A GPU-based optimal differential characteristic search method for ARX-type block cipher

Abstract

The application discloses a GPU-based ARX type block cipher optimal differential characteristic search method, which first selects a high-probability differential transition to split the whole search process into forward search and reverse search; differential transition construction and probability calculation are taken as kernel functions, a GPU-based parallel scheme is designed, and the differential transition probability of different states in each round is calculated in parallel; the GPU parallel calculation result and the set probability threshold are taken as the determination condition of pruning in the search process, the optimal differential characteristic is searched round by round according to the branch and bound strategy, the forward and reverse searches are completed, and the optimal differential characteristics of the two parts are obtained; finally, the optimal differential characteristics of the two parts are spliced to obtain the optimal differential characteristics of the complete rounds. The search method can effectively reduce the recursion depth, improve the search efficiency through parallel calculation, shorten the calculation time and improve the search speed of the ARX type block cipher optimal differential characteristic.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, and particularly relates to a GPU-based ARX type block cipher optimal differential characteristic search method. BACKGROUND

[0002] ARX is a commonly used structure in block cipher algorithm design, and the nonlinearity, confusion and diffusion of the algorithm are realized by using three basic operations of modulo addition operation, cyclic shift operation and XOR operation. The advantage of this structure is that the algorithm design is simple and the execution efficiency is high. Differential cryptanalysis is one of the most effective methods to attack iterative block ciphers, and high-probability differential characteristics can be used to perform key recovery attacks on block cipher algorithms. The optimal differential characteristic is usually used to evaluate the ability of block cipher algorithms to resist differential attacks. The search of the optimal differential characteristic refers to finding a specific differential characteristic among all possible differential characteristics, which appears with the highest probability after the iteration of the round function of the cipher algorithm. However, it is very time-consuming to find the optimal differential characteristic of the block cipher, and usually millions of differentials between plaintext and ciphertext pairs need to be analyzed. Therefore, the search of the optimal differential characteristic and how to accelerate the search process have attracted extensive attention of researchers.

[0003] For the problem of searching the optimal differential characteristic of the ARX type block cipher, the core idea of the existing bottom-up search method is based on the Branch and Bound (B&B) strategy. According to the differential propagation characteristics of each component in the round function of the cipher algorithm, the differential characteristic is searched one round at a time. In the search process, the search space is limited according to the probability threshold and the search branch direction is controlled. When the branch cannot continue to derive the sub-branch, backtracking is performed round by round until the target search round is reached and the optimal differential characteristic is searched, and the whole search process is ended. However, the existing method faces some problems: (1) Since the differential transition probability calculation through the nonlinear module needs to be calculated round by round in the search process, and the differential transition probability calculation needs to be performed once for each possible differential transition, the calculation overhead of the probability value calculation is too large; (2) Since the optimal differential characteristic is searched round by round, and the probability of the differential characteristic needs to be verified whether it is optimal in the search process, the search recursion depth increases with the number of rounds in the case of multi-round search, and the calculation overhead is further increased, which greatly reduces the search speed. SUMMARY

[0004] In view of the problems of large calculation overhead and slow search speed of the existing bottom-up search method in optimal differential characteristic search of ARX type block cipher, the application provides an ARX type block cipher optimal differential characteristic search method based on GPU, which first selects a high-probability differential transition to split the whole search process into forward search and reverse search, reduces the recursion depth of the search by reducing the number of rounds; constructs a differential transition and calculates the probability as a kernel function, designs a GPU-based parallel scheme, and calculates the differential transition probability of different states in each round in parallel to improve the calculation efficiency; based on the GPU parallel calculation result and the set probability threshold for guiding the pruning operation, pruning judgment is performed in the forward search and reverse search processes respectively, the search of all rounds is completed, and the optimal differential characteristics of the two parts are obtained; finally, the optimal differential characteristics of the two parts are spliced to obtain the optimal differential characteristics of the complete rounds, and the ARX type block cipher optimal differential characteristic search is completed.

