A multi-round key genetic algorithm side channel analysis method for lightweight cryptography

Abstract

The present disclosure relates to the field of multi-round key, and more particularly to a multi-round key genetic algorithm side channel analysis method for lightweight cryptography, comprising the following steps: constructing a triple of round key K1 and KT-1 respectively, and using a genetic algorithm to search the triples corresponding to round key K0 and round key K1 and the triples corresponding to KT-2 and KT-1 in parallel; wherein the round key is a sub-key generated by a master key through a key expansion algorithm for each round operation in a block cipher algorithm; T is the number of encryption rounds of the block cipher algorithm; K0 refers to the first round round key; K1 refers to the second round round key; KT-2 refers to the second-to-last round round key; KT-1 refers to the last round round key; the triple is a set of three elements for characterizing a specific round key, and the number of bits of each element is the same as that of the round key. When analyzing the parallel implementation of the lightweight block cipher algorithm, the calculation complexity is lower and the recovery success rate is higher.

Description

Technical Field

[0001] This disclosure relates to the field of multi-round keys, and more specifically, to a side-channel analysis method for multi-round key genetic algorithms for lightweight cryptography. Background Technology

[0002] With the rapid development of IoT technology, lightweight cryptographic algorithms have been proposed to meet the needs of data encryption operations in resource-constrained scenarios. These algorithms are characterized by low resource consumption and high computational speed, reducing computational load while ensuring security, and have broad application prospects in IoT terminal devices. Lightweight block ciphers differ significantly from classic block ciphers, and their physical security has attracted widespread attention from cryptography researchers.

[0003] Classical cryptanalysis techniques analyze the structure of cryptographic algorithms and collect plaintext and ciphertext information leaked through standard channels to recover keys. However, due to the high complexity of cryptographic operations and the extremely long nature of keys, traditional cryptanalysis techniques are difficult to effectively crack in practical applications. In 1996, Kocher et al. proposed side-channel analysis, which utilizes various types of physical side information leaked by devices, such as energy and electromagnetic fields, to capture intermediate data directly or indirectly, thereby recovering the key with relatively low computational complexity.

[0004] Correlation energy analysis (CPA) is a side-channel analysis method proposed by Brier et al., based on differential energy analysis and improved by the Hamming weight model. The core of CPA lies in calculating the correlation coefficient between the energy consumption of the cryptographic device during cryptographic operations and the intermediate values, thereby cracking the key information inside the device.

[0005] Since its introduction into the field of side-channel analysis in 2011, artificial intelligence (AI) technology has provided a completely new perspective and approach to side-channel analysis, yielding significant results. However, current AI-based side-channel technologies still have certain shortcomings. For example, some analysis scenarios struggle to provide sufficient training data to meet the training requirements of supervised learning algorithms, and unsupervised learning algorithms are prone to getting trapped in local optima, which limits the effectiveness of existing methods.

[0006] Heuristic algorithms, a core concept in artificial intelligence, are effective tools for solving complex optimization problems. Genetic algorithms are a type of heuristic search algorithm inspired by the biological concept of "evolution." They find optimal solutions by simulating the evolutionary process of species, effectively reducing the key search space and demonstrating good performance in key guessing in the side-channel domain. In 2015, a correlation energy analysis method based on genetic algorithms was proposed to analyze a parallel implementation of the DES algorithm. This method recovered the complete key using less energy waveforms compared to traditional CPA, significantly improving analysis efficiency. However, existing research mainly focuses on cases where the master key is distributed only in a single round of encryption, lacking discussion on cryptographic algorithms where the master key is distributed across multiple rounds. Furthermore, genetic algorithms themselves have limitations, potentially leading to the inability to escape local optima, resulting in errors in some recovered key bytes. Summary of the Invention

[0007] The purpose of this invention is to address the technical problems of existing side-channel methods based on genetic algorithms, which cannot analyze cryptographic algorithms involving multiple rounds of encryption with the master key and are prone to local convergence when recovering the key. This invention proposes a side-channel analysis method using a multi-round key genetic algorithm for lightweight cryptography. This method enables energy analysis of parallel-implemented lightweight block ciphers and improves the key recovery success rate.

[0008] To achieve the above objectives, the present invention adopts the following technical solution.

[0009] A side-channel analysis method for multi-round key genetic algorithms in lightweight cryptography includes the following steps:

[0010] Step 1: Construct triples for round keys K1 and KT-1 respectively, and use a genetic algorithm to search in parallel for triples corresponding to round keys K0 and K1, as well as triples corresponding to KT-2 and KT-1.

