Safety analysis method and system based on rotation symmetry and degree of freedom in S-box linearization
By constructing and solving the number of S-box linearized wheels based on rotation symmetry, the problem of unpredictable S-box linearization technology in the prior art is solved, and rapid security analysis and efficient attacks on the target algorithm are achieved.
Patent Information
- Application Number
- CN202411844916.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-13
- Publication Date
- 2025-04-15
AI Technical Summary
The rotational symmetry and freedom properties utilized in the existing S-box linearization technology are only for the Keccak algorithm, not universal, and cannot be widely used in other cryptographic algorithms.
By constructing a linearized wheel number inequality based on the S-box and its differential path probability with rotational symmetry, the inequality is solved to determine whether the target algorithm can be attacked by the S-box linearization technology, thereby achieving rapid judgment and improving attack efficiency.
This method can quickly determine whether the general target algorithm can use S-box linearization technology to attack, improve attack efficiency, reduce resource waste, and is applicable to all cryptographic algorithms with nonlinear structures.
Smart Images
Figure CN119834958A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of nonlinear drive components of block ciphers, and in particular to a security analysis method and system based on rotation symmetry and degrees of freedom in S-box linearization. Background Art
[0002] S-box is a nonlinear transformation in block cipher. After fully or partially linearizing the S-box, a connector can be established for the target algorithm, and then combined with the differential distinguisher, the target algorithm can be attacked. Therefore, the linearization property of the S-box has a great impact on the security of the algorithm. The attack method of S-box linearization refers to the idea of subspace traces. Through the linearization property of the S-box, a special subspace trace is established, and a plaintext linear affine subspace that meets the linearization conditions is obtained to carry out a collision attack on the target algorithm.
[0003] The rotation symmetry and degree of freedom properties currently used in the S-box linearization technology are only applicable to the Keccak algorithm and are not universal. Therefore, it is necessary to expand the above technology and design a general technology with a wider range of applications. Summary of the invention
[0004] In order to at least partially solve the problem that the rotation symmetry and degree of freedom properties used in the S-box linearization technology are only applicable to the Keccak algorithm and are not universal, the present invention provides a security analysis method and system based on the rotation symmetry and degree of freedom in the S-box linearization, constructs a linearization round number inequality through an S-box with rotation symmetry and its corresponding differential path probability, and obtains the lower bound of the linearization round number of the S-box of the target algorithm by solving the linearization round number inequality, thereby judging whether the target algorithm can be attacked by the S-box linearization technology, thereby realizing a quick judgment on whether a general target algorithm can be attacked by the S-box linearization technology, improving the efficiency of the S-box linearization attack, and reducing resource waste.
[0005] In order to achieve the above object, the technical solution of the present invention is:
[0006] The first aspect of the present invention proposes a security analysis method based on rotation symmetry and degrees of freedom in S-box linearization, comprising:
[0007] Step 1: According to the target algorithm, an S-box with rotation symmetry and its corresponding differential path probability are obtained, so as to obtain the lower bound of the number of linearized rounds of the S-box with rotation symmetry;
[0008] Step 2: Construct a linearized round number inequality based on the S-box with rotation symmetry and its corresponding differential path probability, and solve the linearized round number inequality to determine whether the target algorithm can be attacked by the S-box linearization technology;
[0009] Step 3: Determine whether the target algorithm can be attacked using the S-box linearization technique based on the solution to the linearization round number inequality.
[0010] Furthermore, the S-box with rotation symmetry includes the following necessary and sufficient conditions:
[0011] y i =x j ⊕…⊕x k x l ⊕…⊕x m …x s ⊕…,0≤i,h,k,l,m,s <n,n≥2
[0012] Among them, y i is the i-th bit of the S-box output, x j is the jth bit of the S-box input, x k is the kth bit of the S-box input, x l is the lth bit of the S-box input, x m is the mth bit of the S-box input, x s is the sth bit of the S-box input, and n is the size of the S-box.
