Side channel attack resistant binomial sampling circuit applied to post quantum cryptography algorithm

Abstract

The invention discloses a side channel attack resistant binomial sampling circuit applied to a post quantum cryptography algorithm. The side channel attack resistant binomial sampling circuit comprises a random number generation unit, a binomial sampling unit and a control logic unit, the random number generation unit is used for generating a pseudo-random number according to input data; the pseudo random number comprises true data and false data; the binomial sampling unit is used for synchronously carrying out binomial sampling on true data and false data; and the control logic unit is used for controlling the random number generation unit and the binomial sampling unit to operate according to an external instruction. According to the side channel attack-resistant binomial sampling circuit applied to the post-quantum cryptographic algorithm, the analysis difficulty of an attacker is increased by generating a pseudo-random number, and meanwhile, the attacker is interfered by synchronously sampling true data and false data, so that the protection on the side channel attack is jointly realized, the security of a Kyber cryptographic system is effectively improved, and the security of the Kyber cryptographic system is improved. And the risk of side channel attack is reduced.

Description

Technical Field

[0001] The present invention belongs to the field of post-quantum information security algorithms, digital signal processing and circuit implementation, and in particular relates to a binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms. Background Art

[0002] Side-Channel Attack (SCA) is an attack method against cryptographic systems. It uses various "side channel" information generated by the actual operation of the cryptographic system, such as power consumption, electromagnetic radiation, processor running time, etc., to obtain secret information about the cryptographic algorithm, such as keys or data. These side channel information are usually leaked due to physical implementation or implementation defects of the cryptographic system. SCA includes not only measurement channel attacks, but also other types of side channel attacks, such as electromagnetic analysis attacks, power consumption analysis attacks, etc. SCA is a more covert and effective attack method than traditional cryptanalysis methods. Therefore, when designing a cryptographic system, it is necessary to consider how to defend against these side channel attacks.

[0003] In this regard, the present invention provides a binomial sampling circuit that resists side channel attacks (such as template attacks) by introducing random numbers, which can provide protection against side channel attacks during encryption algorithm operations. The circuit can bring about a high security performance improvement by introducing only a small amount of additional hardware resources, and has good application prospects. Summary of the invention

[0004] The technical problem to be solved by the present invention is that, in view of the fact that the existing processors applied to post-quantum cryptographic algorithms cannot effectively resist side channel attacks, a method is provided to effectively protect against side channel attacks when the post-quantum cryptographic algorithms are operated. The present invention provides a binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms, comprising: a random number generation unit, a binomial sampling unit and a control logic unit;

[0005] The random number generating unit is used to generate a pseudo-random number according to the input data; the pseudo-random number includes true data and false data;

[0006] The binomial sampling unit is used to synchronously perform binomial sampling on true data and false data;

[0007] The control logic unit is used to control the operation of the random number generation unit and the binomial sampling unit according to external instructions;

[0008] Among them, the output end of the random number generation unit is connected to the binomial sampling unit; the output end of the control logic unit is connected to the random number generation unit and the binomial sampling unit.

[0009] Preferably, the random number generation unit includes a first register, a second register, a third register, a first selector and a Keccak core;

[0010] Among them, the first register input end is connected to the input data; the second register input end is connected to the first register output end and the control logic unit output end; the first selector input end is connected to the second register output end and the third register output end, and the selection end is connected to the control logic unit output end; the Keccak core input end is connected to the first selector output end and the control logic unit output end; the third register input end is connected to the Keccak core output end and the control logic unit output end, and the output end is used to output true data and false data.

[0011] Preferably, the first register is used to roll the input data, the number of roll rounds is 42 rounds, and the roll data is generated;

[0012] The second register is used for filling with rollover data;

[0013] The Keccak core is used to generate a pseudo-random number using the Keccak algorithm according to the filled data;

[0014] The third register is used to transmit true data and false data in the pseudo-random number to the binomial sampling unit.