[0011] In this context, the round key is a subkey generated from the master key using a key expansion algorithm in a block cipher algorithm, used for each round of operation; T is the encryption round number of the block cipher algorithm; K0 refers to the first round key; K1 refers to the second round key; KT-2 refers to the penultimate round key; KT-1 refers to the last round key; and a triple is a set of three elements used to represent a specific round key, with each element having the same number of bits as the round key.

[0012] Specifically, step 1 includes the following steps:

[0013] Step 1.1: The random number generator randomly generates the initial key, which is the individual in the population. The randomly generated individual is used as the initial population for evolution.

[0014] Here, an individual refers to a complete guessing key, which includes the triplet corresponding to the previous round key and the subsequent round key;

[0015] Step 1.2: Calculate the fitness of individuals in the population, including the following steps:

[0016] Step 1.2.1: Collect the energy traces generated during the encryption operation of the cryptographic algorithm;

[0017] Step 1.2.2: Calculate the correlation coefficient between the energy mapping of the intermediate value corresponding to the guessed key represented by each individual and the collected energy waveform;

[0018] The intermediate value refers to the value containing key-related information during the encryption process of the cryptographic algorithm;

[0019] The correlation coefficient represents the fitness of an individual.

[0020] Step 1.3: Perform three operations on individuals in the population: selection, crossover, and mutation to obtain the next generation of the population;

[0021] Among them, selection refers to choosing individuals with higher fitness in the population;

[0022] Here, crossover refers to randomly selecting a crossover point on an individual and swapping the bits after the crossover point between the two guessed keys;

[0023] Mutation refers to flipping a bit at a random position of the guessing key represented by an individual, with only one bit being mutated at a time.

[0024] Step 1.4: Repeat steps 1.2 to 1.3 until the upper limit of iterations is reached;

[0025] The upper limit of iterations ranges from 150 to 250.

[0026] Step 1.5: The value of the triple corresponding to the round keys K1 and KT-1 is equal to the individual with the highest fitness in the population.

[0027] Step 2: Fix the candidate keys K1 and KT-1, and use a genetic algorithm to search for K0 and KT-2.

[0028] Among them, the candidate key refers to the key guess that is closest to the correct key;

[0029] Specifically, step 2 includes the following steps:

[0030] Step 2.1: Based on the triples obtained in Step 1, derive the candidate keys K1 and KT-1;

[0031] Step 2.2: Following the methods described in Steps 1.1 to 1.5, after summing the energy mappings of the intermediate values ​​corresponding to the keys in two adjacent rounds, the correlation coefficient is calculated with the energy waveform to serve as the individual fitness, thus obtaining the final guessing results for K0 and KT-2.

[0032] Step 3: Fix the values ​​of K0 and KT-2, and use a genetic algorithm to search for K1 and KT-1 according to the method described in Step 2.2.

[0033] Step 4: Based on the first and last round keys recovered in Step 2 and Step 3, deduce the master key.

[0034] The beneficial effects contained in this application include at least the following:

[0035] 1. Compared with existing energy analysis methods based on genetic algorithms, the method provided in this application can analyze cryptographic algorithms in which the master key is distributed in multiple rounds of encryption.

[0036] 2. Compared with other side-channel methods based on genetic algorithms, the method provided in this application has lower computational complexity and higher recovery success rate when analyzing lightweight block cipher algorithms implemented in parallel.

[0037] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of this application. Attached Figure Description

[0038] The above and other objects, features, and advantages of the present disclosure will become more apparent from the more detailed description of the embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of the present disclosure and form part of the specification. They are used together with the embodiments of the present disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0039] Figure 1 This is a schematic diagram of the overall process provided for an embodiment of this application;

[0040] Figure 2 Energy waveform diagram provided for embodiments of this application;

[0041] Figure 3 This is a schematic diagram of a single-round encryption process provided in an embodiment of this application;

[0042] Figure 4 This is a schematic diagram of the first two rounds of encryption process provided in the embodiments of this application;

[0043] Figure 5 A flowchart of the genetic algorithm provided in the embodiments of this application;

[0044] Figure 6This is a schematic diagram of the individual structure provided in the embodiments of this application. Detailed Implementation

[0045] The technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without creative effort are within the scope of protection of this disclosure.

[0046] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application are further described in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be considered as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. In the following description, the term "optional implementation" is used, which describes a subset of all possible embodiments. However, it is understood that "optional implementation" can be the same subset or different subsets of all possible embodiments and can be combined with each other without conflict. The terms "first / second" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first / second" can be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application belongs. The terminology used herein is for the purpose of describing this application only and is not intended to limit this application.

