Binomial sampling circuit for side-channel attack resistance in post-quantum cryptography

Abstract

The application discloses a binomial sampling circuit applied to post-quantum cryptographic algorithm and resisting side channel attacks, comprising a random number generation unit, a binomial sampling unit and a control logic unit; the random number generation unit is used for generating pseudo random numbers according to input data; the pseudo random numbers comprise true data and false data; the binomial sampling unit is used for synchronously performing binomial sampling on the true data and the false data; and the control logic unit is used for controlling the random number generation unit and the binomial sampling unit to operate according to external instructions. The binomial sampling circuit applied to post-quantum cryptographic algorithm and resisting side channel attacks disclosed by the application increases the difficulty of analysis of attackers by generating pseudo random numbers, synchronously samples the true data and the false data to interfere with the attackers, and jointly realizes the protection against side channel attacks, thereby effectively improving the security of a Kyber cryptographic system and reducing the risk of being attacked by side channels.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of post-quantum information security algorithm, digital signal processing and circuit implementation, and particularly relates to a binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms. BACKGROUND

[0002] A side channel attack (SCA) is an attack method against a cryptographic system, which obtains secret information about a cryptographic algorithm, such as a key or data, by using various "side channel" information generated during the actual operation of the cryptographic system, such as power consumption, electromagnetic radiation, processor running time, etc. These side channel information is usually leaked due to the physical implementation or implementation defects of the cryptographic system. SCA not only includes measurement channel attacks, but also other types of side channel attacks, such as electromagnetic analysis attacks, power consumption analysis attacks, etc. SCA is a more covert and effective attack means than traditional cryptographic analysis methods, so when designing a cryptographic system, how to resist these side channel attacks needs to be considered.

[0003] To this end, the application provides a binomial sampling circuit for resisting side channel attacks (such as template attacks) by introducing random numbers, which can provide protection against side channel attacks during cryptographic algorithm operation. This circuit can bring high security performance improvement with only a small amount of additional hardware resources, and has good application prospects. SUMMARY

[0004] The technical problem to be solved by the application is that the existing processors applied to post-quantum cryptographic algorithms cannot effectively resist side channel attacks, and the application provides a binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms, which can effectively protect against side channel attacks during post-quantum cryptographic algorithm operation. The application provides a binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms, which includes a random number generation unit, a binomial sampling unit and a control logic unit.

[0005] The random number generation unit is used to generate pseudo-random numbers according to input data; the pseudo-random numbers include true data and false data.

[0006] The binomial sampling unit is used to synchronously perform binomial sampling on the true data and the false data.

[0007] The control logic unit is used to control the operation of the random number generation unit and the binomial sampling unit according to external instructions.

[0008] The output end of the random number generation unit is connected to the binomial sampling unit; and the output end of the control logic unit is connected to the random number generation unit and the binomial sampling unit.

[0009] Preferably, the random number generation unit comprises a first register, a second register, a third register, a first selector and a Keccak core;

[0010] The first register input end is connected with input data; the second register input end is connected with the first register output end and the control logic unit output end; the first selector input end is connected with the second register output end and the third register output end, and the selection end is connected with the control logic unit output end; the Keccak core input end is connected with the first selector output end and the control logic unit output end; the third register input end is connected with the Keccak core output end and the control logic unit output end, and the output end is used for outputting true data and false data.

[0011] Preferably, the first register is used for rolling the input data, and the rolling number is 42 rounds to generate rolling data.

[0012] The second register is used for filling the rolling data.

[0013] The Keccak core is used for generating pseudo-random numbers according to the filled data by using the Keccak algorithm.

[0014] The third register is used for transmitting the true data and the false data in the pseudo-random numbers to the binomial sampler.

[0015] Preferably, the input data is 32 bits data; the rolling data is 1344 bits data; and the filled data is 1600 bits data, and the 256 bits used for filling are all digital 0.

[0016] Preferably, the binomial sampler comprises a first binomial sampler, a second binomial sampler, a fourth register and a fifth register.