[0015] Preferably, the input data is 32 bits of data; the rollover data is 1344 bits of data; the padded data is 1600 bits of data, and the 256 bits used for padding are all digital 0s.

[0016] Preferably, the binomial sampling unit comprises: a first binomial sampler, a second binomial sampler, a fourth register and a fifth register;

[0017] The output end of the random number generation unit is connected to the input ends of the first binomial sampler and the second binomial sampler respectively; the output end of the first binomial sampler is connected to the input end of the fourth register; the output end of the second binomial sampler is connected to the fifth register; the output end of the control logic unit is connected to the input ends of the fourth register and the fifth register.

[0018] Preferably, the pseudo-random number is 1600 bits in size, wherein the first 48 bits of data are true data and are input into the first binomial sampler; the 49th to 96th bits of data are false data and are input into the second binomial sampler; the first binomial sampler and the second binomial sampler run synchronously and stop synchronously.

[0019] Preferably, the first binomial sampler includes 8 groups of single binomial sampling groups; the 48-bit true data is evenly divided into 8 groups of 6-bit data and transmitted one-to-one to the 8 groups of single binomial sampling groups.

[0020] Preferably, the single binomial sampling group includes a first adder, a second adder, a third adder, a fourth adder and a first subtractor;

[0021] The output end of the first adder is connected to the input end of the third adder; the output end of the second adder is connected to the input end of the fourth adder; the output ends of the third adder and the fourth adder are connected to the input end of the first subtractor.

[0022] Preferably, the 6 bits of data will be divided into 6 1-bit data, which are sequentially input into two input ends of the first adder, two input ends of the second adder, another input end of the third adder and another input end of the fourth adder; and the Hamming code distance of the last 3 bits of the 6 bits of data minus the first 3 bits of the data is realized.

[0023] Preferably, the first binomial sampler and the second binomial sampler have the same structure.

[0024] Implementing the embodiments of the present invention has the following beneficial effects:

[0025] (1) In the embodiment of the present invention, a random number generation unit is used to generate pseudo-random numbers, and then a binomial sampling unit is used to synchronously perform binomial sampling on the true data and false data separated from the pseudo-random numbers. In this process, the randomness of the pseudo-random numbers is used to increase the uncertainty of the false data, thereby increasing the difficulty of analysis for attackers. Binomial sampling is then performed synchronously with the true data and the false data to cause the energy of the binomial sampling process to be mixed and overlapped, thereby further increasing the difficulty of analysis for attackers. This achieves protection against side channel attacks, effectively improves the security of the post-quantum cryptographic algorithm system, and reduces the risk of side channel attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0027] Figure 1 This is a diagram of the architecture of a binomial sampling circuit for resisting side channel attacks applied to a post-quantum cryptographic algorithm in the present invention;

[0028] Figure 2It is a diagram of the architecture of a binomial sampler in a binomial sampling circuit for resisting side channel attacks applied to a post-quantum cryptographic algorithm in the present invention;

[0029] Figure 3 It is an energy trajectory diagram of a binomial sampling unit in a binomial sampling circuit for resisting side channel attacks applied to a post-quantum cryptographic algorithm in the present invention. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0031] like Figure 1 As shown, the present embodiment discloses a binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms, and the binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms includes: a random number generation unit 10, a binomial sampling unit 20, and a control logic unit 30. The input end of the random number generation unit 10 is connected to the input data (Din), and the output end is connected to the input end of the binomial sampling unit 20. The input end of the control logic unit 30 is connected to an external instruction, and the output end is connected to the input end of the random number generation unit 10 and the binomial sampling unit 20. The output end of the binomial sampling unit 20 is used to output the final output data (Dout). Among them, the random number generation unit 10 is used to generate a pseudo-random number according to the input data. The pseudo-random number includes true data and false data. The binomial sampling unit 20 is used to synchronously perform binomial sampling on true data and false data. The control logic unit 30 is used to control the operation of the random number generation unit 10 and the binomial sampling unit 20 according to the external instruction.