[0005] The technical solution for achieving the application is:

[0006] An ARX type block cipher optimal differential characteristic search method based on GPU, comprising the following steps:

[0007] (1) selecting a high-probability differential transition to split the search process;

[0008] A differential transition with high probability is selected as a splicing position to split the multi-round search into forward search and reverse search to reduce the recursion depth of the search;

[0009] (2) constructing a differential transition and calculating the probability as a kernel function to design a GPU parallel calculation scheme;

[0010] In each round of the forward and reverse search processes, a differential transition needs to be constructed and the probability needs to be calculated for each bit state bit, in order to improve the construction and calculation efficiency, a GPU-based parallel calculation scheme is designed by constructing a differential transition and calculating the probability as a kernel function, each kernel function calculates the differential transition probability of a state in each round in the set parallel scale, and the calculation efficiency is improved by parallel calculation;

[0011] (3) completing bidirectional search based on GPU parallel calculation to obtain two-part optimal differential characteristics;

[0012] In order to improve the overall search speed, the forward search is first performed from the splicing position, the GPU parallel calculation result and the set probability threshold are used as the judgment condition for pruning in the search process, the optimal differential characteristics are searched round by round according to the branch and bound strategy, and the optimal differential characteristics of the forward search are obtained; the reverse search is continued in the same way, and the optimal differential characteristics of the reverse search are obtained;

[0013] (4) splicing two parts of optimal differential characteristics to obtain the whole optimal differential characteristic;

[0014] Splicing two parts of optimal differential characteristics obtained by forward search and reverse search, combining to obtain the whole optimal differential characteristic of an ARX type block cipher algorithm, and updating the optimal differential characteristic probability.

[0015] In the ARX type block cipher optimal differential characteristic search method based on GPU, the step (1) selects a high-probability differential transition to split the search process, and the specific steps are as follows:

[0016] (1.1) In order to reduce the problem of excessive recursion depth caused by multi-round search, the whole search problem is split into two parts at the splicing position to reduce the overall recursion depth; since many optimal differential characteristics of the ARX type block cipher have special internal differential transitions in the middle round number, that is, the differential transition has only one non-0 bit, in this case, a differential transition with a probability of 1 is selected as the differential transition at the splicing position; according to the modulo addition operation, the differential transition at the splicing position is set as: input differential value α=0x8...0, input differential value β=0x0...0, and output differential value γ=0x8...0, wherein 0x represents hexadecimal, and the values in the ellipsis are all 0; assuming that the complete bit length of the modulo addition operation is L, then the number of 0 is num=(L-8) / 4.

[0017] (1.2) Assuming that the target search round number is N, then the round number of the splicing position is Wherein represents rounding up;

[0018] (1.3) The search direction of the splicing position to the target search round number N is forward search, and the search direction of the splicing position to the first round is reverse search, assuming that the round number of the forward search is X, and the round number of the reverse search is Y, then N=X+Y+1.

[0019] In the ARX type block cipher optimal differential characteristic search method based on GPU, the step (2) constructs a differential transition and calculates the probability as a kernel function to design a GPU parallel computing scheme, and the specific steps are as follows:

[0020] In each round of the forward and reverse search process, a differential transition needs to be constructed and the probability needs to be calculated on the state bit of each bit of the output differential value, and if the output differential value is 16 bits, then in the most undesirable case, 2 16The existing method has great time overhead and low efficiency in CPU calculation. In order to improve the efficiency of construction and calculation, a parallel computing scheme based on GPU is designed, which uses differential transfer construction and probability calculation as the kernel function to calculate the differential transfer probability of a state in each round with the parallel scale set, and improves the calculation efficiency through parallel calculation, as follows:

[0021] (2.1) In order to ensure that the calculation of each thread corresponds to different states, each thread is bound to the data of a certain state of the output differential value, as follows:

[0022] (2.1.1) In order to improve the efficiency of data transmission between CPU and GPU, the number of parallel construction of differential transfer and probability calculation of GPU is set each time, that is, the parallel scale is m, and m is set to 256, so that m threads are started in GPU for parallel calculation each time, and each thread executes the kernel function to complete the differential transfer construction and probability calculation of a state.

[0023] (2.1.2) In order to improve the utilization of GPU, the thread block is usually generated in GPU, and the number of threads generated by each thread block is usually an integer multiple of 32. Assuming that the number of threads in each thread block generated by GPU is blockDim, the index of each thread block is blockIdx, and the index of each thread in the thread block is threadIdx, the thread number tid of each thread can be calculated uniquely, tid = blockDim × blockIdx + threadIdx.

[0024] (2.1.3) Each thread takes its thread number tid as part of the output differential value to be constructed, denoted as γ tid , γ tid = tid, so that the thread number can be bound to the data of a certain state of the output differential value, ensuring that the data in each thread is different.

