ARX type block cipher optimal differential feature search method based on GPU

Abstract

The invention discloses an ARX type block cipher optimal differential feature search method based on a GPU. The method comprises the steps that firstly, a high-probability differential transfer is selected to divide the whole search process into a forward search part and a reverse search part; taking differential transfer construction and probability calculation as kernel functions, designing a parallel scheme based on a GPU, and carrying out parallel calculation on differential transfer probabilities of different states in each round; based on a GPU parallel computing result and a set probability threshold value as judgment conditions of pruning in the search process, searching the optimal differential features round by round according to a branch and bound strategy, completing forward and reverse search, and obtaining the optimal differential features of the two parts; and finally, splicing the optimal difference features of the two parts to obtain the optimal difference feature of the complete number of rounds. When the method is used for searching, the recursion depth can be effectively reduced, the searching efficiency is improved through parallel calculation, the calculation time is shortened, and the searching speed of the optimal difference feature of the ARX type block cipher is improved.

Description

Technical Field

[0001] The invention relates to the field of information security, and in particular to a GPU-based ARX block cipher optimal differential feature search method. Background Art

[0002] ARX ​​is a commonly used structure in the design of block cipher algorithms. It realizes the nonlinearity, obfuscation and diffusion of the algorithm by using three basic operations: modular addition, circular shift and XOR. The advantages of this structure are simple algorithm design and high execution efficiency. Differential cryptanalysis is one of the most effective methods to attack iterative block ciphers. The key recovery attack on block cipher algorithms can be carried out by using high-probability differential features. The optimal differential feature is usually used to evaluate the ability of block cipher algorithms to resist differential attacks. The search for the optimal differential feature refers to finding a specific differential feature among all possible differential features, which appears with the highest probability after iterating the round function of the cryptographic algorithm. However, it is very time-consuming to find the optimal differential feature of a block cipher, which usually requires analyzing millions of differences between plaintext and ciphertext pairs. Therefore, the search for the optimal differential feature and how to accelerate the search process have attracted widespread attention from researchers.

[0003] The core idea of ​​the existing bottom-up search method for the optimal differential feature search problem of ARX block ciphers is based on the branch and bound (B&B) strategy. According to the differential propagation characteristics of each component in the round function of the cryptographic algorithm, the differential features are searched one round at a time. During the search process, the search space is limited and the search branch direction is controlled according to the probability threshold. When the branch cannot continue to derive sub-branches, it is backtracked round by round until the target number of search rounds is reached and the optimal differential feature is searched to end the entire search process. However, the existing method faces some problems: (1) Since the differential transition probability of the nonlinear module needs to be calculated round by round during the search process, and the differential transition probability calculation needs to be performed once for each possible differential transition, the computational overhead of the probability value calculation is too high; (2) Since the optimal differential feature is searched iteratively round by round, and the probability of the differential feature needs to be backtracked round by round during the search process to verify whether it is optimal, the search recursion depth increases in the case of multiple rounds of search, and the computational overhead is further increased, which greatly reduces the search speed. Summary of the invention

[0004] Aiming at the problems of large computational overhead and slow search speed in the existing bottom-up search method for the optimal differential feature search of ARX type block cipher, the present invention proposes a GPU-based ARX type block cipher optimal differential feature search method, which first selects a high-probability differential transfer to split the entire search process into two parts, namely, forward search and reverse search, and reduces the recursive depth of the search by reducing the number of rounds; takes differential transfer construction and probability calculation as kernel functions, designs a GPU-based parallel scheme, and parallelly calculates the differential transfer probabilities of different states in each round to improve the computational efficiency; based on the GPU parallel calculation results and the probability threshold set for guiding the pruning operation, performs pruning judgment in the forward search and reverse search processes respectively, completes the search for all rounds, and obtains the optimal differential features of the two parts; finally, the optimal differential features of the two parts are spliced ​​to obtain the optimal differential features of the complete number of rounds, and the optimal differential feature search of the ARX type block cipher is completed.

[0005] The technical solution for achieving the purpose of the present invention is:

[0006] A GPU-based ARX block cipher optimal differential feature search method comprises the following steps:

[0007] (1) Select a high-probability differential transition to split the search process;

[0008] Select a differential transition with high probability as the splicing position, split the multi-round search into two parts: forward search and reverse search, and perform the search separately to reduce the recursive depth of the search;

[0009] (2) Design a GPU parallel computing solution using differential transfer construction and probability calculation as kernel functions;

[0010] In each round of the forward and reverse search process, a differential transfer needs to be constructed on each bit state and the probability needs to be calculated. To improve the efficiency of construction and calculation, a parallel computing solution based on GPU is designed with differential transfer construction and probability calculation as kernel functions. Each kernel function calculates the differential transfer probability of a state of the set parallel scale in each round, and the computing efficiency is improved through parallel computing.

[0011] (3) Based on GPU parallel computing, a bidirectional search is completed to obtain the optimal differential features of the two parts;

[0012] In order to improve the overall search speed, we first perform a forward search starting from the splicing position. Based on the GPU parallel computing results and the set probability threshold as the judgment condition for pruning during the search process, we search for the optimal differential features round by round according to the branch and bound strategy to obtain the optimal differential features of the forward search. Then, we continue to perform a reverse search in the same way to obtain the optimal differential features of the reverse search.

[0013] (4) Concatenate the two parts of the best differential features to obtain the overall best differential features;

[0014] The two parts of the optimal differential features obtained by the forward search and the reverse search are concatenated to obtain the optimal differential feature of the ARX block cipher algorithm as a whole, and the probability of the optimal differential feature is updated.

[0015] In the GPU-based ARX type block cipher optimal differential feature search method of the present invention, the step (1) of selecting a high-probability differential transfer to split the search process is as follows:

[0016] (1.1) In order to reduce the problem of excessive recursion depth caused by multiple rounds of search, the entire search problem is split into two parts based on the splicing position to reduce the overall recursion depth; since many optimal differential features of ARX block ciphers have special internal differential transfers in the middle rounds, that is, the differential transfer has only one non-zero bit, a differential transfer with a probability of 1 is selected as the differential transfer at the splicing position; according to the modular addition operation, the differential transfer at the splicing position is set to: input differential value α = 0x8...0, input differential value β = 0x0...0, output differential value γ = 0x8...0, where 0x represents hexadecimal, and the values ​​in the ellipsis are all 0. Assuming that the complete bit length of the modular addition operation is L, the number of 0s num = (L-8) / 4;

[0017] (1.2) Assuming the target search round number is N, then the round number of the splicing position is in represents rounding up;

[0018] (1.3) The search direction of N rounds of searching from the splicing position to the target is called forward search, and the search direction of the splicing position to the first round is called reverse search. Let the number of rounds of forward search be X and the number of rounds of reverse search be Y, then N=X+Y+1.