[0032] Specifically, after receiving the input data, the random number generation unit 10 will process the input data into pseudo-random numbers under the control of the control logic unit 30, and transmit the true data and false data therein to the binomial sampling unit 20. The binomial sampling unit 20 will synchronously perform binomial sampling on the true data and false data. After completing the binomial sampling, the control logic unit 30 will control the binomial sampling unit 20 to output the final output data. In this process, the binomial sampling circuit for resisting side channel attacks applied to the post-quantum cryptographic algorithm increases the uncertainty of false data by utilizing the randomness of pseudo-random numbers, thereby increasing the difficulty of analysis for attackers. Then, binomial sampling is performed synchronously with true data and false data to make the energy mixing and overlapping of the binomial sampling process, thereby further increasing the difficulty of analysis for attackers. Thereby, protection against side channel attacks is achieved, the security of the post-quantum cryptographic algorithm system is effectively improved, and the risk of being attacked by side channel attacks is reduced.

[0033] The random number generation unit 10 includes a first register 110, a second register 120, a third register 130, a first selector 140 and a Keccak core 150. The input end of the first register 110 is connected to the input data, and is used to roll the input data, and the number of rollover rounds is 42 rounds to generate rollover data. The input end of the second register 120 is connected to the output end of the first register 110 and the output end of the control logic unit 30, and is used to fill the rollover data according to the instruction of the control logic unit 30 to generate fill data. The input end of the first selector 140 is connected to the output end of the second register 120 and the output end of the third register 130, and the selection end is connected to the output end of the control logic unit 30. The input end of the Keccak core 150 is connected to the output end of the first selector 140 and the output end of the control logic unit 30, and is used to generate a pseudo-random number using the Keccak algorithm according to the filled data. The input end of the third register 130 is connected to the output end of the Keccak core 150 and the output end of the control logic unit 30, and the output end is used to output true data and false data. The third register 130 is used to transmit the true data and false data in the pseudo-random number to the binomial sampling unit 20.

[0034] The random number generation unit 10 further includes a filler 101. The filler 101 is connected to the second register 120 and is used to fill the rollover data with data.

[0035] Specifically, the 32-bit input data is tumbled 42 times through the first register 110 to generate 1344-bit tumbled data. The 1344-bit tumbled data is filled through the second register 120 and, under the control of the control logic unit 30, through the filler 101 to generate 1600-bit filled data. Among them, the filler 101 fills 256-bit data, and the 256-bit data is the number 0. The 1600-bit filled data will be transmitted to the Keccak core 150 through the first selector 140. After the Keccak core 150 performs the Keccak algorithm operation on the 1600-bit filled data and outputs it to the third register 130, it will still be transmitted back to the input end of the first selector 140. The selection end of the first selector 140 is controlled by the control logic unit 30. Through this connection relationship, the control logic unit 30 controls the 1600 bits of padding data to perform multiple rounds of Keccak algorithm operations to generate a 1600 bits pseudo-random number. After the 1600 bits of pseudo-random number are transmitted to the third register 130, the first 48 bits of data are transmitted as true data to the binomial sampling unit 20, and the 49th to 96th bits of data are transmitted as false data to the binomial sampling unit 20.

[0036] The binomial sampling unit 20 includes: a first binomial sampler 210, a second binomial sampler 220, a fourth register 230 and a fifth register 240. The output end of the random number generation unit 10 is connected to the input end of the first binomial sampler 210 and the second binomial sampler 220, that is, the output end of the third register 130 is connected to the input end of the first binomial sampler 210 and the second binomial sampler 220, respectively. The 48 bits of true data are transmitted to the first binomial sampler 210, and the 48 bits of dummy data are transmitted to the second binomial sampler 220. The output end of the first binomial sampler 210 is connected to the input end of the fourth register 230, and is used to receive data using 48 bits of true data to complete binomial sampling. The output end of the second binomial sampler 220 is connected to the fifth register 240, and is used to receive data using 48 bits of dummy data to complete binomial sampling. The output end of the control logic unit 30 is connected to the input ends of the fourth register 230 and the fifth register 240, and is used to control one of the fourth register 230 and the fifth register 240 to output the final output data.