[0025] (2.2) The kernel function differential transfer construction and probability calculation are completed in each thread, as follows:

[0026] (2.2.1) Assuming that the differential transfer bit length to be constructed is l, l is equal to an integer multiple of log2 m , wherein log2 m represents the bit length obtained by taking the logarithm of the parallel scale m; based on l, an input differential value α and β in the input kernel function are truncated using a mask mask, and the lowest l significant bits are retained, wherein The symbol represents a logical negation operation, ULL represents an unsigned long integer variable, >> represents a right shift operation, α = α & mask, β = β & mask, where & represents a bitwise AND operation;

[0027] (2.2.2) Use a mask to truncate the output difference value γ in the input kernel function, retaining the least significant bits, i.e., γ = γ & mask; then the truncated γ is compared with the γ bound to the thread number. tid By combining these values, we obtain the complete output difference value γ = γ|(γ) constructed by this thread. tid <<(l-log2 m ), where | represents a bitwise OR operation;

[0028] (2.2.3) Calculate the differential transfer probability P. A differential transfer is feasible if and only if the XOR result of the least significant bits of the three differential values ​​α, β, and γ is 0, and the value at a certain intermediate bit position (excluding the most significant bit) is the same, and this value is equal to the XOR result of the bit value of the higher 1 significant bit position of the current bit position. The probability is non-zero. in Where α[i], β[i] and γ[i] represent the values ​​of the i-th bits of α, β and γ respectively, and eq is used to determine whether the bit values ​​of the variables are the same;

[0029] (2.3) Return the differential transition (α,β→γ) and differential transition probability P to the CPU.

[0030] In the GPU-based ARX block cipher optimal differential feature search method of this invention, step (3) involves using GPU parallel computing to perform a bidirectional search to obtain two optimal differential features. The specific steps are as follows:

[0031] (3.1) The forward search for the optimal difference feature process is as follows:

[0032] (3.1.1) Let BPfe be the probability threshold used for pruning decisions in the forward search. This threshold is an estimate, and let BPfe1 represent the optimal probability estimate for the first round of forward search. Since the optimal probability of the splicing position is 1, let BPfe1 = 1 / 4; and the optimal probability estimate for round i is equal to half of the optimal probability estimate for round i-1, i.e., BPfe i =BPfe i-1 / 2;

[0033] (3.1.2) For a forward search involving X rounds, with the current round number i, let i = 1. If i ≤ X, then:

[0034] (3.1.2.1) According to the complete bit length L of the modulo addition operation, the total number of times of calling the kernel function in each round is determined as L / log2 m In the jth call of the kernel function in each round, the relationship between the bit length l of the differential transition and j is l=jxlog2 m , let j=1; define a three-dimensional array XDP[i][j][k] to store the differential transition and the differential transition probability results calculated by m GPU threads in each round of different times of calling the kernel function, wherein the current round number i∈[1,X], the number of times of calling the kernel function in the current round j∈[1,L / log2 m ], and the GPU thread started by each call of the kernel function k∈[0,m-1], let k=0;

[0035] (3.1.2.2) Assuming that the round function of the cryptographic algorithm is F, the input differential values a and β are subjected to cyclic shift or XOR operation according to the structure of F before entering the modulo addition operation in the forward search in the encryption direction;

[0036] (3.1.2.3) The input differential values a and β, the output differential value γ, and the bit length l of the differential transition are input as parameters of the kernel function called by the host CPU to the device GPU;

[0037] (3.1.2.4) The device starts m GPU threads to execute in parallel, each thread executes the kernel function operation according to the input parameters, constructs the differential transition and calculates the probability, and returns the results;

[0038] (3.1.2.5) The host obtains all the differential transitions (a, β→γ) and the differential transition probability P returned by the device, and stores the obtained results in the three-dimensional array XDP[i][j][k] according to the number of rounds searched, the number of times of calling the kernel function in each round, and the number of GPU threads started each time;

[0039] (3.1.2.6) Let k=0, the host reads the data XDP[i][j][k];

[0040] (3.1.2.7) The host takes the optimal probability of all previous X-1 rounds and the differential transition probability in XDP[i][j][k] as the pruning condition, and first verifies whether it is established, wherein represents the product of the differential transition probability constructed in each of the first i-1 rounds in the current search process, BPf X-i represents the optimal probability of X-i rounds; if it is established, go to (3.1.2.8), otherwise let k=k+1, go to (3.1.2.10);

[0041] (3.1.2.8) judge whether the length of the current constructed differential transition bit l is equal to the length of the complete modular addition operation bit L, if l=L, go to (3.1.2.9), otherwise let j=j+1, go to (3.1.2.3);