[0019] In the GPU-based ARX block cipher optimal differential feature search method of the present invention, the GPU parallel computing scheme is designed using differential transfer construction and probability calculation as kernel functions in step (2), and the specific steps are as follows:

[0020] In each round of the forward and reverse search process, a differential transfer needs to be constructed and the probability calculated on the state bit of each bit of the output differential value. If the output differential value is 16 bits, then in the worst case, there are 2 differential transfers and probability calculations to be constructed. 16times; the existing method uses CPU calculation, which takes a lot of time and is inefficient; in order to improve the efficiency of construction and calculation, a GPU-based parallel computing solution is designed with differential transfer construction and probability calculation as kernel functions. Each kernel function calculates the differential transfer probability of a state of the set parallel scale in each round, and the computing efficiency is improved through parallel computing, as follows:

[0021] (2.1) To ensure that the calculation of each thread corresponds to a different state, each thread is bound to the data of a certain state of the output differential value, as follows:

[0022] (2.1.1) In order to improve the efficiency of data transmission between the CPU and GPU, the number of differential transfers and probability calculations constructed by the GPU in parallel each time is set, that is, the parallel scale is m. Here, m=256, then m threads need to be started in the GPU for parallel calculation each time, and each thread executes the kernel function to complete the differential transfer construction and probability calculation of a state;

[0023] (2.1.2) In order to improve the utilization of GPU, thread blocks are usually generated in GPU first, and the number of threads generated in each thread block is usually an integer multiple of 32; assuming that the number of threads in each thread block generated by GPU is blockDim, the index of each thread block is blockIdx, and the index of each thread in its thread block is threadIdx, then the thread number tid of each thread can be uniquely calculated, tid = blockDim × blockIdx + threadIdx;

[0024] (2.1.3) Each thread takes its thread number tid as part of the output differential value to be constructed, denoted as γ tid , γ tid =tid, the thread number can be bound to the data of a certain state of the output differential value to ensure that the data in each thread is different;

[0025] (2.2) The kernel function differential transfer construction and probability calculation are completed in each thread, as follows:

[0026] (2.2.1) Assume that the differential transfer bit length to be constructed is l, and l is equal to an integer multiple of log2 m , where log2 m represents the bit length obtained by taking the logarithm of the parallel scale m; based on l, a mask mask is used to truncate the input difference values ​​α and β passed into the kernel function, retaining the least significant bits. in represents the logical negation operation, ULL represents an unsigned long integer variable, >> represents the right shift operation, α=α&mask, β=β&mask, where & represents the bitwise AND operation;

[0027] (2.2.2) Use mask mask to truncate the output difference value γ passed into the kernel function, retaining the least significant bits, that is, γ = γ & mask; then compare the truncated γ with the γ bound to the thread number. tid Combine them to get the complete output difference value γ=γ|(γ tid <<(l-log2 m )), where | represents a bitwise OR operation;

[0028] (2.2.3) Calculate the probability of differential transfer P. If and only if the XOR result of the least significant bit of the three differential values ​​α, β and γ is 0, and the value of a certain bit position in the middle is the same except for the most significant bit, and this value is equal to the XOR result of the bit value of the most significant bit of the current bit position, the differential transfer that meets this condition is a feasible differential transfer, and the probability is non-zero, and the probability value is in Among them, α[i], β[i] and γ[i] represent the values ​​of the i-th bit of α, β and γ respectively, and eq is used to determine whether the bit values ​​of the variables are the same;

[0029] (2.3) The differential transition (α, β→γ) and the differential transition probability P are returned to the CPU.

[0030] In the GPU-based ARX type block cipher optimal differential feature search method of the present invention, the step (3) described in the GPU-based parallel computing is used to complete the bidirectional search to obtain the two parts of the optimal differential features. The specific steps are as follows:

[0031] (3.1) The process of forward search for the optimal differential feature is as follows:

[0032] (3.1.1) Let BPfe be the probability threshold used for pruning decision in forward search. This threshold is an estimated value. BPfe1 represents the optimal probability estimate of one round of forward search. Since the optimal probability value of the splicing position is 1, let BPfe1 = 1 / 4; and the optimal probability estimate of round i is equal to half of the optimal probability estimate of round i-1, that is, BPfe i =BPfe i-1 / 2;

[0033] (3.1.2) For a forward search involving X rounds, the current round number is i, let i = 1, if i ≤ X, then:

[0034] (3.1.2.1) According to the complete bit length L of the modular addition operation, the total number of times the kernel function needs to be called in each round is determined to be L / log2 m , when the kernel function is called for the jth time in each round, the relationship between the bit length l and j of the differential transfer to be constructed is l = j × log2 m , let j = 1; define a three-dimensional array XDP[i][j][k] to store the differential transfer and differential transfer probability results of m GPU threads calculated by calling the kernel function for different times in each round, where the current round number i∈[1,X], the number of times the kernel function is called in the current round j∈[1,L / log2 m ], each time a kernel function is called to start a GPU thread k∈[0,m-1], let k=0;

[0035] (3.1.2.2) Assume that the round function of the cryptographic algorithm is F, perform forward search in the encryption direction, and perform cyclic shift or XOR operation on the input differential values ​​α and β according to the structure of F before entering the modular addition operation of F;

[0036] (3.1.2.3) The input differential values ​​α and β, the output differential value γ, and the bit length l of the differential transfer to be constructed are used as parameter inputs of the kernel function of the host CPU calling the device GPU;

[0037] (3.1.2.4) The device starts m GPU threads for parallel execution. Each thread executes the kernel function operation according to the input parameters, constructs the differential transfer and calculates the probability, and returns the result;

[0038] (3.1.2.5) The host obtains all differential transitions (α, β→γ) and differential transition probabilities P returned by the device, and stores the obtained results in the three-dimensional array XDP[i][j][k] according to the number of search rounds, the number of kernel functions called in each round, and the number of GPU threads started each time;

[0039] (3.1.2.6) Let k = 0, the host reads data XDP[i][j][k];

[0040] (3.1.2.7) The host uses all the optimal probabilities in the previous X-1 rounds and the differential transfer probabilities in XDP[i][j][k] as pruning conditions, first verifying Is it established, among which, represents the product of the differential transition probabilities constructed in each round in the first i-1 rounds during the current search process, BPf X-i represents the optimal probability of Xi round; if it is true, go to (3.1.2.8), otherwise let k=k+1, go to (3.1.2.10);