[0017] The random number generation unit output end is connected with the first binomial sampler input end and the second binomial sampler input end respectively; the first binomial sampler output end is connected with the fourth register input end; the second binomial sampler output end is connected with the fifth register; and the control logic unit output end is connected with the fourth register input end and the fifth register input end.

[0018] Preferably, the pseudo-random number is 1600 bits in size, wherein the first 48 bits of data are true data input into the first binomial sampler; the 49th to 96th bits of data are false data input into the second binomial sampler; and the first binomial sampler and the second binomial sampler are synchronously operated and stopped.

[0019] Preferably, the first binomial sampler comprises 8 single binomial sampling groups; the 48 bits of true data are evenly divided into 8 groups of 6 bits of data and transmitted to the 8 single binomial sampling groups one by one.

[0020] Preferably, the single binomial sampling group comprises a first adder, a second adder, a third adder, a fourth adder and a first subtractor.

[0021] The output end of the first adder is connected with the input end of the third adder; the output end of the second adder is connected with the input end of the fourth adder; the output ends of the third adder and the fourth adder are connected with the input end of the first subtractor.

[0022] Preferably, the 6 bits of data are divided into 6 bits of data, which are sequentially input into the two input ends of the first adder, the two input ends of the second adder, the other input end of the third adder and the other input end of the fourth adder; the Hamming code distance of the last 3 bits of data minus the first 3 bits of data in the 6 bits of data is realized.

[0023] Preferably, the first binomial sampler and the second binomial sampler have the same structure.

[0024] The embodiment of the present application has the following beneficial effects:

[0025] (1) The embodiment of the present application produces pseudo-random numbers through a random number generation unit, and then synchronously performs binomial sampling on the true data and the false data separated from the pseudo-random numbers through a binomial sampling unit. In this process, the randomness of the pseudo-random numbers is used to increase the uncertainty of the false data, thereby increasing the analysis difficulty of the attacker. Then, the true data and the false data are synchronously subjected to binomial sampling, so that the energy of the binomial sampling process is mixed and overlapped, thereby further increasing the analysis difficulty of the attacker. Thus, the protection against side channel attacks is realized, the security of the post-quantum cryptography algorithm system is effectively improved, and the risk of being attacked by the side channel is reduced. BRIEF DESCRIPTION OF DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0027] Figure 1 It is a binomial sampling circuit architecture applied to the anti-side channel attack of the post-quantum cryptography algorithm in the present application.

[0028] Figure 2It is a binomial sampler architecture diagram in a binomial sampling circuit for resisting side channel attacks of a post-quantum cryptographic algorithm in the application.

[0029] Figure 3 It is a binomial sampling unit energy trajectory diagram in a binomial sampling circuit for resisting side channel attacks of a post-quantum cryptographic algorithm in the application. DETAILED DESCRIPTION

[0030] The technical solutions in the embodiments of the application will be clearly and completely described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the application.

[0031] As shown in Figure 1 The binomial sampling circuit for resisting side channel attacks of a post-quantum cryptographic algorithm disclosed in the embodiment includes a random number generation unit 10, a binomial sampling unit 20 and a control logic unit 30. The input end of the random number generation unit 10 is connected with input data (Din), and the output end is connected with the input end of the binomial sampling unit 20. The input end of the control logic unit 30 is connected with external instructions, and the output end is connected with the input ends of the random number generation unit 10 and the binomial sampling unit 20. The output end of the binomial sampling unit 20 is used for outputting final output data (Dout). The random number generation unit 10 is used for generating pseudo-random numbers according to input data. The pseudo-random numbers include true data and false data. The binomial sampling unit 20 is used for synchronously performing binomial sampling on the true data and the false data. The control logic unit 30 is used for controlling the random number generation unit 10 and the binomial sampling unit 20 to run according to the external instructions.

