A method for detecting resistance of aradi cryptosystem to impossible statistical fault analysis

Abstract

The application relates to a method for detecting that ARADI password resists impossible statistical fault analysis, first, generating a plaintext to be processed at random, taking the plaintext as an input of an ARADI algorithm, introducing a random 4-bit fault in the second last round, and outputting a fault ciphertext. By enumerating subkeys of the last three rounds and impossible relationship analysis, false candidate key bits are excluded in advance, and an intermediate state is calculated. By using a statistical method, the hamming weight of the intermediate state is calculated, and the correct value of corresponding subkey bits is obtained. The fault introduction and analysis process are repeated, and finally all bit positions of the correct subkey of the last three rounds can be deduced, and the correct master key is deduced according to a key arrangement scheme of the algorithm. The method provided by the application is easy to implement, fast and high in accuracy, and provides an important analysis basis for security research on the ARADI password algorithm.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a method for detecting that ARADI cipher resists impossible statistical fault analysis. BACKGROUND

[0002] With the rapid development of computer technology, the speed of device data information is also getting faster and faster, and the analysis and processing of data have become more convenient and efficient. At the same time, this also brings new information security challenges, and how to ensure information security without affecting real-time performance has become a hot spot of research and attention. ARADI block cipher is a low-latency cipher algorithm, which was proposed by the US National Security Agency in 2024, and is mainly used in memory encryption and other scenarios and devices with high real-time requirements. The block length of ARADI cipher is 128 bits, the key length is 256 bits, and a total of 16 rounds of encryption are performed, each round of encryption including key XOR, S-box substitution and row shift operations, and finally XORing the whitening key.

[0003] Impossible statistical fault analysis (Statistical Fault Analysis, SFA) is a cryptographic analysis technique that uses deliberately introduced faults (such as hardware faults) during the execution of a cryptographic algorithm to analyze and attack the algorithm. This analysis method does not require the attacker to have internal information about the algorithm, but rather observes the behavior of the algorithm when a fault occurs to infer the weaknesses of the key or algorithm. There is currently no related report evaluating the ability of ARADI cipher algorithm to resist impossible statistical fault attacks, which leaves a security risk for products that are using ARADI cipher algorithm encapsulation. SUMMARY

[0004] The technical problem to be solved by the present application is to provide a method for detecting that ARADI cipher resists impossible statistical fault analysis, which can evaluate the ability of ARADI cipher algorithm to resist impossible statistical fault attacks.

[0005] The technical solution adopted by the present application to solve the technical problem is: a method for detecting that ARADI cipher resists impossible statistical fault analysis is provided, comprising the following steps:

[0006] Step S1, randomly generating a plaintext message;

[0007] Step S2, using ARADI cipher algorithm and a fixed master key to encrypt the plaintext message, and introducing a random 4-bit fault other than the all-1 state in the second-to-last round of the encryption process to generate multiple fault ciphertexts;

[0008] Step S3: Based on the fault injection position, the intermediate state value of the fault injection position is deduced from the fault ciphertext by enumerating the subkey bits of the last three rounds, and the intermediate state value corresponding to multiple candidate subkey bits is obtained.

[0009] Step S4: Construct an impossible analysis path with a probability of 0 based on the 4-bit fault intermediate state impossible value, and exclude erroneous candidate subkey bits according to the impossible analysis path;

[0010] Step S5: For the intermediate state values ​​obtained from the remaining candidate subkey bits, use statistical methods to calculate the Hamming weight of the intermediate state values ​​and find the subkey bit corresponding to the minimum Hamming weight.

[0011] Step S6: Repeat steps 1-5 to obtain the subkeys for the last three rounds;

[0012] Step S7: Recover the subkey of each round using the subkeys of the last three rounds according to the key arrangement scheme, and recover the master key based on the subkey of the first round.

[0013] Between steps S2 and S3, the following is also included:

[0014] Determine if the number of faulty ciphertexts has reached the preset number;

[0015] If the number of faulty ciphertexts does not reach the preset number, return to step S1;

[0016] If the number of faulty encrypted messages reaches a preset number, proceed to step S3.

[0017] The intermediate state value in step S3 is calculated in the following way: Among them, C 13 RK is an intermediate state value. 14 RK is the subkey for the penultimate round. 15 The subkey for the penultimate round, RK 16 This is the subkey for the final round. For faulty encrypted text, SR -1 For row shift inverse operation, SC -1 Replace the inverse operation for the S-box.

[0018] The impossible analysis path in step S4 is represented as follows: in, and These are the 0th, 32nd, 64th, and 96th bits of the intermediate state value, respectively.

[0019] In step S7, RKr = M- 1(RKr +1 To recover the subkey for each round, RK r M is the subkey for the r-th round. -1 This is the inverse operation of a linear mapping in a key arrangement scheme.

[0020] In step S2, a random 4-bit fault is introduced by means of software simulation or by means of laser, electromagnetic and voltage interference.