[0041] (3.1.2.8) Determine whether the currently constructed differential transfer bit length l is equal to the complete bit length L of the modular addition operation. If l = L, go to (3.1.2.9), otherwise let j = j + 1 and go to (3.1.2.3);

[0042] (3.1.2.9) Determine whether the current search round number i is the forward search target round number X. If so, go to (3.1.2.15). Otherwise, perform cyclic shift or XOR operation on the input differential values ​​α and β entering the next round according to the round function F, set the output differential value γ to 0, set i = i + 1, j = 1, and go to (3.1.2.2) to enter the next round of search;

[0043] (3.1.2.10) The host uses all the optimal probabilities of the previous X-1 rounds and the differential transfer probabilities in XDP[i][j][k] as pruning conditions and re-verifies Is it true? If so, go to (3.1.2.8); otherwise, go to (3.1.2.11);

[0044] (3.1.2.11) Determine whether k=m-1 holds. If so, go to (3.1.2.12). Otherwise, set k=k+1 and go to (3.1.2.10).

[0045] (3.1.2.12) Determine if l>log2 m Is it true? If so, go to (3.1.2.13); otherwise, go to (3.1.2.14);

[0046] (3.1.2.13) The search method traces back to the last differential transfer construction process of the current round, set j = j-1, k = k+1, and go to (3.1.2.10);

[0047] (3.1.2.14) The search method traces back to the last differential transfer construction process in the previous round, and sets i = i-1, j = L / log2 m , k=k+1, go to (3.1.2.10);

[0048] (3.1.2.15) Transfer each round of differences obtained in the current forward search (α, β→γ) i The differential transfer at the splicing position performs a cyclic shift or XOR operation according to the encryption direction and the round function F to obtain the complete output differential value Tf of each round i The complete output difference value Df obtained by the forward operation at the splicing position is obtained to obtain the optimal differential feature BTf of the forward search X rounds X ={Df,Tf1,Tf2,…,Tf X}, forward search for the optimal differential feature probability BPf of round X X =P1×P2×…×P X, end the forward search process;

[0049] (3.2) The reverse search process for the optimal differential feature is as follows:

[0050] (3.2.1) Let BPbe be the probability threshold used for pruning decision in reverse search. This threshold is an estimated value. BPbe1 represents the optimal probability estimate of the reverse search round 1. Since the optimal probability value of the splicing position is 1, let BPbe1 = 1 / 4; and the optimal probability estimate of round i is equal to half of the optimal probability estimate of round i-1, that is, BPbe i =BPbe i-1 / 2; Set the three-dimensional array XDP[][][] to empty;

[0051] (3.2.2) For a reverse search involving Y rounds, the current round number is i, let i = 1, if i ≤ Y, then:

[0052] (3.2.2.1) According to the complete bit length L of the modular addition operation, the total number of times the kernel function needs to be called in each round is determined to be L / log2 m , when the kernel function is called for the jth time in each round, the relationship between the bit length l and j of the differential transfer to be constructed is l = j × log2 m , let j = 1; the three-dimensional array XDP[i][j][k] stores the differential transfer and differential transfer probability results of the m GPU threads calculated by calling the kernel function for different times in each round, where the current round number i∈[1,Y], the number of times the kernel function is called in the current round j∈[1,L / log2 m ], each time a kernel function is called to start a GPU thread k∈[0,m-1], let k=0;

[0053] (3.2.2.2) Assume that the round function of the cryptographic algorithm is F, perform a reverse search in the decryption direction, and perform a circular shift or XOR operation on the input differential values ​​α and β according to the structure of F before entering the modular addition operation of F;

[0054] (3.2.2.3) The input differential values ​​α and β, the output differential value γ, and the bit length l of the differential transfer to be constructed are used as parameter inputs of the kernel function of the host CPU calling the device GPU;

[0055] (3.2.2.4) The device starts m GPU threads for parallel execution. Each thread executes the kernel function operation according to the input parameters, constructs the differential transfer and calculates the probability, and returns the result;

[0056] (3.2.2.5) The host obtains all differential transitions (α, β→γ) and differential transition probabilities P returned by the device, and stores the obtained results in the three-dimensional array XDP[i][j][k] according to the number of search rounds, the number of kernel functions called in each round, and the number of GPU threads started each time;

[0057] (3.2.2.6) Let k = 0, the host reads data XDP[i][j][k];

[0058] (3.2.2.7) The host uses all the optimal probabilities in the previous Y-1 rounds and the differential transfer probabilities in XDP[i][j][k] as pruning conditions, first verify Is it established, among which, represents the product of the differential transition probabilities constructed in each round in the first i-1 rounds during the current search process, BPb Y-i represents the optimal probability of Yi round; if it is true, go to (3.2.2.8), otherwise let k=k+1 and go to (3.2.2.10);

[0059] (3.2.2.8) Determine whether the currently constructed differential transfer bit length l is equal to the complete bit length L of the modular addition operation. If l = L, go to (3.2.2.9), otherwise let j = j + 1 and go to (3.2.2.3);

[0060] (3.2.2.9) Determine whether the current search round number i is the reverse search target round number Y. If so, go to (3.2.2.15). Otherwise, perform cyclic shift or XOR operation on the input differential values ​​α and β entering the next round according to the round function F, set the output differential value γ to 0, set i=i+1, j=1, and go to (3.2.2.2) to enter the next round of search;

[0061] (3.2.2.10) The host uses all the optimal probabilities of the previous Y-1 rounds and the differential transfer probabilities in XDP[i][j][k] as pruning conditions and re-verifies Is it true? If so, go to (3.2.2.8); otherwise, go to (3.2.2.11);

[0062] (3.2.2.11) Determine whether k=m-1 holds. If so, go to (3.2.2.12). Otherwise, set k=k+1 and go to (3.2.2.10).

[0063] (3.2.2.12) Determine if l>log2 m Is it true? If so, go to (3.2.2.13); otherwise, go to (3.2.2.14);

[0064] (3.2.2.13) The search method traces back to the last differential transfer construction process of the current round, set j = j-1, k = k+1, and go to (3.2.2.10);

[0065] (3.2.2.14) The search method traces back to the last differential transfer construction process in the previous round, and sets i = i-1, j = L / log2 m , k=k+1, go to (3.2.2.10);

[0066] (3.2.2.15) Transfer each round of differences obtained by the current reverse search (α, β→γ) i The differential transfer at the splicing position performs a cyclic shift or XOR operation according to the decryption direction and the round function F to obtain the complete output differential value Tb of each round i The complete output difference value Db obtained by reverse operation at the splicing position is obtained to obtain the optimal differential feature BTb of the reverse search Y wheel Y ={Db,Tb1,Tb2,…,Tb Y}, reverse search for the optimal differential feature probability BPb of round Y Y =P1×P2×…×P Y , ending the reverse search process.