[0047] This application provides an embodiment of a side-channel analysis method using a multi-round key genetic algorithm for lightweight cryptography. The overall process is as follows: Figure 1 As shown.

[0048] Taking the lightweight block cipher algorithm SIMON with a block length of 32 bits, a key length of 64 bits, and 32 encryption rounds as an example, the SIMON algorithm is implemented on the SAKURA-G development board. A fixed key is used to generate 200,000 random plaintext messages. The acquired energy waveforms are analyzed to recover the master key. The waveform diagram is shown below. Figure 2 As shown. Figure 3 This is a schematic diagram of a single round of encryption using the SIMON algorithm, where (Li, Ri) is the input of the i-th round, Ki is the round key, Sj represents the left shift of the j-th cycle, and & is the logical AND operator.

[0049] The master key is four times the length of the round keys and is distributed across the first four rounds of computation, denoted as (K0, K1, K2, K3). Since the key expansion process involves linear transformations, the master key and any round key can be derived from each other. Therefore, correctly recovering the values ​​of the first and last two round keys, i.e., K0, K1, KT-2, KT-1, is equivalent to recovering the master key. The energy mapping of the intermediate value corresponding to the round key Ki is the Hamming distance from Li to Li+1, i.e., the Hamming weight of Li⊕Li+1.

[0050] The specific key recovery process is as follows:

[0051] The triplet for the rear round keys K1 and KT-1 is constructed as follows:

[0052] Taking the construction of the triplet of K1 as an example, the general process of constructing the triplet of the subsequent key is explained.

[0053] Figure 4 In the first two rounds of the round-key encryption process, tmp represents the value before XORing with key K0 in the first round, a represents the value after cyclically shifting key K0 left by 1 bit, b represents the value after cyclically shifting key K0 left by 8 bits, and C represents the value after cyclically shifting key K0 left by 2 bits. Let d = (a∧b)⊕c⊕K1. Using a, b, and d to replace K1 as the recovery target, construct the triple (a, b, d). When recovering K0 and K1 in parallel, it is actually recovering K0 and a, b, and d.

[0054] The method to obtain the triplet guess value corresponding to the rear round key is as follows:

[0055] Taking the parallel recovery of the triples corresponding to K0 and K1 as an example, the general process of obtaining the triples corresponding to the subsequent round keys is explained as follows: Figure 5 As shown.

[0056] First, initialize the population.

[0057] An individual is defined as a complete guessing key containing K0 and a, b, d, and its construction is as follows: Figure 6 As shown, an initial key, which is the individual member of the population, is randomly generated by a random number generator. This randomly generated individual is used as the initial population for evolution.

[0058] Then, the fitness of individuals in the population is calculated.

[0059] Fitness is defined as the correlation coefficient between the energy mapping of the intermediate value corresponding to the guessed key represented by each individual and the collected energy waveform. The energy mapping of the intermediate value is obtained by calculating HW(L0⊕L1) + HW(L1⊕L2). Energy traces generated during the encryption operation of the cryptographic algorithm are collected, and leakage analysis is performed to find the leakage locations on the waveform. Based on the intermediate value and the waveform, the correlation coefficient can be calculated.

[0060] Next, the selection, crossover, mutation, and fitness calculation operations are performed sequentially. After Ngen iterations, the individual with the highest fitness in the population is output. The crossover rate is Pc, the mutation rate is Pm, and the fitness calculation is performed in the same way as described above.

[0061] Finally, the optimal individual K'0‖a'‖b'‖d' is output, and (a', b', d') is the corresponding triplet guess. Similarly, the triplet guesses for KT-1 can be obtained.

[0062] The final guess result of the previous round's key is obtained as follows:

[0063] Taking a fixed K1 and an adjusted K0 as an example, this describes the general process for obtaining the final guess result of the previous round key.

[0064] First, based on the previously obtained K'0 and triple (a', b', d'), calculate the guess key K'1 that is closest to the correct key, K'1=((a'∧b')⊕c'⊕d'.

[0065] Then, a genetic algorithm is used to search for K0. An individual is defined as a complete guessing key containing K0 and K'1, where the value of K'1 is fixed and known. The fitness definition remains unchanged. Following the genetic algorithm described above, the optimal individual K''0‖K'1 is obtained, and K''0 is the final guess result for K0. Similarly, the final guess result for KT-2 can be obtained.

[0066] The final guess result for the key in the next round is obtained as follows:

[0067] Taking a fixed K0 and an adjusted K1 as an example, this describes the general process for obtaining the final guess result of the key in the next round.