[0013] Furthermore, the S-box with rotation symmetry also includes the following necessary and sufficient conditions:
[0014] Assume that:
[0015] y i =…⊕x i1 ⊕…
[0016] y i+1 =…⊕x i2 ⊕…
[0017] y i+2 =…⊕x i3 ⊕…
[0018] Then we have:
[0019] x i1 -x i2 =x i2 -x i3 mod n
[0020] Among them, ⊕ is the exclusive OR operation, x i1 is the i1th bit of the S-box input, mod is the modulus operation, y i is the i-th bit output by the S-box.
[0021] Furthermore, the linearized round number inequality is constructed according to the S-box with rotation symmetry and its corresponding differential path probability, specifically including:
[0022] The degrees of freedom of the plaintext space in the first round of linearization are calculated to facilitate the construction of the linearization round number inequality;
[0023] When all S-boxes need to be linearized, the linearization round number inequality is obtained according to the differential path probability and the degree of freedom of the plaintext space.
[0024] Furthermore, the degrees of freedom of the plaintext space of the first round of linearization is expressed by the following formula:
[0025]
[0026] Among them, Q is the degree of freedom of the plaintext space in the first round of linearization, m is the number of S-boxes, is the degree of freedom of the jth S-box input space in the first round, and l is the degree of freedom consumed by initialization.
[0027] Furthermore, the linearization round number inequality is expressed by the following formula:
[0028]
[0029] Where r is the number of linearization rounds, k is the kth linearization round, and p is the negative logarithm of the probability of attacking the differential path given by the target algorithm.
[0030] Furthermore, the step three comprises:
[0031] If the linearization round number inequality can be solved to obtain the maximum positive integer, then the maximum positive integer is the lower bound of the linearization round number, and the target algorithm can be attacked by the S-box linearization technique;
[0032] If there is no maximum positive integer that satisfies the linearization round number inequality, it means that the target algorithm cannot be attacked by the S-box linearization technique.
[0033] The second aspect of the present invention proposes a safety analysis system based on rotation symmetry and degrees of freedom in S-box linearization, comprising:
[0034] A collection module is used to obtain an S-box with rotation symmetry and its corresponding differential path probability according to a target algorithm, so as to obtain a linearized lower bound of the number of rounds of the S-box with rotation symmetry;
[0035] A processing module is used to construct a linearized round number inequality according to an S-box with rotation symmetry and its corresponding differential path probability, and solve the linearized round number inequality to facilitate determining whether the target algorithm can be attacked by the S-box linearization technology;
[0036] The calculation module is used to determine whether the target algorithm can be attacked by using the S-box linearization technology according to the solution of the linearization round number inequality.
[0037] The third aspect of the present invention proposes an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the security analysis method based on the rotation symmetry and degrees of freedom in S-box linearization as described in the first aspect above is implemented.
[0038] The fourth aspect of the present invention proposes a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the security analysis method based on the rotation symmetry and degrees of freedom in S-box linearization as described in the first aspect above.
[0039] Beneficial effects of the present invention:
[0040] The invention constructs a linearization round number inequality by obtaining the degree of freedom of the plaintext space, and determines the linearization round number of the S-box according to the maximum positive integer of the obtained linearization round number inequality, so as to quickly judge whether a general target algorithm can be attacked by using the S-box linearization technology, and quickly obtains the linear affine subspace of the S-box to linearize it, and calculates the number of rounds that can be linearized. The invention is applicable to all cryptographic algorithms with nonlinear structures, improves the efficiency of the S-box linearization attack, and reduces the waste of resources. BRIEF DESCRIPTION OF THE DRAWINGS
[0041] Figure 1 A flowchart of a security analysis method based on rotation symmetry and degrees of freedom in S-box linearization provided in an embodiment of the present invention.