[0067] In the GPU-based ARX type block cipher optimal differential feature search method of the present invention, the step (4) of concatenating the two parts of the optimal differential features to obtain the overall optimal differential feature is as follows:

[0068] (4.1) The optimal differential feature BTb obtained by reverse search Y rounds Y Reverse to get RBTb Y , but the differential feature probabilities of each round remain unchanged;

[0069] (4.2) The optimal differential feature BTf obtained by forward search X rounds X and RBTb Y For splicing, use T N represents the final obtained overall N rounds of differential features, T N =RBTb Y ||BTf X , where || represents the sequence concatenation operation;

[0070] (4.4) Calculate N rounds of differential feature probability BP N =BPf X ×BP Y ;

[0071] (4.5) The splicing process ends, the optimal differential features and differential feature probabilities of N rounds of search are obtained, and the search ends.

[0072] The beneficial effects of the present invention are:

[0073] (1) The method of the present invention splits the multi-round search process into two parts, forward and reverse, by selecting a high-probability differential transfer, splitting a long round number into two short round numbers, thereby reducing the recursive depth of the overall search round number and reducing the time required for the optimal differential feature search of the ARX type block cipher;

[0074] (2) The method of the present invention designs a GPU-based differential transfer construction and probability calculation parallel scheme, and performs parallel calculations in the bidirectional search process of the optimal differential features of the ARX type block cipher, thereby improving the calculation efficiency, shortening the calculation time, and increasing the search speed of the optimal differential features of the ARX type block cipher. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] Figure 1 It is a flow chart of the optimal differential feature search method of ARX type block cipher based on GPU of the present invention;

[0076] Figure 2 A schematic diagram of selecting a high-probability differential transition to split the search process in the method of the present invention;

[0077] Figure 3 This is a flow chart of bidirectional search based on GPU parallel computing in the method of the present invention. DETAILED DESCRIPTION

[0078] The present invention is further described below with reference to the embodiments and drawings, but is not intended to limit the present invention.

[0079] Example

[0080] Reference Figure 1 , an optimal differential feature search method for ARX type block cipher based on GPU, comprising the following steps:

[0081] (1) Select a high-probability differential transition to split the search process;

[0082] (2) Design a GPU parallel computing solution using differential transfer construction and probability calculation as kernel functions;

[0083] (3) Based on GPU parallel computing, a bidirectional search is completed to obtain the optimal differential features of the two parts;

[0084] (4) Concatenate the two parts of the optimal differential features to obtain the overall optimal differential features.

[0085] Reference Figure 2 , step (1) selects a high-probability differential transition to split the search process, and the specific steps are as follows:

[0086] (1.1) In order to reduce the problem of excessive recursion depth caused by multiple rounds of search, the entire search problem is split into two parts based on the splicing position to reduce the overall recursion depth; since many optimal differential features of ARX block ciphers have special internal differential transfers in the middle rounds, that is, the differential transfer has only one non-zero bit, a differential transfer with a probability of 1 is selected as the differential transfer at the splicing position; according to the modular addition operation, the differential transfer at the splicing position is set to: input differential value α = 0x8...0, input differential value β = 0x0...0, output differential value γ = 0x8...0, where 0x represents hexadecimal, and the values ​​in the ellipsis are all 0. Assuming that the complete bit length of the modular addition operation is L, the number of 0s num = (L-8) / 4;

[0087] (1.2) Assuming the target search round number is N, then the round number of the splicing position is in represents rounding up;

[0088] (1.3) The search direction of N rounds of searching from the splicing position to the target is called forward search, and the search direction of the splicing position to the first round is called reverse search. Let the number of rounds of forward search be X and the number of rounds of reverse search be Y, then N=X+Y+1.

[0089] The specific steps of designing a GPU parallel computing solution using differential transfer construction and probability calculation as kernel functions in step (2) are as follows:

[0090] (2.1) To ensure that the calculation of each thread corresponds to a different state, each thread is bound to the data of a certain state of the output differential value, as follows:

[0091] (2.1.1) In order to improve the efficiency of data transmission between the CPU and GPU, the number of differential transfers and probability calculations constructed by the GPU in parallel each time is set, that is, the parallel scale is m. Here, m=256, then m threads need to be started in the GPU for parallel calculation each time, and each thread executes the kernel function to complete the differential transfer construction and probability calculation of a state;

[0092] (2.1.2) In order to improve the utilization of GPU, thread blocks are usually generated in GPU first, and the number of threads generated in each thread block is usually an integer multiple of 32; assuming that the number of threads in each thread block generated by GPU is blockDim, the index of each thread block is blockIdx, and the index of each thread in its thread block is threadIdx, then the thread number tid of each thread can be uniquely calculated, tid = blockDim × blockIdx + threadIdx;

[0093] (2.1.3) Each thread takes its thread number tid as part of the output differential value to be constructed, denoted as γ tid , γ tid =tid, the thread number can be bound to the data of a certain state of the output differential value to ensure that the data in each thread is different;

[0094] (2.2) The kernel function differential transfer construction and probability calculation are completed in each thread, as follows:

[0095] (2.2.1) Assume that the differential transfer bit length to be constructed is l, and l is equal to an integer multiple of log2 m , where log2 m represents the bit length obtained by taking the logarithm of the parallel scale m; based on l, a mask mask is used to truncate the input difference values ​​α and β passed into the kernel function, retaining the least significant bits. in represents the logical negation operation, ULL represents an unsigned long integer variable, >> represents the right shift operation, α=α&mask, β=β&mask, where & represents the bitwise AND operation;

[0096] (2.2.2) Use mask mask to truncate the output difference value γ passed into the kernel function, retaining the least significant bits, that is, γ = γ & mask; then compare the truncated γ with the γ bound to the thread number. tid Combine them to get the complete output difference value γ=γ|(γ tid <<(l-log2 m )), where | represents a bitwise OR operation;

[0097] (2.2.3) Calculate the probability of differential transfer P. If and only if the XOR result of the least significant bit of the three differential values ​​α, β and γ is 0, and the value of a certain bit position in the middle is the same except for the most significant bit, and this value is equal to the XOR result of the bit value of the most significant bit of the current bit position, the differential transfer that meets this condition is a feasible differential transfer, and the probability is non-zero, and the probability value is in Among them, α[i], β[i] and γ[i] represent the values ​​of the i-th bit of α, β and γ respectively, and eq is used to determine whether the bit values ​​of the variables are the same;

[0098] (2.3) The differential transition (α, β→γ) and the differential transition probability P are returned to the CPU.