[0032] Specifically, the random number generation unit 10 will process the input data into pseudo-random numbers under the control of the control logic unit 30 after receiving the input data, and transmit the true data and false data therein to the binomial sampling unit 20. The binomial sampling unit 20 will synchronously binomially sample the true data and false data. After completing the binomial sampling, the control logic unit 30 will control the binomial sampling unit 20 to output the final output data. In this process, the binomial sampling circuit for resisting side channel attacks applied to post-quantum cryptographic algorithms increases the uncertainty of false data by utilizing the randomness of pseudo-random numbers, thereby increasing the difficulty of analysis for attackers. The energy mixing of the binomial sampling process is overlapped by synchronously binomially sampling the true data and false data, thereby further increasing the difficulty of analysis for attackers. Thus, the protection against side channel attacks is realized, the security of the post-quantum cryptographic algorithm system is effectively improved, and the risk of being attacked by side channels is reduced.

[0033] The random number generation unit 10 includes a first register 110, a second register 120, a third register 130, a first selector 140, and a Keccak core 150. The input end of the first register 110 is connected with input data, for rolling the input data, the rolling number is 42 rounds, to generate rolling data. The input end of the second register 120 is connected with the output end of the first register 110 and the output end of the control logic unit 30, for filling the rolling data according to the instruction of the control logic unit 30, to generate filling data. The input end of the first selector 140 is connected with the output end of the second register 120 and the output end of the third register 130, the selection end is connected with the output end of the control logic unit 30. The input end of the Keccak core 150 is connected with the output end of the first selector 140 and the output end of the control logic unit 30, for generating pseudo-random numbers by using the Keccak algorithm according to the filled data. The input end of the third register 130 is connected with the output end of the Keccak core 150 and the output end of the control logic unit 30, and the output end is used for outputting true data and false data. The third register 130 is used for transmitting the true data and false data in the pseudo-random numbers to the binomial sampling unit 20.

[0034] The random number generation unit 10 further includes a filler 101. The filler 101 is connected with the second register 120, for filling data to the rolling data.

[0035] Specifically, the 32 bits of input data are rolled 42 rounds by the first register 110 to generate 1344 bits of rolled data. The 1344 bits of rolled data are padded by the second register 120 under the control of the control logic unit 30 by the pad 101 to generate 1600 bits of padded data. Among them, the pad 101 pads 256 bits of data, and the 256 bits of data are digital 0. The 1600 bits of padded data will be transmitted to the Keccak core 150 through the first selector 140. Among them, the Keccak core 150 performs Keccak algorithm operation on the 1600 bits of padded data, and outputs to the third register 130, and then returns to the input end of the first selector 140. And the selection end of the first selector 140 is controlled by the control logic unit 30. Through the connection relationship, the control logic unit 30 will control the 1600 bits of padded data to perform multiple rounds of Keccak algorithm operation to generate 1600 bits of pseudo-random number. After the 1600 bits of pseudo-random number are transmitted to the third register 130, the first 48 bits of data are transmitted to the binomial sampling unit 20 as true data, and the 49th to 96th bits of data are transmitted to the binomial sampling unit 20 as false data.

[0036] The binomial sampling unit 20 includes a first binomial sampler 210, a second binomial sampler 220, a fourth register 230, and a fifth register 240. The output end of the random number generation unit 10 is connected to the input end of the first binomial sampler 210 and the second binomial sampler 220, that is, the output end of the third register 130 is connected to the input end of the first binomial sampler 210 and the second binomial sampler 220. Among them, the 48 bits of true data are transmitted to the first binomial sampler 210, and the 48 bits of false data are transmitted to the second binomial sampler 220. The output end of the first binomial sampler 210 is connected to the input end of the fourth register 230 for receiving data using 48 bits of true data to complete binomial sampling. The output end of the second binomial sampler 220 is connected to the fifth register 240 for receiving data using 48 bits of false data to complete binomial sampling. The output end of the control logic unit 30 is connected to the input end of the fourth register 230 and the fifth register 240 for controlling one of the fourth register 230 and the fifth register 240 to output the final output data.

