Method for detecting impossible statistical fault analysis of ARADI password resistance

Abstract

The invention relates to a method for detecting impossible statistical fault analysis of ARADI password resistance, which comprises the following steps of: firstly, randomly generating a plaintext to be processed, taking the plaintext as the input of an ARADI algorithm, importing a random 4-bit fault in the last but one round, and outputting a fault ciphertext; the method comprises the following steps: eliminating wrong candidate key bits in advance and calculating an intermediate state through exhaustion of sub-keys in the last three rounds and impossible relation analysis, then calculating the Hamming weight of the intermediate state by using a statistical method, and solving the correct value of the corresponding sub-key bits. And the fault introduction and analysis process is repeated, all bits of the correct sub-key in the last three rounds can be derived finally, and a correct main key is derived according to a key arrangement scheme of the algorithm. The method provided by the invention is easy to implement, high in speed and high in accuracy, and an important analysis basis is provided for the security research of the ARADI cryptographic algorithm.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method for detecting ARADI passwords to resist impossible statistical fault analysis. Background Art

[0002] With the rapid development of computer technology, the speed of device data information is getting faster and faster, and data analysis and processing have become more convenient and efficient. At the same time, this has also brought new information security challenges. How to ensure information security without affecting real-time performance has become a hot topic of research and attention. The ARADI block cipher is a low-latency cryptographic algorithm proposed by the National Security Agency of the United States in 2024. It is mainly used in scenarios and devices with high real-time requirements such as memory encryption. The block length of the ARADI cipher is 128 bits, the key length is 256 bits, and a total of 16 rounds of encryption are performed. Each round of encryption includes key XOR, S-box replacement and row shift operations, and the key is XORed and whitened at the end.

[0003] Statistical Fault Analysis (SFA) is a cryptographic analysis technique that uses faults (such as hardware failures) deliberately introduced during the execution of a cryptographic algorithm to analyze and attack the cryptographic algorithm. This analysis method does not require the attacker to have internal information about the algorithm, but rather infers the weaknesses of the key or algorithm by observing the behavior of the algorithm when a fault occurs. There are currently no reports evaluating the ability of the ARADI cryptographic algorithm to resist impossible statistical fault attacks, which leaves a security risk for products that are using the ARADI cryptographic algorithm package. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a method for detecting ARADI cipher's resistance to impossible statistical fault analysis, which can evaluate the ability of ARADI cipher algorithm to resist impossible statistical fault attacks.

[0005] The technical solution adopted by the present invention to solve the technical problem is: to provide a method for detecting ARADI passwords to resist impossible statistical fault analysis, comprising the following steps:

[0006] Step S1, randomly generate a plaintext message;

[0007] Step S2, encrypting the plaintext message using the ARADI cryptographic algorithm and a fixed master key, and introducing a random 4-bit fault except the all-1 state in the penultimate round of the encryption process to generate multiple fault ciphertexts;

[0008] Step S3, according to the fault injection position, the intermediate state value of the fault injection position is reversely inferred from the fault ciphertext by enumerating the subkey bits of the last three rounds, so as to obtain the intermediate state values ​​corresponding to the multiple candidate subkey bits;

[0009] Step S4, constructing an impossible analysis path with a probability of 0 based on the impossible value of the 4-bit fault intermediate state, and eliminating erroneous candidate subkey bits according to the impossible analysis path;

[0010] Step S5, for the intermediate state values ​​obtained from the remaining candidate subkey bits, using a statistical method, calculate the Hamming weight of the intermediate state value, and find the subkey bit corresponding to the minimum Hamming weight;

[0011] Step S6, repeating steps 1 to 5 to obtain the subkeys of the last three rounds;

[0012] Step S7: recover the subkeys of each round using the subkeys of the last three rounds according to the key arrangement scheme, and recover the master key based on the subkeys of the first round.

[0013] Between step S2 and step S3, the following steps are also included:

[0014] Determine whether the number of faulty ciphertexts reaches a preset number;

[0015] If the number of the faulty ciphertexts does not reach the preset number, return to step S1;

[0016] If the number of the faulty ciphertexts reaches a preset number, the process proceeds to step S3.

[0017] The intermediate state value in step S3 is calculated in the following way: Among them, C 13 is the intermediate state value, RK 14 is the third-to-last round subkey, RK 15 is the subkey of the penultimate round, R 16 is the subkey of the last round, is the fault ciphertext, SR -1 is the inverse operation of row shift, SC -1 Replace the inverse operation for the S-box.

[0018] The impossible analysis path in step S4 is expressed as: in, and They are the 0th bit, the 32nd bit, the 64th bit and the 96th bit of the intermediate state value respectively.

[0019] In step S7, RKr=M- 1(RKR +1 ) to recover the subkey of each round, where RK r is the subkey of round r, M -1 It is the inverse operation of the linear mapping in the key scheduling scheme.

[0020] In step S2, the introduction of random 4-bit faults is completed by software simulation method, or laser, electromagnetic and voltage interference means.