[0042] Figure 2 An architectural diagram of a security analysis system based on rotation symmetry and degrees of freedom in S-box linearization provided in an embodiment of the present invention. DETAILED DESCRIPTION
[0043] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution in the embodiment of the present invention will be clearly described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0044] Example 1
[0045] like Figure 1 As shown in the figure, the safety analysis method based on the rotation symmetry and degree of freedom in S-box linearization includes:
[0046] S101: Obtain an S-box with rotation symmetry and its corresponding differential path probability according to a target algorithm.
[0047] S102: construct a linearized round number inequality based on the S-box with rotation symmetry and its corresponding differential path probability, and solve the linearized round number inequality.
[0048] S103: Determine whether the target algorithm can be attacked using the S-box linearization technique based on the solution of the linearization round number inequality.
[0049] The present invention constructs a linearized round number inequality through differential path probability and plaintext space degree of freedom, solves the linearized round number inequality, and the maximum positive integer solution of the inequality is the linearized round number lower bound. If the inequality has no maximum positive integer solution, it means that the target algorithm cannot be attacked using the S-box linearization technology. The above method can quickly determine whether a general target algorithm can be attacked using the S-box linearization technology, and the present invention is applicable to all cryptographic algorithms with nonlinear structures, improves the efficiency of the S-box linearization attack, and reduces resource waste.
[0050] Example 2
[0051] Based on the above embodiment, the embodiment of the present invention provides a construction process of a linearized round number inequality, which specifically includes:
[0052] Specifically, the following terms are explained first. The definition of linear affine subspace is as follows:
[0053] A linear affine subspace is an input affine space. For an n-input n-output S-box, when its input is selected in this space, the S-box transformation is equivalent to a linear transformation. If V is a linear affine subspace of some S-box transformation S(·), then where A is an n×n matrix, b is an n-bit constant, and x is a linear affine subspace.
[0054] The definition of Keccak-like S-box is as follows:
[0055] Let F n : The nonlinear transformation of the Keccak algorithm is f(x0,x1,x2)=x0⊕x1x2⊕x2. n Satisfy i =x i ⊕x i+1 x i+2 ⊕x i+2 , 0≤i<n, n≥3, then it is called F n is an n-ary Keccak-type S-box.
[0056] in, is an n-dimensional vector space on a binary domain, f(x0,x1,x2) is the nonlinear transformation output of the Keccak algorithm, x i is the lth bit of the S-box input, y i is the i-th bit of the S-box output, n is the size of the S-box (i.e., the S-box has n-bit input and n-bit output), X is the input vector of the S-box, and Y is the output vector of the S-box.
[0057] Starting from the S-box of Keccak algorithm, the structural characteristics of the S-box with rotation symmetry are analyzed.
[0058] For the Keccak class S-box, assume that an affine subspace has been found, which can express the S-box transformation as:
[0059] S(x)=A·x
[0060]
[0061] Among them, A is the coefficient matrix.
[0062] If the S-box has rotation symmetry, then by using the rotation symmetry, we can get the four linear affine subspaces of the S-box after rotation. The coefficient matrices are recorded as A1, A2, A3, and A4 respectively. The four coefficient matrices are expressed as follows:
[0063]
[0064]
[0065] Then, the conclusion can be extended to general S-boxes with similar characteristics, and the rotation symmetry can be used to quickly find the affine subspace of the S-box and perform linearization.
[0066] S-box transformation S(X)=Y,X=(x0,x1,…,x n-1 ), S n has rotation symmetry if and only if (1)y i =x j ⊕…⊕x k x l ⊕…⊕x m …x s ⊕…,0≤i,j,k,l,m,s <n,n≥2。
[0067] Among them, y i is the i-th bit of the S-box output, x j is the jth bit of the S-box input, x k is the kth bit of the S-box input, x lis the lth bit of the S-box input, x m is the mth bit of the S-box input, x s is the sth bit of the S-box input, and n is the size of the S-box.