[0099] Reference Figure 3 , the bidirectional search based on GPU parallel computing described in step (3) is completed to obtain the optimal differential features of the two parts. The specific steps are as follows:

[0100] (3.1) The process of forward search for the optimal differential feature is as follows:

[0101] (3.1.1) Let BPfe be the probability threshold used for pruning decision in forward search. This threshold is an estimated value. BPfe1 represents the optimal probability estimate of one round of forward search. Since the optimal probability value of the splicing position is 1, let BPfe1 = 1 / 4; and the optimal probability estimate of round i is equal to half of the optimal probability estimate of round i-1, that is, BPfe i =BPfe i-1 / 2;

[0102] (3.1.2) For a forward search involving X rounds, the current round number is i, let i = 1, if i ≤ X, then:

[0103] (3.1.2.1) According to the complete bit length L of the modular addition operation, the total number of times the kernel function needs to be called in each round is determined to be L / log2 m , when the kernel function is called for the jth time in each round, the relationship between the bit length l and j of the differential transfer to be constructed is l = j × log2 m , let j = 1; define a three-dimensional array XDP[i][j][k] to store the differential transfer and differential transfer probability results of m GPU threads calculated by calling the kernel function for different times in each round, where the current round number i∈[1,X], the number of times the kernel function is called in the current round j∈[1,L / log2 m ], each time a kernel function is called to start a GPU thread k∈[0,m-1], let k=0;

[0104] (3.1.2.2) Assume that the round function of the cryptographic algorithm is F, perform forward search in the encryption direction, and perform cyclic shift or XOR operation on the input differential values ​​α and β according to the structure of F before entering the modular addition operation of F;

[0105] (3.1.2.3) The input differential values ​​α and β, the output differential value γ, and the bit length l of the differential transfer to be constructed are used as parameter inputs of the kernel function of the host CPU calling the device GPU;

[0106] (3.1.2.4) The device starts m GPU threads for parallel execution. Each thread executes the kernel function operation according to the input parameters, constructs the differential transfer and calculates the probability, and returns the result;

[0107] (3.1.2.5) The host obtains all differential transitions (α, β→γ) and differential transition probabilities P returned by the device, and stores the obtained results in the three-dimensional array XDP[i][j][k] according to the number of search rounds, the number of kernel functions called in each round, and the number of GPU threads started each time;

[0108] (3.1.2.6) Let k = 0, the host reads data XDP[i][j][k];

[0109] (3.1.2.7) The host uses all the optimal probabilities in the previous X-1 rounds and the differential transfer probabilities in XDP[i][j][k] as pruning conditions, first verifying Is it established, among which, represents the product of the differential transition probabilities constructed in each round in the first i-1 rounds during the current search process, BPf X-i represents the optimal probability of Xi round; if it is true, go to (3.1.2.8), otherwise let k=k+1, go to (3.1.2.10);

[0110] (3.1.2.8) Determine whether the currently constructed differential transfer bit length l is equal to the complete bit length L of the modular addition operation. If l = L, go to (3.1.2.9), otherwise let j = j + 1 and go to (3.1.2.3);

[0111] (3.1.2.9) Determine whether the current search round number i is the forward search target round number X. If so, go to (3.1.2.15). Otherwise, perform cyclic shift or XOR operation on the input differential values ​​α and β entering the next round according to the round function F, set the output differential value γ to 0, set i = i + 1, j = 1, and go to (3.1.2.2) to enter the next round of search;

[0112] (3.1.2.10) The host uses all the optimal probabilities of the previous X-1 rounds and the differential transfer probabilities in XDP[i][j][k] as pruning conditions and re-verifies Is it true? If so, go to (3.1.2.8); otherwise, go to (3.1.2.11);

[0113] (3.1.2.11) Determine whether k=m-1 holds. If so, go to (3.1.2.12). Otherwise, set k=k+1 and go to (3.1.2.10).

[0114] (3.1.2.12) Determine if l>log2 m Is it true? If so, go to (3.1.2.13); otherwise, go to (3.1.2.14);

[0115] (3.1.2.13) The search method traces back to the last differential transfer construction process of the current round, set j = j-1, k = k+1, and go to (3.1.2.10);

[0116] (3.1.2.14) The search method traces back to the last differential transfer construction process in the previous round, and sets i = i-1, j = L / log2 m, k=k+1, go to (3.1.2.10);

[0117] (3.1.2.15) Transfer each round of differences obtained in the current forward search (α, β→γ) i The differential transfer at the splicing position performs a cyclic shift or XOR operation according to the encryption direction and the round function F to obtain the complete output differential value Tf of each round i The complete output difference value Df obtained by the forward operation at the splicing position is obtained to obtain the optimal differential feature BTf of the forward search X rounds X ={Df,Tf1,Tf2,…,Tf X}, forward search for the optimal differential feature probability BPf of round X X =P1×P2×…×P X , end the forward search process;

[0118] (3.2) The reverse search process for the optimal differential feature is as follows:

[0119] (3.2.1) Let BPbe be the probability threshold used for pruning decision in reverse search. This threshold is an estimated value. BPbe1 represents the optimal probability estimate of the reverse search round 1. Since the optimal probability value of the splicing position is 1, let BPbe1 = 1 / 4; and the optimal probability estimate of round i is equal to half of the optimal probability estimate of round i-1, that is, BPbe i =BPbe i-1 / 2; Set the three-dimensional array XDP[][][] to empty;

[0120] (3.2.2) For a reverse search involving Y rounds, the current round number is i, let i = 1, if i ≤ Y, then:

[0121] (3.2.2.1) According to the complete bit length L of the modular addition operation, the total number of times the kernel function needs to be called in each round is determined to be L / log2 m , when the kernel function is called for the jth time in each round, the relationship between the bit length l and j of the differential transfer to be constructed is l = j × log2 m , let j = 1; the three-dimensional array XDP[i][j][k] stores the differential transfer and differential transfer probability results of the m GPU threads calculated by calling the kernel function for different times in each round, where the current round number i∈[1,Y], the number of times the kernel function is called in the current round j∈[1,L / log2 m ], each time a kernel function is called to start a GPU thread k∈[0,m-1], let k=0;

[0122] (3.2.2.2) Assume that the round function of the cryptographic algorithm is F, perform a reverse search in the decryption direction, and perform a circular shift or XOR operation on the input differential values ​​α and β according to the structure of F before entering the modular addition operation of F;