[0042] (3.1.2.9) judge whether the current search round i is the target round X of the forward search, if yes, go to (3.1.2.15), otherwise perform the cyclic shift or XOR operation on the input differential values α and β of the next round according to the round function F, set the output differential value γ to 0, let i=i+1, j=1, go to (3.1.2.2) to enter the next round of search;

[0043] (3.1.2.10) take the optimal probability of all the previous X-1 rounds and the differential transition probability in XDP[i][j][k] as the pruning condition, re-verify whether is true, if true, go to (3.1.2.8), otherwise go to (3.1.2.11);

[0044] (3.1.2.11) judge whether k=m-1 is true, if true, go to (3.1.2.12), otherwise let k=k+1, go to (3.1.2.10);

[0045] (3.1.2.12) judge whether l>log2 m is true, if true, go to (3.1.2.13), otherwise go to (3.1.2.14);

[0046] (3.1.2.13) backtrack the search method to the previous differential transition construction process of the current round, let j=j-1, k=k+1, go to (3.1.2.10);

[0047] (3.1.2.14) backtrack the search method to the last differential transition construction process of the previous round, let i=i-1, j=L / log2 m , k=k+1, go to (3.1.2.10);

[0048] (3.1.2.15) perform the cyclic shift or XOR operation on each round differential transition (α,β→γ) i obtained by the current forward search and the differential transition at the splicing position according to the encryption direction and the round function F, to obtain the complete output differential value Tf i of each round, and the complete output differential value Df obtained by the forward operation at the splicing position, to obtain the optimal differential characteristic BTf X of the X rounds of forward search = {Df, Tf1, Tf2, …, Tf X}, and the optimal differential characteristic probability BPf X of the X rounds of forward search = P1×P2×…×P X, end the forward search process;

[0049] (3.2) The reverse search part of the optimal differential feature process is as follows:

[0050] (3.2.1) Set BPbe as the probability threshold for pruning judgment in reverse search, which is an estimated value. Set BPbei as the optimal probability estimate value of the i-th round of reverse search. Since the optimal probability value of the splicing position is 1, set BPbei = 1 / 4. The optimal probability estimate value of the i-th round is equal to half of the optimal probability estimate value of the i-1-th round, i.e. BPbei = BPbei-1 / 2. Set the three-dimensional array XDP[][][] to empty. i i-1

[0051] (3.2.2) For reverse search containing Y rounds, the current round number is i, set i = 1, if i ≤ Y, then:

[0052] (3.2.2.1) According to the complete bit length L of the modular addition operation, determine the total number of times of calling the kernel function in each round as L / log2 m . At the j-th time of calling the kernel function in each round, the relationship between the bit length l of the differential transition and j is l = j × log2 m . Set j = 1. The three-dimensional array XDP[i][j][k] stores the differential transition and the differential transition probability results calculated by m GPU threads in each round of calling the kernel function, where the current round number i ∈ [1, Y], the number of times of calling the kernel function in the current round j ∈ [1, L / log2 m ], and the GPU thread k ∈ [0, m-1] started by each time of calling the kernel function. Set k = 0.

[0053] (3.2.2.2) Assuming that the round function of the password algorithm is F, the reverse search is performed in the decryption direction, and the input differential values α and β are subjected to cyclic shift or XOR operation according to the structure of F before entering the modular addition operation.

[0054] (3.2.2.3) The input differential values α and β, the output differential value γ, and the bit length l of the differential transition are input as parameters for the host CPU to call the kernel function of the device GPU.

[0055] (3.2.2.4) The device starts m GPU threads to execute in parallel, each thread executes the kernel function operation according to the input parameters, constructs and calculates the probability of the differential transition, and returns the results.

[0056] ​​(3.2.2.5) The host obtains all the returned differential transitions (a, b→g) and differential transition probabilities P, and stores the obtained results into a three-dimensional array XDP[i][j][k] according to the number of search rounds, the number of kernel functions called in each round, and the number of GPU threads started each time;

[0057] (3.2.2.6) Let k = 0, and the host reads data XDP[i][j][k];

[0058] (3.2.2.7) The host verifies whether the following condition is met, using the optimal probability of all previous Y-1 rounds and the differential transition probability in XDP[i][j][k] as pruning conditions: wherein, represents the product of the differential transition probabilities constructed in each of the previous i-1 rounds in the current search process, BPb Y-i represents the optimal probability of Y-i rounds; if the condition is met, go to (3.2.2.8); otherwise, let k = k + 1, and go to (3.2.2.10);