[0068] Each output y i The algebraic expression form of is the same, that is, the number of terms of each order is equal, for example, they all contain i linear terms and j quadratic terms;
[0069] (2) Assume that:
[0070] y i =…⊕x i1 ⊕…
[0071] y i+1 =…⊕x i2 ⊕…
[0072] y i+2 =…⊕x i3 ⊕…
[0073] Then we have:
[0074] x i1 -x i2 =x i2 -x i3 mod n
[0075] That is, for any adjacent y i and i+1 The difference in the subscripts of x at the same position in the expression is the same.
[0076] At the same time, the impact of linearization on the degrees of freedom is analyzed, the analysis of the degrees of freedom when using linearization technology to attack is modeled, and a general method for calculating the number of rounds that can be linearized using the degrees of freedom is given.
[0077] The degrees of freedom of the j-th S-box input space in the i-th round is The number of S-boxes in each round is m, and the initialization consumed degrees of freedom is l (l can be 0). After r rounds of linearization, the remaining degrees of freedom available for attack are:
[0078]
[0079] Among them, DF is the remaining degrees of freedom available for attack after r rounds of linearization, m is the number of S boxes in each round, l is the degrees of freedom consumed by initialization, is the degrees of freedom of the j-th S-box input space in the i-th round, and r is the number of linearization rounds.
[0080] In actual collision attacks, connectors are constructed based on existing high-probability differential paths, and then collision attacks are carried out. However, regardless of whether the final collision attack can be effectively implemented, as long as a differential path is given, the corresponding connector can be constructed. If the final path cannot achieve the collision attack to find the summary collision, a lot of resources will be wasted. Therefore, for a given differential path, it is necessary to first determine whether it can be used as the starting point for the actual collision attack. The algorithm for determining the number of linearizable rounds is as follows:
[0081] After the first round of linearization of the S-box, the degrees of freedom of the plaintext space are obtained as follows:
[0082] Among them, Q is the degree of freedom of the plaintext space in the first round of linearization, m is the number of S-boxes, is the degree of freedom of the jth S-box input space in the first round, and l is the degree of freedom consumed by initialization.
[0083] The degrees of freedom consumed in each subsequent linearization round are treated as the worst case, that is, all S-boxes need to be linearized. The degrees of freedom consumed in each subsequent linearization round are expressed as
[0084] Let the probability of differential path be 2 -p , where p is the negative logarithm of the probability of attacking the differential path given by the target algorithm. According to the linearized round number inequality Find the largest positive integer that satisfies the inequality r , this positive integer is the lower bound of the number of linearization rounds. If there is no such positive integer r , indicating that the target algorithm cannot be attacked by linearization technology.
[0085] Example 3
[0086] Based on the above embodiments, Figure 2 As shown, an embodiment of the present invention provides a security analysis system based on rotation symmetry and degrees of freedom in S-box linearization, including:
[0087] The collection module is used to obtain an S-box with rotation symmetry and its corresponding differential path probability according to a target algorithm.
[0088] The processing module is used to construct a linearized round number inequality according to the S-box with rotation symmetry and its corresponding differential path probability, and solve the linearized round number inequality.
[0089] The calculation module is used to determine whether the target algorithm can be attacked by using the S-box linearization technology according to the solution of the linearization round number inequality.
[0090] It should be noted that the security analysis system based on rotation symmetry and degrees of freedom in S-box linearization provided in the embodiment of the present invention is to implement the security analysis method based on rotation symmetry and degrees of freedom in S-box linearization in the above-mentioned embodiment. Its specific functions can be referred to the above-mentioned method embodiments, which will not be repeated here.
[0091] Example 4
[0092] Corresponding to the above method, an embodiment of the present invention provides an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the security analysis method based on the rotation symmetry and degrees of freedom in S-box linearization as in the above embodiment.
[0093] An embodiment of the present invention provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute a security analysis method based on rotation symmetry and degrees of freedom in S-box linearization as described in the above embodiment.