[0037] Among them, the first binomial sampler 210 and the second binomial sampler 220 are synchronously operated and synchronously stopped. By using the overlapping mixing of energy trajectories, the judgment of the attacker is interfered. Specifically, see Figure 3, the first binomial sampler 210 and the second binomial sampler 220 will generate an energy trajectory fluctuation when performing binomial sampling. In the case of synchronous operation and synchronous stop, the energy trajectories of the first binomial sampler 210 and the second binomial sampler 220 will completely overlap and mix, thereby forming a single peak that is steeper. This will further increase the difficulty of analysis for attackers, thereby achieving protection against side-channel attacks, effectively improving the security of the post-quantum cryptographic algorithm system, and reducing the risk of side-channel attacks.

[0038] The first binomial sampler 210 and the second binomial sampler 220 have the same structure. The first binomial sampler 210 and the second binomial sampler 220 each include 8 groups of single binomial sampling groups 250. The 8 groups of single binomial sampling groups 250 are stacked together. The 48 bits of true data will be evenly divided into 8 groups of 6 bits of data and transmitted one-to-one to the 8 groups of single binomial sampling groups 250 of the first binomial sampler 210. The 48 bits of false data will be evenly divided into 8 groups of 6 bits of data and transmitted one-to-one to the 8 groups of single binomial sampling groups 250 of the second binomial sampler 220. Please refer to Figure 2 The single binomial sampling group 250 includes a first adder 201, a second adder 202, a third adder 203, a fourth adder 204, and a first subtractor 205. The output end of the first adder 201 is connected to the input end of the third adder 203. The output end of the second adder 202 is connected to the input end of the fourth adder 204. The output ends of the third adder 203 and the fourth adder 204 are connected to the input end of the first subtractor 205.

[0039] The 6 bits of data will be divided into 6 bits of 1 bit data, which are sequentially input into the two input ends of the first adder 201, the two input ends of the second adder 202, the other input end of the third adder 203, and the other input end of the fourth adder 204. That is, the fourth and fifth bits of 1 bit data are input into the two input ends of the first adder 201, and the sixth bit of 1 bit data is input into the other input end of the third adder 203. The second and third bits of 1 bit data are input into the input ends of the second adder, and the first bit of 1 bit data is input into the other input end of the fourth adder 204. This realizes the Hamming code distance of subtracting the last 3 bits of data from the first 3 bits of data in the 6 bits of data.

[0040] The single binomial sampling group 250 further comprises a second selector 206. The output end of the first subtracter 205 is connected with the selection end of the second selector 206. The input end of the second selector 206 is 7 data, which are digital 0, 1, 2, 3, 3326, 3327 and 3328. The Hamming distance between the last 3 bits data and the first 3 bits data in the 6 bits data inputted through the selection end of the second selector 206 is subtracted, so as to determine one of the 7 data at the input end of the second selector 206 as the output result. Finally, the binomial sampling of the 48 bits true data and the 48 bits false data is realized.

[0041] In summary, the embodiment of the present application produces pseudo random numbers by the random number generation unit 10 under the coordination of the control logic unit 30, and then synchronously performs binomial sampling on the true data and the false data separated from the pseudo random numbers by the binomial sampling unit 20. In this process, the randomness of the pseudo random numbers is utilized to increase the uncertainty of the false data, thereby increasing the analysis difficulty of the attacker. Then, the energy of the binomial sampling process is mixed and overlapped by synchronously performing binomial sampling on the true data and the false data, thereby further increasing the analysis difficulty of the attacker. Further, the protection against side channel attacks is realized, the security of the post-quantum cryptography algorithm system is effectively improved, and the risk of being attacked by the side channel is reduced. The embodiment of the present application brings great improvement of security performance while introducing very small additional control resource overhead, and meets the requirements of low resource overhead and high efficiency.

[0042] The above only discloses one preferred embodiment of the present application, and of course cannot limit the scope of the rights of the present application. Those skilled in the art can understand that all or part of the processes of the above-mentioned embodiment are realized, and equivalent changes made according to the claims of the present application still belong to the scope covered by the present application.