[0059] (3.2.2.8) Determine whether the current constructed differential transition bit length l is equal to the complete bit length L of the modulo addition operation; if l = L, go to (3.2.2.9); otherwise, let j = j + 1, and go to (3.2.2.3);

[0060] (3.2.2.9) Determine whether the current search round i is the target round Y of reverse search; if yes, go to (3.2.2.15); otherwise, perform cyclic shift or XOR operation on the input differential values a and b of the next round according to the round function F, set the output differential value g to 0, let i = i + 1, j = 1, and go to (3.2.2.2) to enter the next round of search;

[0061] (3.2.2.10) The host re-verifies whether the following condition is met, using the optimal probability of all previous Y-1 rounds and the differential transition probability in XDP[i][j][k] as pruning conditions: if the condition is met, go to (3.2.2.8); otherwise, go to (3.2.2.11);

[0062] (3.2.2.11) Determine whether k = m-1 is met; if yes, go to (3.2.2.12); otherwise, let k = k + 1, and go to (3.2.2.10);

[0063] (3.2.2.12) Determine whether l > log2 m is met; if yes, go to (3.2.2.13); otherwise, go to (3.2.2.14);

[0064] (3.2.2.13) The search method traces back to the last differential transition construction process of the current round, and j=j-1, k=k+1, turn to (3.2.2.10);

[0065] (3.2.2.14) The search method traces back to the last differential transition construction process in the last round, and i=i-1, j=L / log2 m , k=k+1, turn to (3.2.2.10);

[0066] (3.2.2.15) Perform a cyclic shift or XOR operation on each round differential transition (α,β→γ) i obtained by the current reverse search and the differential transition at the splicing position according to the decryption direction and the round function F, to obtain the complete output differential value Tb i of each round, and the complete output differential value Db obtained by the reverse operation at the splicing position, to obtain the optimal differential characteristic BTb Y of the Y rounds of reverse search, and the optimal differential characteristic probability BPb Y of the Y rounds of reverse search, and the optimal differential characteristic probability BPb Y of the Y rounds of reverse search, and the optimal differential characteristic probability BPb Y of the Y rounds of reverse search, and the optimal differential characteristic probability BPb

[0067] In the optimal differential characteristic search method of the ARX type block cipher based on GPU, the step (4) splices the two-part optimal differential characteristics to obtain the overall optimal differential characteristic, and the specific steps are as follows:

[0068] (4.1) Reverse the optimal differential characteristic BTb Y obtained by the Y rounds of reverse search to obtain RBTb Y , but the differential characteristic probability of each round remains unchanged;

[0069] (4.2) Splice the optimal differential characteristic BTf X obtained by the X rounds of forward search and RBTb Y , and use T N to represent the overall N round differential characteristic finally obtained, and T N =RBTb Y ||BTf X , wherein || represents a sequence splicing operation;

[0070] (4.4) Calculate the N round differential characteristic probability BP N =BPf X ×BPb Y ;

[0071] (4.5) End the splicing process to obtain the optimal differential characteristic and the differential characteristic probability of the N round search, and end the search.

[0072] The beneficial effects of the present application are:

[0073] (1) The method of the present application splits the multi-round search process into two parts, forward and reverse, by selecting a high-probability differential transition, splits a long round into two short rounds, reduces the recursive depth of the overall search round number, and reduces the time required for optimal differential characteristic search of ARX-type block ciphers;

[0074] (2) The method of the present application designs a GPU-based differential transition construction and probability calculation parallel scheme, performs parallel calculation in the bidirectional search process of the optimal differential characteristic of ARX-type block ciphers, improves the calculation efficiency, shortens the calculation time, and improves the search speed of the optimal differential characteristic of ARX-type block ciphers. BRIEF DESCRIPTION OF DRAWINGS

[0075] Figure 1 is a flowchart of the ARX-type block cipher optimal differential characteristic search method based on GPU of the present application;

[0076] Figure 2 is a schematic diagram of the present application method for selecting a high-probability differential transition to split the search process;

[0077] Figure 3 is a flowchart of the bidirectional search based on GPU parallel calculation in the method of the present application. DETAILED DESCRIPTION

[0078] The content of the present application will be further described below in conjunction with the embodiments and the drawings, but is not limited to the present application.

