spreading PL. The result is denoted as... Then take The last 128 bits are XORed with the master key K to obtain the output tag T. The formulas for calculating X3 and X4 in linear diffusion are:

[0063]

[0064] Taking the fault introduction before the PL step in the 12th round of full permutation, and the first bit of X3 and X4 as an example, the fault propagation path is as follows: Figure 2 As shown. Follow these steps to confirm the values ​​of all bits in the correct key.

[0065] Step 4: Import the set of 2-bit key candidate values ​​K corresponding to the fault location and the set of error labels T. * Taking the Cartesian product, we have K×T * , the Cartesian product K×T * The elements in the dataset are grouped according to the key candidate values, generating four sets. Each set contains multiple tuples, as shown below:

[0066]

[0067] Step 5: Calculate the intermediate state at the point of import failure based on each pair of tuples. In this step, substitute each pair of tuples into the following formula:

[0068]

[0069] S represents the intermediate state, T i K represents the error label value in the tuple. j PL is a 2-bit key candidate value. -1 This is the inverse operation of linear diffusion. This is an XOR operation.

[0070] Step 6: When injecting a fault, this implementation introduces a 2-bit random fault other than the 0b11 state. Therefore, the intermediate state value cannot be 0b11, thus constructing an impossible analysis path, represented as: The candidate key corresponding to the intermediate state value cannot be the correct key, so it can be excluded, which can effectively reduce the search space.

[0071] Step 7: For the intermediate state values ​​calculated from the tuples corresponding to the remaining key candidate values, use statistical methods to calculate the probability of each intermediate state value occurring, and select the key corresponding to the tuple that best matches the theoretical probability value as the 2-bit key for importing the fault location. The theoretical probability value is expressed as: Where n is the number of bits injected with the fault, in this embodiment n = 2, and β is all possible values ​​of the intermediate state, 0 ≤ β ≤ 3. ， hw(β) represents the Hamming weight of all possible values ​​of β in the intermediate state, 0≤hw(β)≤2.

[0072] Step 8: Repeat the above steps 64 times, shifting the faulty import position one bit to the right each time to obtain the 2-bit key for all positions. Concatenate the 2-bit keys for all positions to recover the complete 128-bit master key.

[0073] Using the above analytical methods, in Core TM On a computer with an i5-9400 CPU at 2.90GHz and 8GB of RAM, the import failure and Ascon authentication encryption algorithm processing were simulated using Visual Studio 2019 and C++ programming. This was repeated 2000 times, and the experimental results show that the above detection method is accurate. The method provided by this invention is easy to implement, fast, and highly accurate, providing a sufficient theoretical basis for the security research of the Ascon authentication encryption algorithm.

Claims

1. A method for detecting the Ascon algorithm's resistance to impossible statistical fault analysis, characterized in that, Includes the following steps: Step S1: Randomly generate a plaintext message; Step S2: The plaintext message is encrypted using the Ascon-128 encryption algorithm and a fixed master key. In the last round of the encryption process, a 2-bit random fault (excluding the 0b11 state) is introduced to obtain the error tag set. Step S3: Perform a Cartesian product between the set of 2-bit key candidate values ​​corresponding to the imported fault location and the set of error labels. Group the elements in the Cartesian product according to the key candidate values ​​to generate 4 sets, each set containing multiple tuples. Step S4: Calculate the intermediate state at the point of import failure based on each pair of tuples; Step S5: Construct an impossible analysis path with a probability of 0, and exclude the tuples corresponding to the candidate values ​​of the erroneous key based on the impossible analysis path; Step S6: For the intermediate state values ​​obtained by calculating the tuples corresponding to the remaining key candidate values, use statistical methods to calculate the probability of the intermediate state values ​​that may occur, and select the key corresponding to the tuple that best matches the theoretical probability value as the 2-bit key for importing the fault location. Step S7: Repeat steps S1-S6 until the 2-bit key for all positions is obtained.

2. The method for detecting Ascon algorithm resistance to impossible statistical fault analysis according to claim 1, characterized in that, Between steps S2 and S3, the following is also included: Determine whether the number of error tags in the error tag set has reached a preset number; If the number of error tags in the error tag set does not reach the preset number, then return to step S1; If the number of error tags in the error tag set reaches a preset number, proceed to step S3.

3. The method for detecting Ascon algorithm resistance to impossible statistical fault analysis according to claim 1, characterized in that, The intermediate state in step S4 is calculated in the following way: Where S represents the intermediate state, and T i K represents the error label value in the tuple. j PL is a 2-bit key candidate value. -1 This is the inverse operation of linear diffusion. This is an XOR operation.

4. The method for detecting Ascon algorithm resistance to impossible statistical fault analysis according to claim 3, characterized in that, The impossible analysis path in step S5 is represented as follows:

5. The method for detecting Ascon algorithm resistance to impossible statistical fault analysis according to claim 1, characterized in that, The theoretical probability value in step S6 is expressed as follows: Where n is the number of bits injected with the fault, β is all possible values ​​of the intermediate state, and hw(β) represents the Hamming weight of all possible values ​​β of the intermediate state.

6. The method for detecting Ascon algorithm resistance to impossible statistical fault analysis according to claim 1, characterized in that, In step S2, a 2-bit random fault, excluding the 0b11 state, is introduced through software simulation or by means of laser, electromagnetic, and voltage interference.

Images