[0123] (3.2.2.3) The input differential values ​​α and β, the output differential value γ, and the bit length l of the differential transfer to be constructed are used as parameter inputs of the kernel function of the host CPU calling the device GPU;

[0124] (3.2.2.4) The device starts m GPU threads for parallel execution. Each thread executes the kernel function operation according to the input parameters, constructs the differential transfer and calculates the probability, and returns the result;

[0125] (3.2.2.5) The host obtains all differential transitions (α, β→γ) and differential transition probabilities P returned by the device, and stores the obtained results in the three-dimensional array XDP[i][j][k] according to the number of search rounds, the number of kernel functions called in each round, and the number of GPU threads started each time;

[0126] (3.2.2.6) Let k = 0, the host reads data XDP[i][j][k];

[0127] (3.2.2.7) The host uses all the optimal probabilities in the previous Y-1 rounds and the differential transfer probabilities in XDP[i][j][k] as pruning conditions, first verify Is it established, among which, represents the product of the differential transition probabilities constructed in each round in the first i-1 rounds during the current search process, BPb Y-i represents the optimal probability of Yi round; if it is true, go to (3.2.2.8), otherwise let k=k+1 and go to (3.2.2.10);

[0128] (3.2.2.8) Determine whether the currently constructed differential transfer bit length l is equal to the complete bit length L of the modular addition operation. If l = L, go to (3.2.2.9), otherwise let j = j + 1 and go to (3.2.2.3);

[0129] (3.2.2.9) Determine whether the current search round number i is the reverse search target round number Y. If so, go to (3.2.2.15). Otherwise, perform cyclic shift or XOR operation on the input differential values ​​α and β entering the next round according to the round function F, set the output differential value γ to 0, set i=i+1, j=1, and go to (3.2.2.2) to enter the next round of search;

[0130] (3.2.2.10) The host uses all the optimal probabilities of the previous Y-1 rounds and the differential transfer probabilities in XDP[i][j][k] as pruning conditions and re-verifies Is it true? If so, go to (3.2.2.8); otherwise, go to (3.2.2.11);

[0131] (3.2.2.11) Determine whether k=m-1 holds. If so, go to (3.2.2.12). Otherwise, set k=k+1 and go to (3.2.2.10).

[0132] (3.2.2.12) Determine if l>log2 m Is it true? If so, go to (3.2.2.13); otherwise, go to (3.2.2.14);

[0133] (3.2.2.13) The search method traces back to the last differential transfer construction process of the current round, set j = j-1, k = k+1, and go to (3.2.2.10);

[0134] (3.2.2.14) The search method traces back to the last differential transfer construction process in the previous round, and sets i = i-1, j = L / log2 m , k=k+1, go to (3.2.2.10);

[0135] (3.2.2.15) Transfer each round of differences obtained by the current reverse search (α, β→γ) i The differential transfer at the splicing position performs a cyclic shift or XOR operation according to the decryption direction and the round function F to obtain the complete output differential value Tb of each round i The complete output difference value Db obtained by reverse operation at the splicing position is obtained to obtain the optimal differential feature BTb of the reverse search Y wheel Y ={Db,Tb1,Tb2,…,Tb Y}, reverse search for the optimal differential feature probability BPb of round Y Y =P1×P2×…×P Y , ending the reverse search process.

[0136] The steps of concatenating the two parts of the optimal differential features in step (4) to obtain the overall optimal differential features are as follows:

[0137] (4.1) The optimal differential feature BTb obtained by reverse search Y rounds Y Reverse to get RBTb Y , but the differential feature probabilities of each round remain unchanged;

[0138] (4.2) The optimal differential feature BTf obtained by forward search X rounds X and RBTb Y For splicing, use T N represents the final obtained overall N rounds of differential features, T N =RBTb Y||BTf X , where || represents the sequence concatenation operation;

[0139] (4.4) Calculate N rounds of differential feature probability BP N =BPf X ×BP Y ;

[0140] (4.5) The splicing process ends, the optimal differential features and differential feature probabilities of N rounds of search are obtained, and the search ends.

Claims

1. A GPU-based ARX block cipher optimal differential feature search method, characterized in that: The following steps are involved: (1) Select a high-probability differential transition to split the search process; Select a differential transition with high probability as the splicing position, split the multi-round search into two parts: forward search and reverse search, and perform the search separately to reduce the recursive depth of the search; (2) Design a GPU parallel computing solution using differential transfer construction and probability calculation as kernel functions; In each round of the forward and reverse search process, a differential transfer needs to be constructed on each bit state and the probability needs to be calculated. To improve the efficiency of construction and calculation, a parallel computing solution based on GPU is designed with differential transfer construction and probability calculation as kernel functions. Each kernel function calculates the differential transfer probability of a state of the set parallel scale in each round, and the computing efficiency is improved through parallel computing. (3) Based on GPU parallel computing, a bidirectional search is completed to obtain the optimal differential features of the two parts; In order to improve the overall search speed, a forward search is first performed starting from the splicing position. Based on the GPU parallel computing results and the set probability threshold as the judgment condition for pruning during the search process, the optimal differential features are searched round by round according to the branch and bound strategy to obtain the optimal differential features of the forward search; Continue the reverse search in the same way to obtain the optimal differential features of the reverse search; (4) Concatenate the two parts of the best differential features to obtain the overall best differential features; The two parts of the optimal differential features obtained by the forward search and the reverse search are concatenated to obtain the optimal differential feature of the ARX block cipher algorithm as a whole, and the probability of the optimal differential feature is updated.

2. The GPU-based ARX block cipher optimal differential feature search method according to claim 1, characterized in that: Step (1) of selecting a high-probability differential transition to split the search process is as follows: (1.1) In order to reduce the problem of excessive recursion depth caused by multiple rounds of search, the entire search problem is split into two parts based on the splicing position to reduce the overall recursion depth; since many optimal differential features of ARX block ciphers have special internal differential transfers in the middle rounds, that is, the differential transfer has only one non-zero bit, a differential transfer with a probability of 1 is selected as the differential transfer at the splicing position; according to the modular addition operation, the differential transfer at the splicing position is set to: input differential value α = 0x8...0, input differential value β = 0x0...0, output differential value γ = 0x8...0, where 0x represents hexadecimal, and the values ​​in the ellipsis are all 0. Assuming that the complete bit length of the modular addition operation is L, the number of 0s num = (L-8) / 4; (1.2) Assuming the target search round number is N, then the round number of the splicing position is in Indicates rounding up; (1.3) The search direction of N rounds of searching from the splicing position to the target is called forward search, and the search direction of the splicing position to the first round is called reverse search. Let the number of rounds of forward search be X and the number of rounds of reverse search be Y, then N=X+Y+1.