[0021] Beneficial Effects

[0022] Due to the adoption of the above technical solution, the present invention has the following advantages and positive effects compared with the prior art: the present invention first randomly generates a plaintext to be processed, denoted as P∈{{0,1} 32} 4 , and use the plaintext P as the input of the ARADI algorithm, introduce a random 4-bit fault, the fault position is before the penultimate round of key XOR, and output the fault ciphertext By using the characteristics of bitwise 'AND' operation, the 4-bit intermediate state value injected into the fault position cannot be 0b1111, thus generating an impossible analysis path, eliminating some wrong candidate keys in advance, and then using statistical methods to calculate the Hamming weight, find out some correct values ​​of the round key, repeat the process of introducing faults and analyzing, and finally derive the correct round key RK 14 , R.K. 15 and According to the key arrangement scheme of the algorithm, the correct master key K can be derived. The method provided by the present invention is easy to implement, fast and highly accurate, and provides a good analytical basis for detecting the ability of the ARADI cryptographic algorithm to resist impossible statistical fault attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 Flowchart of steps for testing whether the cryptographic algorithm ARADI is resistant to impossible statistical fault attacks

[0024] Figure 2 It is the fault propagation diagram of the impossible statistical fault attack in the encryption process of ARADI algorithm;

[0025] Figure 3 This is the detailed structure diagram of the ARADI cryptographic algorithm;

[0026] Figure 4 Schematic diagram of the experimental environment for this scheme. DETAILED DESCRIPTION

[0027] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the appended claims of the application equally.

[0028] Basic symbol description:

[0029] P: plain text, P∈{{0,1} 32} 4 ;

[0030] Fault ciphertext,

[0031] K: master key, K∈{{0,1} 32} 8 ;

[0032] R r : The rth round subkey, 0≤r≤16, where RK 16 is the whitening key;

[0033] SC: S-box replacement operation;

[0034] SC -1 : S-box replacement inverse operation;

[0035] SR: row shift operation;

[0036] SR -1 : Inverse row shift operation;

[0037] M: Linear mapping operation in key scheduling scheme.

[0038] M -1 : Inverse operation of linear mapping.

[0039] A r : The intermediate state output value of the XOR key of the r+1th round, 0≤r≤15;

[0040] A r The i-th bit of , 0≤r≤15, 0≤i≤127;

[0041] B r : The intermediate state output value of the r+1th round of S-box replacement operation, 0≤r≤15;

[0042] B r The i-th bit of , 0≤r≤15, 0≤i≤127;

[0043] Cr : The intermediate state output value of the r+1th round, 0≤r≤15;

[0044] C r The i-th bit of , 0≤r≤15, 0≤i≤127;

[0045] XOR operation.

[0046] Figure 1 A flowchart of a method for detecting an ARADI cryptographic algorithm against impossible statistical fault attacks provided by an embodiment of the present invention, comprising the following steps:

[0047] Step 1: Randomly generate a plaintext message P with a length of 128 bits.

[0048] Step 2: Use the ARADI cipher algorithm (see Figure 3 ) and a fixed master key to encrypt the plaintext message P, and introduce a random 4-bit fault except the all-1 state in the penultimate round of the encryption process to generate multiple fault ciphertexts In this step, in order to ensure the accuracy of the experimental results, the experimental environment needs to be strictly controlled to obtain the corresponding output. The specific operation method is as follows: input the plaintext message P, introduce the fault during the operation of the ARADI algorithm, and then obtain the fault ciphertext

[0049] In this step, you can choose Figure 4 The experimental environment shown in the figure uses a computer to generate the input plaintext message P of ARADI, and processes and analyzes the output result of the input plaintext after the ARADI algorithm; the device encapsulating the ARADI algorithm is used to process the input message and obtain the corresponding output result; the device for introducing faults is used to perform the action of introducing faults, which will be performed during the operation of the ARADI algorithm to obtain the output of the fault ciphertext. The device for introducing faults can complete the introduction of random 4-bit faults through software simulation methods, or laser, electromagnetic and voltage interference means.

[0050] Step 3: Determine whether the number of faulty ciphertexts reaches the preset number. If not, repeat steps 1 to 2 until the preset number of faulty ciphertexts is obtained. The preset number in this embodiment is 100. If the preset number is reached, the process proceeds to step 4.

[0051] Step 4: Calculate the intermediate state value. The fault injection position is before the penultimate round of key XOR operation, that is, C 13 The intermediate state formula of the fault location injected by reverse inference from the ciphertext is:

[0052]

[0053] Due to SR -1 It is a linear operation, so the above formula can be simplified to:

[0054]

[0055] In order to reduce the computational complexity, the subkey bits can be enumerated directly by enumerating SR -1 (RK 16 ), and remember:

[0056]

[0057] According to the above formula and the possible fault injection location, the fault propagation path diagram is derived. Assuming that the random fault injection location is Figure 2 As shown, after the above formula is simplified, it can be enumerated 12 bits of the corresponding position, RK 15 The 12 bits of the corresponding position and RK 14 The 4 bits at the corresponding position reverse the intermediate state value:

[0058]

[0059] Step 5: Perform impossible relationship analysis. Combined with the characteristics of the bitwise AND operation, the 4-bit intermediate state value injected into the fault position cannot be 0b1111. Therefore, an impossible analysis path is constructed (based on Figure 2 For example):

[0060]

[0061] in, and They are bit 0, bit 32, bit 64 and bit 96 of the intermediate state value. By using the impossible analysis path with probability 0, some erroneous candidate subkey bits can be excluded in advance, thereby effectively reducing the key search space and improving the analysis efficiency.