[0068] Similar to the aforementioned method, using a genetic algorithm to search for K1, with the individual definition and fitness definition remaining unchanged, we can obtain the optimal individual K''0‖K''1, where K''1 is the final guess result for K1. Similarly, we can obtain the final guess result for KT-1.

[0069] Based on the recovered first two round keys, the master key can be derived as follows:

[0070] From the recovered first two round keys K0 and K1, and the last two round keys KT-2 and KT-1, the values ​​of K2 and K3 are calculated. Through key expansion using a computer program, K0, K1, KT-2, KT-1 and K2, K3 can be expressed as the relationship shown in equation (1):

[0071] AK0+BK1+CK2+DK3= (1)

[0072] Where A, B, C, and D are all constant matrices of size 128*64, K2 and K3 can be expressed as equation (2):

[0073]

[0074] The master key can be represented as K = K0‖K1‖K2‖K3.

[0075] The parameters in the above process were set to Ngen=200, Pc=0.5, and Pm=0.006. Experiments were conducted, and the success rate and the number of energy traces required were statistically analyzed. The experimental results show that when the number of waveform traces is 100,000, the key recovery success rate is 90%.

[0076] In contrast, when using a simple genetic algorithm framework to recover the same simulated energy trace, the key recovery success rate was only 38% when the number of waveforms was 100,000.

[0077] It should be noted that the object information (including but not limited to the object's device information, corresponding personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the object or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0078] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0079] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of this application. It should be noted that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A lightweight cryptography oriented multi-round key genetic algorithm side-channel analysis method, said method being used in a legal scenario, characterized in that, The method comprises the following steps: step 1: three-tuples of round keys K1 and KT-1 are respectively constructed, and a genetic algorithm is used to search three-tuples corresponding to round keys K0 and K1 and three-tuples corresponding to KT-2 and KT-1 in parallel; Step 1 comprises the following steps: Step 1.1: a random number generator randomly generates an initial key, that is, an individual of a population, and the randomly generated individual is taken as an initial population for evolution; Step 1.2: the fitness of the individual in the population is calculated, comprising the following steps: Step 1.2.1: an energy trace generated in a cryptographic algorithm encryption operation process is collected; Step 1.2.2: the energy corresponding to the intermediate value of the guessed key represented by each individual is mapped, and a correlation coefficient calculation is performed on the collected energy waveform; Wherein the intermediate value is a value containing key-related information in the cryptographic algorithm encryption process; Wherein the correlation coefficient is the fitness of the individual; Step 1.3: the individual in the population is selected, crossed and mutated, and the next generation population is obtained; Step 1.4: steps 1.2 to 1.3 are repeated until the upper limit of iteration is reached; Wherein the value range of the upper limit of iteration is 150 to 250 times; Step 1.5: the value of the three-tuple corresponding to the round keys K1 and KT-1 is equal to the individual with the fitness in the population; Step 2: the candidate keys of K1 and KT-1 are fixed, and a genetic algorithm is used to search K0 and KT-2; Wherein the candidate key refers to the key guess value closest to the correct key; Specifically, step 2 comprises the following steps: Step 2.1: the candidate keys of K1 and KT-1 are derived according to the three-tuples obtained in step 1; Step 2.2: according to the method described in steps 1.1 to 1.5, the energy mapping of the intermediate values corresponding to the adjacent two round keys is summed, and the correlation coefficient is calculated with the energy waveform to serve as the fitness of the individual, thereby obtaining the final guess result of K0 and KT-2; Step 3: the values of K0 and KT-2 are fixed, and a genetic algorithm is used to search K1 and KT-1 according to the method described in step 2.2; Step 4: the master key is derived according to the first and last two round keys recovered in steps 2 and 3; The round key in step 1 is a sub-key generated by a master key through a key expansion algorithm in a block cipher algorithm for each round of operation; T is the number of encryption rounds of the block cipher algorithm; K0 refers to the first round key; K1 refers to the second round key; KT-2 refers to the second-to-last round key; KT-1 refers to the last round key; the three-tuple is a set of three elements used to represent a specific round key, and the number of bits of each element is the same as that of the round key; The individual in step 1.1 refers to a complete guessed key, which includes three-tuples corresponding to the front and rear round keys; The selection in step 1.3 refers to selecting individuals with higher fitness in the population.

2. The lightweight cipher oriented multi-round key genetic algorithm side channel analysis method according to claim 1, characterized in that: The crossover refers to randomly selecting a crossover point on the individual, and exchanging the bits after the crossover point of the two guessed keys; wherein the mutation refers to flipping a bit at a random position of the guessed key represented by the individual, and only one bit is flipped each time.

Images