[0037] The first binomial sampler 210 and the second binomial sampler 220 are operated synchronously and stopped synchronously. The overlapping and mixing of their energy trajectories are used to interfere with the attacker's judgment. Figure 3, when the first binomial sampler 210 and the second binomial sampler 220 perform binomial sampling, the first binomial sampler 210 and the second binomial sampler 220 will both generate an energy trajectory fluctuation. In the case of synchronous operation and synchronous stop, the energy trajectories of the first binomial sampler 210 and the second binomial sampler 220 will completely overlap and mix, thereby forming a steeper single peak. This will further increase the difficulty of analysis for attackers. Thereby achieving protection against side channel attacks, effectively improving the security of the post-quantum cryptographic algorithm system, and reducing the risk of side channel attacks.

[0038] The first binomial sampler 210 and the second binomial sampler 220 have the same structure. The first binomial sampler 210 and the second binomial sampler 220 both include 8 groups of single binomial sampling groups 250. The 8 groups of single binomial sampling groups 250 are stacked together. The 48 bits of true data are evenly divided into 8 groups of 6 bits of data and transmitted one by one to the 8 groups of single binomial sampling groups 250 of the first binomial sampler 210. The 48 bits of false data are evenly divided into 8 groups of 6 bits of data and transmitted one by one to the 8 groups of single binomial sampling groups 250 of the second binomial sampler 220. See Figure 2 The single binomial sampling group 250 includes a first adder 201, a second adder 202, a third adder 203, a fourth adder 204 and a first subtractor 205. The output end of the first adder 201 is connected to the input end of the third adder 203. The output end of the second adder 202 is connected to the input end of the fourth adder 204. The output ends of the third adder 203 and the fourth adder 204 are connected to the input end of the first subtractor 205.

[0039] The 6-bit data is divided into 6 1-bit data, which are sequentially input into two input ends of the first adder 201, two input ends of the second adder 202, another input end of the third adder 203, and another input end of the fourth adder 204. That is, the fourth and fifth 1-bit data are input into two input ends of the first adder 201, and the sixth 1-bit data is input into another input end of the third adder 203. The second and third 1-bit data are input into the second adder input end, and the first 1-bit data is input into another input end of the fourth adder 204. The Hamming code distance of the last 3-bit data minus the first 3-bit data in the 6-bit data is realized.

[0040] The single binomial sampling group 250 also includes a second selector 206. The output end of the first subtractor 205 is connected to the selection end of the second selector 206. The input end of the second selector 206 is 7 data, which are numbers 0, 1, 2, 3, 3326, 3327, and 3328. The Hamming code distance of the last 3 bits of the 6 bits of data input at the selection end of the second selector 206 is subtracted from the first 3 bits of data, and the input end of the second selector 206 is determined to be one of the 7 data as the output result. Finally, binomial sampling of 48 bits of true data and 48 bits of false data is achieved.

[0041] In summary, the embodiment of the present invention generates pseudo-random numbers by the random number generation unit 10 under the coordination of the control logic unit 30, and then performs binomial sampling on the true data and false data separated from the pseudo-random numbers through the binomial sampling unit 20. In this process, the randomness of the pseudo-random numbers is used to increase the uncertainty of the false data, thereby increasing the difficulty of analysis for attackers. Binomial sampling is then performed synchronously with true data and false data to cause the energy mixing and overlapping of the binomial sampling process, thereby further increasing the difficulty of analysis for attackers. Protection against side channel attacks is thereby achieved, effectively improving the security of the post-quantum cryptographic algorithm system, and reducing the risk of side channel attacks. While introducing a very small additional control resource overhead, the embodiment of the present invention brings about a significant improvement in security performance, meeting the requirements of low resource overhead and high efficiency.