Claims

1. A binomial sampling circuit for resisting side-channel attacks in post-quantum cryptography algorithms, characterized in that, include: Random number generation unit, binomial sampling unit, and control logic unit; The random number generation unit is used to generate pseudo-random numbers based on the input data; the pseudo-random numbers include real data and fake data; The binomial sampling unit is used to simultaneously perform binomial sampling on real data and fake data; The control logic unit is used to control the operation of the random number generation unit and the binomial sampling unit according to external instructions; The output of the random number generation unit is connected to the binomial sampling unit; the output of the control logic unit is connected to both the random number generation unit and the binomial sampling unit. The binomial sampling unit includes: a first binomial sampler, a second binomial sampler, a fourth register, and a fifth register; The output of the random number generation unit is connected to the inputs of the first binomial sampler and the second binomial sampler, respectively; the output of the first binomial sampler is connected to the input of the fourth register; the output of the second binomial sampler is connected to the fifth register; and the output of the control logic unit is connected to the inputs of the fourth register and the fifth register.

2. The binomial sampling circuit for resisting side-channel attacks in post-quantum cryptography algorithms according to claim 1, characterized in that, The random number generation unit includes a first register, a second register, a third register, a first selector, and a Keccak core; The first register input is connected to the input data; the second register input is connected to the first register output and the control logic unit output; the first selector input is connected to the second register output and the third register output, and the selector is connected to the control logic unit output; the Keccak core input is connected to the first selector output and the control logic unit output; the third register input is connected to the Keccak core output and the control logic unit output, and the output is used to output true and false data.

3. The binomial sampling circuit for resisting side-channel attacks in post-quantum cryptography algorithms according to claim 2, characterized in that, The first register is used to tumble the input data, with 42 tumbling wheels, to generate tumbling data; The second register is used to fill the data during the rolling process; The Keccak core is used to generate pseudo-random numbers based on the filled data using the Keccak algorithm. The third register is used to transmit the real and fake data from the pseudo-random numbers to the binomial sampling unit.

4. The binomial sampling circuit for resisting side-channel attacks in post-quantum cryptography algorithms according to claim 3, characterized in that, The input data is 32 bits; the roll data is 1344 bits; the padded data is 1600 bits, with the 256 bits used for padding being all 0s.

5. The binomial sampling circuit for resisting side-channel attacks in post-quantum cryptography algorithms according to claim 1, characterized in that, The pseudo-random number is 1600 bits in size. The first 48 bits of the pseudo-random number are real data and are input into the first binomial sampler. The 49th to 96th bits of the pseudo-random number are fake data and are input into the second binomial sampler. The first binomial sampler and the second binomial sampler run synchronously and stop synchronously.

6. The binomial sampling circuit for resisting side-channel attacks in post-quantum cryptography algorithms according to claim 1, characterized in that, The first binomial sampler includes 8 single binomial sampling groups; the first 48 bits of the pseudo-random number are divided into 8 groups of 6 bits each and transmitted one-to-one to the 8 single binomial sampling groups.

7. The binomial sampling circuit for resisting side-channel attacks in post-quantum cryptography algorithms according to claim 6, characterized in that, The single binomial sampling group includes a first adder, a second adder, a third adder, a fourth adder, and a first subtractor; The output of the first adder is connected to the input of the third adder; the output of the second adder is connected to the input of the fourth adder; and the outputs of the third and fourth adders are connected to the input of the first subtractor.

8. The binomial sampling circuit for resisting side-channel attacks in post-quantum cryptography algorithms according to claim 7, characterized in that, The 6 bits of data will be divided into 6 1-bit data segments, which will be sequentially input into the two inputs of the first adder, the two inputs of the second adder, the other input of the third adder, and the other input of the fourth adder; thus, the Hamming code distance of the last 3 bits of the 6 bits of data will be subtracted from the first 3 bits of the data.

9. The binomial sampling circuit for resisting side-channel attacks in post-quantum cryptography algorithms according to claim 1, characterized in that, The first binomial sampler and the second binomial sampler have the same structure.

Images