[0062] Step 6: For the intermediate state values ​​obtained from the remaining candidate subkey bits, use statistical methods to calculate the intermediate state value C 13 The Hamming weight represents the number of '1's contained in the binary form of the intermediate state. For example, when C 13 =13, the binary representation of 13 is 1101, then C 13 The Hamming weight of is 3.

[0063] Step 7: Find the subkey bit corresponding to the minimum Hamming weight. Since the fault is injected by bitwise "AND", the distribution of the intermediate state value will be uneven, showing that there are more "0" than "1". Therefore, the key corresponding to the minimum Hamming weight is the correct subkey bit.

[0064] Step 8: Repeat steps 1 to 7. The import position of each fault is different from the previous one. In this way, RK can be obtained. 14 , R.K. 15 and 128 bits. And because Therefore, the correct RK can also be obtained 16 128 bits.

[0065] Step 9: Master key recovery. According to the key arrangement scheme, the round key RK can be recovered r All bits of , where 0≤r≤15, are used to reverse the master key K. The formula is:

[0066] R r =M -1 (RK r+1 ).

[0067] The first round of sub-keys RK0 can be gradually obtained through the above formula, and finally the master key can be restored by K=RK0.

[0068] Using the above analysis method, on a computer with Intel(R) Core(TM) i7-12700H 2.30GHz 16GB memory, the VS Code development tool was used to simulate the import failure and ARADI cryptographic algorithm processing process, and the execution was repeated 2000 times. The experimental results show that the above detection method is accurate. It can be seen that the method provided by the present invention is easy to implement, fast and accurate, and has important significance for the security research of the ARADI cryptographic algorithm.

Claims

1. A method for detecting ARADI ciphers against impossible statistical fault analysis, characterized in that: The following steps are involved: Step S1, randomly generate a plaintext message; Step S2, encrypting the plaintext message using the ARADI cryptographic algorithm and a fixed master key, and introducing a random 4-bit fault except the all-1 state in the penultimate round of the encryption process to generate multiple fault ciphertexts; Step S3, according to the fault injection position, the intermediate state value of the fault injection position is reversely inferred from the fault ciphertext by enumerating the subkey bits of the last three rounds, so as to obtain the intermediate state values ​​corresponding to the multiple candidate subkey bits; Step S4, constructing an impossible analysis path with a probability of 0 based on the impossible value of the 4-bit fault intermediate state, and eliminating erroneous candidate subkey bits according to the impossible analysis path; Step S5, for the intermediate state values ​​obtained from the remaining candidate subkey bits, using a statistical method, calculate the Hamming weight of the intermediate state value, and find the subkey bit corresponding to the minimum Hamming weight; Step S6, repeating steps S1 to S5 to obtain the subkeys of the last three rounds; Step S7: recover the subkeys of each round using the subkeys of the last three rounds according to the key arrangement scheme, and recover the master key based on the subkeys of the first round.

2. The method for detecting ARADI passwords against impossible statistical fault analysis according to claim 1, characterized in that: Between step S2 and step S3, the following steps are also included: Determine whether the number of faulty ciphertexts reaches a preset number; If the number of the faulty ciphertexts does not reach the preset number, return to step S1; If the number of the faulty ciphertexts reaches a preset number, the process proceeds to step S3.

3. The method for detecting ARADI passwords against impossible statistical fault analysis according to claim 1, characterized in that: The intermediate state value in step S3 is calculated in the following way: Among them, C 13 is the intermediate state value, RK 14 is the third-to-last round subkey, RK 15 is the subkey of the penultimate round, R 16 is the subkey of the last round, is the fault ciphertext, SR -1 is the inverse operation of row shift, SC -1 Replace the inverse operation for the S-box.

4. The method of detecting ARADI passwords against impossible statistical fault analysis according to claim 1, characterized in that: The impossible analysis path in step S4 is expressed as: in, and They are the 0th bit, the 32nd bit, the 64th bit and the 96th bit of the intermediate state value respectively.

5. The method of detecting ARADI passwords against impossible statistical fault analysis according to claim 1, characterized in that: In step S7, RKr=M- 1 (RKR +1 ) to recover the subkey of each round, where RK r is the subkey of round r, M -1 It is the inverse operation of the linear mapping in the key scheduling scheme.

6. The method of detecting ARADI passwords against impossible statistical fault analysis according to claim 1, characterized in that: In step S2, the introduction of random 4-bit faults is completed by software simulation method, or laser, electromagnetic and voltage interference means.

Images