[0042] What is disclosed above is only a preferred embodiment of the present invention, and it certainly cannot be used to limit the scope of rights of the present invention. Ordinary technicians in this field can understand that all or part of the processes of the above embodiment and equivalent changes made according to the claims of the present invention still fall within the scope of the invention.

Claims

1. A binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms, characterized in that: include: a random number generation unit, a binomial sampling unit, and a control logic unit; The random number generating unit is used to generate a pseudo-random number according to the input data; the pseudo-random number includes true data and false data; The binomial sampling unit is used to synchronously perform binomial sampling on true data and false data; The control logic unit is used to control the operation of the random number generation unit and the binomial sampling unit according to external instructions; Among them, the output end of the random number generation unit is connected to the binomial sampling unit; the output end of the control logic unit is connected to the random number generation unit and the binomial sampling unit.

2. The binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms according to claim 1, characterized in that: The random number generation unit includes a first register, a second register, a third register, a first selector and a Keccak core; Among them, the first register input end is connected to the input data; the second register input end is connected to the first register output end and the control logic unit output end; the first selector input end is connected to the second register output end and the third register output end, and the selection end is connected to the control logic unit output end; the Keccak core input end is connected to the first selector output end and the control logic unit output end; the third register input end is connected to the Keccak core output end and the control logic unit output end, and the output end is used to output true data and false data.

3. The binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms according to claim 2, characterized in that: The first register is used to roll the input data, the number of roll rounds is 42 rounds, and the roll data is generated; The second register is used for filling with rollover data; The Keccak core is used to generate a pseudo-random number using the Keccak algorithm according to the filled data; The third register is used to transmit true data and false data in the pseudo-random number to the binomial sampling unit.

4. The binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms according to claim 3, characterized in that: The input data is 32 bits of data; the rollover data is 1344 bits of data; the padded data is 1600 bits of data, and the 256 bits used for padding are all digital 0s.

5. The binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms according to claim 1, characterized in that: The binomial sampling unit comprises: a first binomial sampler, a second binomial sampler, a fourth register and a fifth register; The output end of the random number generation unit is connected to the input ends of the first binomial sampler and the second binomial sampler respectively; the output end of the first binomial sampler is connected to the input end of the fourth register; the output end of the second binomial sampler is connected to the fifth register; the output end of the control logic unit is connected to the input ends of the fourth register and the fifth register.

6. The binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms according to claim 5, characterized in that: The pseudo-random number is 1600 bits in size, wherein the first 48 bits of data are true data and are input into the first binomial sampler; the 49th to 96th bits of data are false data and are input into the second binomial sampler; the first binomial sampler and the second binomial sampler run synchronously and stop synchronously.

7. The binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms according to claim 5, characterized in that: The first binomial sampler includes 8 groups of single binomial sampling groups; the 48-bit true data is evenly divided into 8 groups of 6-bit data and transmitted to the 8 groups of single binomial sampling groups in a one-to-one correspondence.

8. The binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms according to claim 7, characterized in that: The single binomial sampling group includes a first adder, a second adder, a third adder, a fourth adder and a first subtractor; The output end of the first adder is connected to the input end of the third adder; the output end of the second adder is connected to the input end of the fourth adder; the output ends of the third adder and the fourth adder are connected to the input end of the first subtractor.

9. The binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms according to claim 8, characterized in that: The 6 bits of data will be divided into 6 1-bit data, and input into two input ends of the first adder, two input ends of the second adder, another input end of the third adder and another input end of the fourth adder in sequence; and the Hamming code distance of the last 3 bits of the 6 bits of data minus the first 3 bits of the data is realized.

10. The binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms according to claim 5, characterized in that: The first binomial sampler and the second binomial sampler have the same structure.

Images