[0079] EMBODIMENT

[0080] Referring to Figure 1 , an ARX-type block cipher optimal differential characteristic search method based on GPU, comprising the following steps:

[0081] (1) selecting a high-probability differential transition to split the search process;

[0082] (2) designing a GPU parallel calculation scheme with differential transition construction and probability calculation as the kernel function;

[0083] (3) completing bidirectional search based on GPU parallel calculation to obtain two parts of the optimal differential characteristic;

[0084] (4) splicing the two parts of the optimal differential characteristic to obtain the overall optimal differential characteristic.

[0085] Referring to Figure 2 , the step (1) of selecting a high-probability differential transition to split the search process, the specific steps are as follows:

[0086] (1.1) In order to reduce the problem of excessive recursion depth caused by multi-round search, the entire search problem is divided into two parts at the splicing position, reducing the overall recursion depth; since many optimal differential characteristics of ARX type block cipher have special internal differential transfer at the middle round number, that is, the differential transfer has only one non-0 bit, here, a differential transfer with a probability of 1 is selected as the differential transfer at the splicing position; according to the modulo addition operation, the differential transfer at the splicing position is set as: input differential value α = 0x8...0, input differential value β = 0x0...0, output differential value γ = 0x8...0, where 0x represents hexadecimal, and the values in the ellipsis are all 0, assuming that the complete bit length of the modulo addition operation is L, then the number of 0 is num = (L-8) / 4;

[0087] (1.2) Assuming that the target search round number is N, then the round number of the splicing position is represents the upward rounding;

[0088] (1.3) In the search direction of the splicing position to the target search round number N, the search direction of the splicing position to the first round is the reverse search, assuming that the round number of the forward search is X and the round number of the reverse search is Y, then N = X + Y + 1.

[0089] Step (2) uses differential transfer construction and probability calculation as a kernel function to design a GPU parallel computing scheme, and the specific steps are as follows:

[0090] (2.1) In order to ensure that the calculation of each thread corresponds to different states, each thread is bound to the data of a certain state of the output differential value, and the specific steps are as follows:

[0091] (2.1.1) In order to improve the efficiency of data transmission between CPU and GPU, the number of parallel construction of differential transfer and probability calculation of GPU is set each time, that is, the parallel scale is m, and here m = 256, then m threads need to be started in GPU for parallel calculation each time, and each thread executes the kernel function to complete the differential transfer construction and probability calculation of one state;

[0092] (2.1.2) In order to improve the utilization rate of GPU, the thread block is usually generated in GPU, and the number of threads generated by each thread block is usually an integer multiple of 32; assuming that the number of threads in each thread block generated by GPU is blockDim, the index of each thread block is blockIdx, and the index of each thread in the thread block is threadIdx, then the thread number tid of each thread can be uniquely calculated, tid = blockDim × blockIdx + threadIdx;

[0093] ​(2.1.3) Each thread binds its thread number tid as part of the output difference value to be constructed, denoted as γ tid , γ tid = tid, the thread number can be bound with the data of a certain state of the output difference value, ensuring that the data in each thread is different;

[0094] (2.2) The differential transition construction and probability calculation of the kernel function are completed in each thread respectively, as follows:

[0095] (2.2.1) Assuming that the differential transition bit length to be constructed is l, l is equal to an integer multiple of log2 m , where log2 m represents the bit length obtained by taking the logarithm of the parallel scale m; based on l, a mask mask is used to truncate the input difference values α and β in the incoming kernel function, retaining the lowest l significant bits, where represents the logical NOT operation, ULL represents an unsigned long integer variable, >> represents the right shift operation, α = α & mask, β = β & mask, and & represents the bitwise AND operation;

[0096] (2.2.2) The output difference value γ in the incoming kernel function is truncated using the mask mask, retaining the lowest l significant bits, i.e. γ = γ & mask; then the truncated γ is combined with the γ tid bound with the thread number, to obtain the complete output difference value γ = γ | (γ tid <<(l-log2 m )), where | represents the bitwise OR operation;

[0097] (2.2.3) Calculate the differential transition probability P. If and only if the XOR result of the lowest significant bits of the three difference values α, β and γ is 0, the value at a certain bit position other than the highest significant bit is the same, and the value is equal to the XOR result of the bit value of the high 1-bit significant bit at the current bit position, the differential transition meets the condition of feasible differential transition, and the probability is non-zero, and the probability value where where α[i], β[i] and γ[i] represent the values of the i-th bit of α, β and γ, respectively, and eq is used to determine whether the bit values of the variables are the same;

[0098] (2.3) Return the differential transition (α, β→γ) and the differential transition probability P to the CPU.