3. The GPU-based ARX block cipher optimal differential feature search method according to claim 1, characterized in that: The specific steps of designing a GPU parallel computing solution using differential transfer construction and probability calculation as kernel functions in step (2) are as follows: In each round of the forward and reverse search process, it is necessary to construct a differential transfer and calculate the probability on the state bit of each bit of the output differential value. In order to improve the efficiency of construction and calculation, a parallel computing scheme based on GPU is designed with differential transfer construction and probability calculation as kernel functions. Each kernel function calculates the differential transfer probability of a state of the parallel scale set in each round, and the computing efficiency is improved through parallel computing, as follows: (2.1) To ensure that the calculation of each thread corresponds to a different state, each thread is bound to the data of a certain state of the output differential value, as follows: (2.1.1) In order to improve the efficiency of data transmission between the CPU and GPU, the number of differential transfers and probability calculations constructed by the GPU in parallel each time is set, that is, the parallel scale is m. Here, m=256, then m threads need to be started in the GPU for parallel calculation each time, and each thread executes the kernel function to complete the differential transfer construction and probability calculation of a state; (2.1.2) Assuming that the number of threads in each thread block generated by the GPU is blockDim, the index of each thread block is blockIdx, and the index of each thread in its thread block is threadIdx, then the thread number tid of each thread can be uniquely calculated, tid = blockDim × blockIdx + threadIdx; (2.1.3) Each thread takes its thread number tid as part of the output differential value to be constructed, denoted as γ tid , γ tid =tid, the thread number can be bound to the data of a certain state of the output differential value to ensure that the data in each thread is different; (2.2) The kernel function differential transfer construction and probability calculation are completed in each thread, as follows: (2.2.1) Assume that the differential transfer bit length to be constructed is l, and l is equal to an integer multiple of log2 m , where log2 m represents the bit length obtained by taking the logarithm of the parallel scale m; based on l, a mask mask is used to truncate the input difference values ​​α and β passed into the kernel function, retaining the least significant bits. in represents the logical negation operation, ULL represents the unsigned long integer variable, >> represents the right shift operation, α=α&mask, β=β&mask, where & represents the bitwise AND operation; (2.2.2) Use the mask mask to truncate the output differential value γ passed into the kernel function, retaining the least significant bits, that is, γ=γ&mask; then compare the truncated γ with the γ bound to the thread number tid Combine them to get the complete output difference value γ=γ|(γ tid <<(l-log2 m )), where | represents a bitwise OR operation; (2.2.3) Calculate the probability of differential transfer P. If and only if the XOR result of the least significant bit of the three differential values ​​α, β and γ is 0, and the value of a certain bit position in the middle is the same except for the most significant bit, and this value is equal to the XOR result of the bit value of the most significant bit of the current bit position, the differential transfer that meets this condition is a feasible differential transfer, and the probability is non-zero, and the probability value is in Among them, α[i], β[i] and γ[i] represent the values ​​of the i-th bit of α, β and γ respectively, and eq is used to determine whether the bit values ​​of the variables are the same; (2.3) The differential transition (α, β→γ) and the differential transition probability P are returned to the CPU.