[0021] Beneficial effects

[0022] Due to the adoption of the above technical solution, the present invention has the following advantages and positive effects compared with the prior art: The present invention first randomly generates plaintext to be processed, denoted as P∈{{0,1} 32} 4 The plaintext P is used as input to the ARADI algorithm, a random 4-bit fault is introduced, the fault position is before the penultimate round of key XOR, and the faulted ciphertext is output. By utilizing the properties of bitwise AND operations, the 4-bit intermediate state value injected at the fault location cannot be 0b1111, thus generating an impossible analysis path and eliminating some erroneous candidate keys in advance. Then, using statistical methods, the Hamming weight is calculated to determine the partially correct value of the round key. Repeating the fault import and analysis process, the correct round key RK can finally be derived. 14 RK 15 and Based on the key arrangement scheme of the algorithm, the correct master key K can be derived. The method provided by this invention is easy to implement, fast, and highly accurate, providing a good analytical basis for testing the ability of the ARADI cryptographic algorithm to resist impossible statistical failure attacks. Attached Figure Description

[0023] Figure 1 Flowchart of steps to test whether the ARADI cryptographic algorithm is resistant to impossible statistical failure attacks.

[0024] Figure 2 A fault propagation graph for fault attacks that cannot be statistically analyzed during the ARADI algorithm encryption process;

[0025] Figure 3 A detailed structural diagram of the ARADI cryptographic algorithm;

[0026] Figure 4 This is a schematic diagram of the experimental environment for this scheme. Detailed Implementation

[0027] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined by the appended claims.

[0028] Basic symbol explanation:

[0029] P: Plaintext, P∈{{0,1} 32} 4 ;

[0030] Fault ciphertext,

[0031] K: Master key, K∈{{0,1} 32} 8 ;

[0032] RK r The key for the r-th round, 0 ≤ r ≤ 16, where RK 16 Whitening key;

[0033] SC: S-box substitution operation;

[0034] SC -1 S-box substitution inverse operation;

[0035] SR: Row shift operation;

[0036] SR -1 Row shift inverse operation;

[0037] M: Linear mapping operation in the key arrangement scheme.

[0038] M -1 : Inverse operation of linear mapping.

[0039] A r : The intermediate state output value of the XOR key in the (r+1)th round, 0≤r≤15;

[0040] A r The i-th bit, 0≤r≤15, 0≤i≤127;

[0041] B r : The intermediate state output value of the S-box replacement operation in the (r+1)th round, 0≤r≤15;

[0042] B r The i-th bit, 0≤r≤15, 0≤i≤127;

[0043] Cr : The intermediate state output value of the (r+1)th round, 0≤r≤15;

[0044] C r The i-th bit, 0≤r≤15, 0≤i≤127;

[0045] XOR operation.

[0046] Figure 1 A flowchart of a method for detecting ARADI cryptographic algorithms against impossible statistical failure attacks, provided for embodiments of the present invention, includes the following steps:

[0047] Step 1: Randomly generate a plaintext message P with a length of 128 bits.

[0048] Step 2: Use the ARADI cryptographic algorithm (see...) Figure 3 The plaintext message P is encrypted using a fixed master key, and a random 4-bit fault (excluding the all-1s state) is introduced in the penultimate round of the encryption process to generate multiple faulted ciphertexts. In this step, to ensure the accuracy of the experimental results, the experimental environment needs to be strictly controlled to obtain the corresponding output. The specific operation method is as follows: Input plaintext message P, import faults during the ARADI algorithm operation, and then obtain fault ciphertext.

[0049] This step can be selected as follows: Figure 4 The experimental environment shown uses a computer to generate the plaintext input message P for ARADI, and to process and analyze the output result of the plaintext input after the ARADI algorithm. The device that encapsulates the ARADI algorithm is used to process the input message and obtain the corresponding output result. The device that introduces faults is used to perform the fault introduction action. It will perform the fault introduction action during the operation of the ARADI algorithm, and then obtain the output of fault ciphertext. The fault introduction device can complete the introduction of random 4-bit faults through software simulation or laser, electromagnetic and voltage interference methods.

[0050] Step 3: Determine if the number of faulty ciphertexts has reached the preset number. If not, repeat steps 1 and 2 until the preset number of faulty ciphertexts is obtained. The preset quantity in this embodiment is 100. If this quantity is reached, proceed to step 4.

[0051] Step 4: Calculate the intermediate state value. The fault injection point is before the penultimate round of key XOR operation, i.e., C. 13 The formula for the intermediate state of the injected fault location, derived from the ciphertext, is:

[0052]

[0053] Due to SR -1 Since it is a linear operation, the above expression can be simplified to:

[0054]

[0055] To reduce computational complexity, SR can be directly enumerated when enumerating subkey bits. -1 (RK 16 ), and record:

[0056]

[0057] Based on the above formula and possible fault injection locations, a fault propagation path diagram is derived. Assuming random fault injection locations are as follows... Figure 2 As shown, after simplification of the above formula, it can be achieved through enumeration. The corresponding 12 bits, RK 15 The corresponding 12 bits and RK 14 Using the 4 bits at the corresponding positions, we can deduce the intermediate state value:

[0058]

[0059] Step 5: Perform impossible relationship analysis. Considering the characteristics of bitwise AND operations, the 4-bit intermediate state value injected at the fault location cannot be 0b1111. Therefore, an impossible analysis path is constructed (using...). Figure 2 For example:

[0060]

[0061] in, and These are the 0th, 32nd, 64th, and 96th bits of the intermediate state value, respectively. By utilizing impossible analysis paths with a probability of 0, some erroneous candidate subkey bits are eliminated in advance, thereby effectively reducing the key search space and accelerating analysis efficiency.