[0099] Referring to Figure 3 , step (3) described above, the GPU-based parallel calculation completes bidirectional search to obtain two parts of the optimal differential feature, the specific steps are as follows:

[0100] (3.1) The forward search optimal differential characteristic process is as follows:

[0101] (3.1.1) Set BPfe as a probability threshold value for pruning judgment in the forward search, which is an estimated value. Set BPfe1 as the optimal probability estimate value of the forward 1 round search. Since the optimal probability value of the splicing position is 1, set BPfe1 = 1 / 4. The optimal probability estimate value of i rounds is equal to half of the optimal probability estimate value of i-1 rounds, that is, BPfe i = BPfe i-1 / 2.

[0102] (3.1.2) For the forward search containing X rounds, the current round number is i, set i = 1, if i≤X, then:

[0103] (3.1.2.1) According to the complete bit length L of the modular addition operation, determine the total number of times of calling the kernel function in each round as L / log2 m . At the jth time of calling the kernel function in each round, the relationship between the bit length l of the differential transition and j is l = j x log2 m . Set j = 1. Define a three-dimensional array XDP[i][j][k] to store the differential transition and the differential transition probability results calculated by m GPU threads in each round of calling the kernel function, wherein the current round number i ∈ [1, X], the number of calling the kernel function in the current round j ∈ [1, L / log2 m ], and the GPU thread k ∈ [0, m-1] started each time the kernel function is called. Set k = 0.

[0104] (3.1.2.2) Assume that the round function of the cryptographic algorithm is F. According to the encryption direction, perform forward search, and perform cyclic shift or XOR operation on the input differential values α and β before entering the modular addition operation of F according to the structure of F;

[0105] (3.1.2.3) Input the input differential values α and β, the output differential value γ, and the bit length l of the differential transition as the parameters of the kernel function called by the host CPU to the device GPU;

[0106] (3.1.2.4) The device starts m GPU threads to execute in parallel. Each thread executes the kernel function operation according to the input parameters, constructs and calculates the probability of the differential transition, and returns the results;

[0107] (3.1.2.5) The host obtains all the returned differential transitions (α, β→γ) and differential transition probabilities P from the device. According to the number of rounds searched, the number of times of calling the kernel function in each round, and the number of GPU threads started each time, the obtained results are respectively stored in the three-dimensional array XDP[i][j][k];

[0108] (3.1.2.6) let k = 0, the host reads data XDP[i][j][k];

[0109] (3.1.2.7) the host verifies whether the following condition holds: wherein, denotes the product of the differential transition probabilities constructed in the previous i-1 rounds in the current search process, BPf X-i denotes the optimal probability of the X-i round; if the condition holds, go to (3.1.2.8), otherwise let k = k + 1, go to (3.1.2.10);

[0110] (3.1.2.8) determine whether the length of the differential transition bit l currently constructed is equal to the bit length L of the modulo addition operation; if l = L, go to (3.1.2.9), otherwise let j = j + 1, go to (3.1.2.3);

[0111] (3.1.2.9) determine whether the current search round i is the target round X of the forward search; if yes, go to (3.1.2.15), otherwise perform a cyclic shift or XOR operation on the input differential values a and b of the next round according to the round function F, set the output differential value g to 0, let i = i + 1, j = 1, and go to (3.1.2.2) to enter the next round of search;

[0112] (3.1.2.10) the host re-verifies whether the following condition holds: wherein,

[0113] (3.1.2.11) determine whether k = m-1 holds; if yes, go to (3.1.2.12), otherwise let k = k + 1, go to (3.1.2.10);

[0114] (3.1.2.12) determine whether l > log2 m holds; if yes, go to (3.1.2.13), otherwise go to (3.1.2.14);

[0115] (3.1.2.13) the search method is backtracked to the differential transition construction process of the previous round, let j = j - 1, k = k + 1, and go to (3.1.2.10);

[0116] (3.1.2.14) the search method is backtracked to the differential transition construction process of the last round, let i = i - 1, j = L / log2 m, k = k + 1, turn (3.1.2.10);

[0117] (3.1.2.15) transfer each round difference obtained by the current forward search (a, b→g) i and the difference transfer at the splicing position performs a cyclic shift or XOR operation according to the encryption direction and the round function F to obtain the complete output difference value Tf of each round i and the complete output difference value Df obtained by the forward operation at the splicing position, get the optimal differential feature BTf of X rounds of forward search X = {Df, Tf1, Tf2, …, Tf X}, the optimal differential feature probability BPf of X rounds of forward search X = P1×P2×…×P X , end the forward search process;