4. The GPU-based ARX block cipher optimal differential feature search method according to claim 1, characterized in that: The bidirectional search described in step (3) is completed based on GPU parallel computing to obtain the optimal differential features of the two parts. The specific steps are as follows: (3.1) The process of forward search for the optimal differential feature is as follows: (3.1.1) Let BPfe be the probability threshold used for pruning decision in forward search. This threshold is an estimated value. BPfe1 represents the optimal probability estimate of one round of forward search. Since the optimal probability value of the splicing position is 1, let BPfe1 = 1 / 4; and the optimal probability estimate of round i is equal to half of the optimal probability estimate of round i-1, that is, BPfe i =BPfe i-1 / 2; (3.1.2) For a forward search involving X rounds, the current round number is i, let i = 1, if i ≤ X, then: (3.1.2.1) According to the complete bit length L of the modular addition operation, the total number of times the kernel function needs to be called in each round is determined to be L / log2 m , when the kernel function is called for the jth time in each round, the relationship between the bit length l and j of the differential transfer to be constructed is l = j × log2 m , let j = 1; define a three-dimensional array XDP[i][j][k] to store the differential transfer and differential transfer probability results of m GPU threads calculated by calling the kernel function for different times in each round, where the current round number i∈[1,X], the number of times the kernel function is called in the current round j∈[1,L / log2 m ], each time a kernel function is called to start a GPU thread k∈[0,m-1], let k=0; (3.1.2.2) Assume that the round function of the cryptographic algorithm is F, perform forward search in the encryption direction, and perform cyclic shift or XOR operation on the input differential values ​​α and β according to the structure of F before entering the modular addition operation of F; (3.1.2.3) The input differential values ​​α and β, the output differential value γ, and the bit length l of the differential transfer to be constructed are used as parameter inputs of the kernel function of the host CPU calling the device GPU; (3.1.2.4) The device starts m GPU threads for parallel execution. Each thread executes the kernel function operation according to the input parameters, constructs the differential transfer and calculates the probability, and returns the result; (3.1.2.5) The host obtains all differential transitions (α, β→γ) and differential transition probabilities P returned by the device, and stores the obtained results in the three-dimensional array XDP[i][j][k] according to the number of search rounds, the number of kernel functions called in each round, and the number of GPU threads started each time; (3.1.2.6) Let k = 0, the host reads data XDP[i][j][k]; (3.1.2.7) The host uses all the optimal probabilities in the previous X-1 rounds and the differential transfer probabilities in XDP[i][j][k] as pruning conditions, first verifying Is it established, among which, represents the product of the differential transition probabilities constructed in each round in the first i-1 rounds during the current search process, BPf X-i represents the optimal probability of Xi round. If it is true, go to (3.1.2.8), otherwise let k=k+1 and go to (3.1.2.10); (3.1.2.8) Determine whether the currently constructed differential transfer bit length l is equal to the complete bit length L of the modular addition operation. If l = L, go to (3.1.2.9), otherwise let j = j + 1 and go to (3.1.2.3); (3.1.2.9) Determine whether the current search round number i is the forward search target round number X. If so, go to (3.1.2.15). Otherwise, perform cyclic shift or XOR operation on the input differential values ​​α and β entering the next round according to the round function F, set the output differential value γ to 0, set i = i + 1, j = 1, and go to (3.1.2.2) to enter the next round of search; (3.1.2.10) The host uses all the optimal probabilities of the previous X-1 rounds and the differential transfer probabilities in XDP[i][j][k] as pruning conditions and re-verifies Is it true? If so, go to (3.1.2.8); otherwise, go to (3.1.2.11); (3.1.2.11) Determine whether k=m-1 holds. If so, go to (3.1.2.12). Otherwise, set k=k+1 and go to (3.1.2.10). (3.1.2.12) Determine if l>log2 m Is it true? If so, go to (3.1.2.13); otherwise, go to (3.1.2.14); (3.1.2.13) The search method traces back to the last differential transfer construction process of the current round, set j = j-1, k = k+1, and go to (3.1.2.10); (3.1.2.14) The search method traces back to the last differential transfer construction process in the previous round, and sets i = i-1, j = L / log2 m , k=k+1, go to (3.1.2.10); (3.1.2.15) Transfer each round of differences obtained in the current forward search (α, β→γ) i The differential transfer at the splicing position performs a cyclic shift or XOR operation according to the encryption direction and the round function F to obtain the complete output differential value Tf of each round i The complete output difference value Df obtained by the forward operation at the splicing position is obtained to obtain the optimal differential feature BTf of the forward search X rounds X ={Df,Tf1,Tf2,…,Tf X }, forward search for the optimal differential feature probability BPf of round X X =P1×P2×…×P X , end the forward search process; (3.2) The reverse search process for the optimal differential feature is as follows: (3.2.1) Let BPbe be the probability threshold used for pruning decision in reverse search. This threshold is an estimated value. BPbe1 represents the optimal probability estimate of the reverse search round 1. Since the optimal probability value of the splicing position is 1, let BPbe1 = 1 / 4; and the optimal probability estimate of round i is equal to half of the optimal probability estimate of round i-1, that is, BPbe i =BPbe i-1 / 2; Set the three-dimensional array XDP[][][] to empty; (3.2.2) For a reverse search involving Y rounds, the current round number is i, let i = 1, if i ≤ Y, then: (3.2.2.1) According to the complete bit length L of the modular addition operation, the total number of times the kernel function needs to be called in each round is determined to be L / log2 m , when the kernel function is called for the jth time in each round, the relationship between the bit length l and j of the differential transfer to be constructed is l = j × log2 m , let j = 1; the three-dimensional array XDP[i][j][k] stores the differential transfer and differential transfer probability results of the m GPU threads calculated by calling the kernel function for different times in each round, where i∈[1,Y], the number of times the kernel function is called in the current round j∈[1,L / log2 m ], each time a kernel function is called to start a GPU thread k∈[0,m-1], let k=0; (3.2.2.2) Assume that the round function of the cryptographic algorithm is F, perform a reverse search in the decryption direction, and perform a cyclic shift or XOR operation on the input differential values ​​α and β according to the structure of F before entering the modular addition operation of F; (3.2.2.3) The input differential values ​​α and β, the output differential value γ, and the bit length l of the differential transfer to be constructed are used as parameter inputs of the kernel function of the host CPU calling the device GPU; (3.2.2.4) The device starts m GPU threads for parallel execution. Each thread executes the kernel function operation according to the input parameters, constructs the differential transfer and calculates the probability, and returns the result; (3.2.2.5) The host obtains all differential transitions (α, β→γ) and differential transition probabilities P returned by the device, and stores the obtained results in the three-dimensional array XDP[i][j][k] according to the number of search rounds, the number of kernel functions called in each round, and the number of GPU threads started each time; (3.2.2.6) Let k = 0, the host reads data XDP[i][j][k]; (3.2.2.7) The host uses all the optimal probabilities in the previous Y-1 rounds and the differential transfer probabilities in XDP[i][j][k] as pruning conditions, first verify Is it established, among which, represents the product of the differential transition probabilities constructed in each round in the first i-1 rounds during the current search process, BPb Y-i represents the optimal probability of Yi round; if it is true, go to (3.2.2.8), otherwise let k=k+1 and go to (3.2.2.10); (3.2.2.8) Determine whether the currently constructed differential transfer bit length l is equal to the complete bit length L of the modular addition operation. If l = L, go to (3.2.2.9), otherwise let j = j + 1 and go to (3.2.2.3); (3.2.2.9) Determine whether the current search round number i is the reverse search target round number Y. If so, go to (3.2.2.15). Otherwise, perform cyclic shift or XOR operation on the input differential values ​​α and β entering the next round according to the round function F, set the output differential value γ to 0, set i=i+1, j=1, and go to (3.2.2.2) to enter the next round of search; (3.2.2.10) The host uses all the optimal probabilities of the previous Y-1 rounds and the differential transfer probabilities in XDP[i][j][k] as pruning conditions and re-verifies Is it true? If so, go to (3.2.2.8), otherwise go to (3.2.2.11); (3.2.2.11) Determine whether k=m-1 is true. If so, go to (3.2.2.12), otherwise set k=k+1 and go to (3.2.2.10); (3.2.2.12) Determine if l>log2 m Is it true? If so, go to (3.2.2.13); otherwise, go to (3.2.2.14); (3.2.2.13) The search method traces back to the last differential transfer construction process of the current round, set j = j-1, k = k+1, and go to (3.2.2.10); (3.2.2.14) The search method traces back to the last differential transfer construction process in the previous round, and sets i = i-1, j = L / log2 m , k=k+1, go to (3.2.2.10); (3.2.2.15) Transfer each round of differences obtained by the current reverse search (α, β→γ) i The differential transfer at the splicing position performs a cyclic shift or XOR operation according to the decryption direction and the round function F to obtain the complete output differential value Tb of each round i The complete output difference value Db obtained by the reverse operation at the splicing position is obtained to obtain the optimal differential feature BTb of the reverse search Y wheel Y ={Db,Tb1,Tb2,…,Tb Y }, reverse search for the optimal differential feature probability BPb of round Y Y =P1×P2×…×P Y , ending the reverse search process.

5. The GPU-based ARX block cipher optimal differential feature search method according to claim 1, characterized in that: The steps of concatenating the two parts of the optimal differential features in step (4) to obtain the overall optimal differential features are as follows: (4.1) The optimal differential feature BTb obtained by reverse search Y rounds Y Reverse to get RBTb Y , but the differential feature probabilities of each round remain unchanged; (4.2) The optimal differential feature BTf obtained by forward search X rounds X and RBTb Y For splicing, use T N represents the final N-round differential features, T N =RBTb Y ||BTf X , where || represents the sequence concatenation operation; (4.4) Calculate N rounds of differential feature probability BP N =BPf X ×BP Y ; (4.5) The splicing process ends, the optimal differential features and differential feature probabilities of N rounds of search are obtained, and the search ends.

Images