[0094] In summary, the present invention constructs a linearization round number inequality by obtaining the degree of freedom of the plaintext space, and determines the linearization round number of the S-box according to the maximum positive integer of the obtained linearization round number inequality, so as to quickly judge whether a general target algorithm can be attacked using the S-box linearization technology, and quickly obtain the linear affine subspace of the S-box to linearize it, and calculate the number of rounds that can be linearized. The present invention is applicable to all cryptographic algorithms with nonlinear structures, improves the efficiency of the S-box linearization attack, and reduces resource waste.
[0095] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A safety analysis method based on rotation symmetry and degrees of freedom in S-box linearization, characterized in that: include: Step 1: Obtain an S-box with rotation symmetry and its corresponding differential path probability according to the target algorithm; Step 2: Construct a linearized round number inequality based on the S-box with rotation symmetry and its corresponding differential path probability, and solve the linearized round number inequality; Step 3: Determine whether the target algorithm can be attacked using the S-box linearization technique based on the solution to the linearization round number inequality.
2. The security analysis method based on rotation symmetry and degrees of freedom in S-box linearization according to claim 1 is characterized in that: The S-box with rotation symmetry includes the following necessary and sufficient conditions: Among them, y i is the i-th bit of the S-box output, x j is the jth bit of the S-box input, x k is the kth bit of the S-box input, x l is the lth bit of the S-box input, x m is the mth bit of the S-box input, x s is the sth bit of the S-box input, and n is the size of the S-box.
3. The method and system for security analysis based on rotation symmetry and degrees of freedom in S-box linearization according to claim 1, characterized in that: The S-box with rotation symmetry also includes the following necessary and sufficient conditions: Assume that: Then we have: x i1 -x i2 =x i2 -x i3 modern in, is an XOR operation, x i1 is the i1th bit of the S-box input, mod is the modulus operation, y i is the i-th bit output by the S-box.
4. The security analysis method based on rotation symmetry and degrees of freedom in S-box linearization according to claim 1 is characterized in that: The linearized round number inequality is constructed according to the S-box with rotation symmetry and its corresponding differential path probability, specifically including: Calculate the degrees of freedom of the plaintext space in the first round of linearization; When all S-boxes need to be linearized, the linearization round number inequality is obtained according to the differential path probability and the degree of freedom of the plaintext space.
5. The security analysis method based on rotation symmetry and degrees of freedom in S-box linearization according to claim 4 is characterized in that: The degrees of freedom of the plaintext space in the first round of linearization is expressed as follows: Among them, Q is the degree of freedom of the plaintext space in the first round of linearization, m is the number of S-boxes, is the degree of freedom of the jth S-box input space in the first round, and l is the degree of freedom consumed by initialization.
6. The security analysis method based on rotation symmetry and degrees of freedom in S-box linearization according to claim 5 is characterized in that: The linearization round number inequality is expressed as follows: Where r is the number of linearization rounds, k is the kth linearization round, and p is the negative logarithm of the probability of attacking the differential path given by the target algorithm.
7. The security analysis method based on rotation symmetry and degrees of freedom in S-box linearization according to claim 1 is characterized in that: The step three comprises: If the linearization round number inequality can be solved to obtain the maximum positive integer, then the maximum positive integer is the lower bound of the linearization round number, and the target algorithm can be attacked by the S-box linearization technique; If there is no maximum positive integer that satisfies the linearization round number inequality, it means that the target algorithm cannot be attacked by the S-box linearization technique.
8. A safety analysis system based on rotation symmetry and degrees of freedom in S-box linearization, characterized in that: include: A collection module, used for obtaining an S-box with rotation symmetry and its corresponding differential path probability according to a target algorithm; A processing module, used for constructing a linearized round number inequality according to an S-box with rotation symmetry and its corresponding differential path probability, and solving the linearized round number inequality; The calculation module is used to determine whether the target algorithm can be attacked by using the S-box linearization technology according to the solution of the linearization round number inequality.
9. An electronic device, characterized in that: It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the security analysis method based on the rotation symmetry and degree of freedom in S-box linearization as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: The storage medium includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the security analysis method based on the rotation symmetry and degree of freedom in S-box linearization as described in any one of claims 1 to 7.