[0062] Step 6: For the intermediate state values ​​obtained from the remaining candidate subkey bits, use statistical methods to calculate the intermediate state value C. 13 The Hamming weight. The Hamming weight represents the number of '1's contained in the binary form of the intermediate state. For example, when C... 13 =13, the binary representation of 13 is 1101, then C 13 The weight of Hamming is 3.

[0063] Step 7: Find the subkey bit corresponding to the minimum Hamming weight. Because the fault is injected via bitwise AND, the distribution of intermediate state values ​​will be uneven, with more "0"s than "1". Therefore, the key corresponding to the minimum Hamming weight is the correct subkey bit.

[0064] Step 8: Repeat steps 1 through 7, ensuring the import location for each fault is different from the previous ones. This will allow you to obtain RK. 14 RK 15 and 128 bits. And because Therefore, the correct RK can also be obtained. 16 128 bits.

[0065] Step 9: Master Key Recovery. Based on the key arrangement scheme, the round key RK can be recovered. r Given all the bits of r, where 0 ≤ r ≤ 15, the master key K can be derived by working backwards. The formula is:

[0066] RK r =M -1 (RK r+1 ).

[0067] The first round subkey RK0 can be gradually obtained using the above formula, and the master key can be recovered by K = RK0.

[0068] Using the above analysis method, on a computer with an Intel(R) Core(TM) i7-12700H 2.30GHz processor and 16GB of memory, the import failure and ARADI cryptographic algorithm processing were simulated using the VS Code development tool and repeated 2000 times. The experimental results show that the above detection method is accurate. Therefore, the method provided by this invention is easy to implement, fast, and highly accurate, and is of great significance to the security research of the ARADI cryptographic algorithm.

Claims

1. A method for detecting ARADI cryptographic resistance to impossible statistical failure analysis, characterized in that, Includes the following steps: Step S1: Randomly generate a plaintext message; Step S2: Encrypt the plaintext message using the ARADI cryptographic algorithm and a fixed master key, and introduce a random 4-bit fault (excluding the all-1 state) in the penultimate round of the encryption process to generate multiple fault ciphertexts. Step S3: Based on the fault injection position, the intermediate state value of the fault injection position is deduced from the fault ciphertext by enumerating the subkey bits of the last three rounds, and the intermediate state value corresponding to multiple candidate subkey bits is obtained. Step S4: Construct an impossible analysis path with a probability of 0 based on the 4-bit fault intermediate state impossible value, and exclude erroneous candidate subkey bits according to the impossible analysis path; Step S5: For the intermediate state values ​​obtained from the remaining candidate subkey bits, use statistical methods to calculate the Hamming weight of the intermediate state values ​​and find the subkey bit corresponding to the minimum Hamming weight. Step S6: Repeat steps S1-S5 to obtain the subkeys for the last three rounds; Step S7: Recover the subkey of each round using the subkeys of the last three rounds according to the key arrangement scheme, and recover the master key based on the subkey of the first round.

2. The method for detecting ARADI cryptographic resistance to impossible statistical fault analysis according to claim 1, characterized in that, Between steps S2 and S3, the following is also included: Determine if the number of faulty ciphertexts has reached the preset number; If the number of faulty ciphertexts does not reach the preset number, return to step S1; If the number of faulty encrypted messages reaches a preset number, proceed to step S3.

3. The method for detecting ARADI cryptographic resistance to impossible statistical fault analysis according to claim 1, characterized in that, The intermediate state value in step S3 is calculated in the following way: Among them, C 13 RK is an intermediate state value. 14 RK is the subkey for the penultimate round. 15 The subkey for the penultimate round, RK 16 This is the subkey for the final round. For faulty encrypted text, SR -1 For row shift inverse operation, SC -1 Replace the inverse operation for the S-box.

4. The method for detecting ARADI cryptographic resistance to impossible statistical fault analysis according to claim 1, characterized in that, The impossible analysis path in step S4 is represented as follows: in, and These are the 0th, 32nd, 64th, and 96th bits of the intermediate state value, respectively.

5. The method for detecting ARADI cryptographic resistance to impossible statistical fault analysis according to claim 1, characterized in that, In step S7, RKr = M- 1 (RKr +1 To recover the subkey for each round, RK r M is the subkey for the r-th round. -1 This is the inverse operation of a linear mapping in a key arrangement scheme.

6. The method for detecting ARADI cryptographic resistance to impossible statistical fault analysis according to claim 1, characterized in that, In step S2, a random 4-bit fault is introduced by means of software simulation or by means of laser, electromagnetic and voltage interference.

Images