[0118] (3.2) the optimal differential feature process of the reverse search part, as follows:

[0119] (3.2.1) Set BPbe as the probability threshold for pruning judgment in reverse search, which is an estimated value. The optimal probability estimate value of reverse 1 round search is represented by BPbe1. Since the optimal probability value of the splicing position is 1, set BPbe1 = 1 / 4. The optimal probability estimate value of i rounds is equal to half of the optimal probability estimate value of i-1 rounds, that is, BPbe i = BPbe i-1 / 2; set the three-dimensional array XDP[][][] to empty;

[0120] (3.2.2) For reverse search containing Y rounds, the current round number is i, let i = 1, if i≤Y, then:

[0121] (3.2.2.1) According to the complete bit length L of the modulo addition operation, determine the total number of times of calling the kernel function in each round as L / log2 m , at the jth time of calling the kernel function in each round, the relationship between the bit length l of the difference transfer and j is l = j × log2 m , let j = 1; the three-dimensional array XDP[i][j][k] stores the difference transfer and the difference transfer probability results calculated by m GPU threads respectively started in each round of calling the kernel function, where the current round number i ∈ [1, Y], the number of times of calling the kernel function in the current round j ∈ [1, L / log2 m ], and the GPU thread started each time k ∈ [0, m-1], let k = 0;

[0122] (3.2.2.2) Assuming the round function of the cryptographic algorithm is F, the input difference values α and β are cyclically shifted or XORed according to the structure of F before the modular addition operation into F in the reverse search in the decryption direction;

[0123] (3.2.2.3) The input difference values α and β, the output difference value γ, and the bit length l of the difference transition to be constructed are input as parameters for calling the kernel function of the device-side GPU by the host-side CPU;

[0124] (3.2.2.4) The device side starts m GPU threads to execute in parallel, each thread executes the kernel function operation according to the input parameters, constructs the difference transition and calculates the probability, and returns the result;

[0125] (3.2.2.5) The host side obtains all the returned difference transitions (α, β→γ) and difference transition probabilities P, and stores the obtained results in the three-dimensional array XDP[i][j][k] according to the number of rounds searched, the number of times the kernel function is called each round, and the number of GPU threads started each time;

[0126] (3.2.2.6) Let k = 0, the host side reads the data XDP[i][j][k];

[0127] (3.2.2.7) The host side uses the optimal probability of all previous Y-1 rounds and the difference transition probability in XDP[i][j][k] as pruning conditions to verify first, where represents the product of the difference transition probabilities constructed in each of the first i-1 rounds in the current search process, BPb Y-i represents the optimal probability of Y-i rounds; if it is true, go to (3.2.2.8), otherwise let k = k + 1, go to (3.2.2.10);

[0128] (3.2.2.8) Determine whether the bit length l of the currently constructed difference transition is equal to the complete bit length L of the modular addition operation, if l = L, go to (3.2.2.9), otherwise let j = j + 1, go to (3.2.2.3);

[0129] (3.2.2.9) Determine whether the current search round i is the target round Y of the reverse search, if yes, go to (3.2.2.15), otherwise cyclically shift or XOR the input difference values α and β according to the round function F into the next round, set the output difference value γ to 0, let i = i + 1, j = 1, and go to (3.2.2.2) to enter the search of the next round;

[0130] (3.2.2.10) The host side uses the optimal probability of all previous Y-1 rounds and the difference transition probability in XDP[i][j][k] as pruning conditions to re-verify Check if it is true. If true, proceed to (3.2.2.8); otherwise, proceed to (3.2.2.11).

[0131] (3.2.2.11) Determine whether k = m - 1 is true. If it is true, go to (3.2.2.12). Otherwise, let k = k + 1 and go to (3.2.2.10).

[0132] (3.2.2.12) Determine if l > log2 m Check if it is true. If it is true, proceed to (3.2.2.13); otherwise, proceed to (3.2.2.14).

[0133] (3.2.2.13) The search method backtracks to the previous differential transition construction process in the current round number, let j = j-1, k = k+1, and go to (3.2.2.10);

[0134] (3.2.2.14) The search method backtracks to the last differential transition construction process in the previous round, letting i = i-1 and j = L / log2. m , k = k + 1, go to (3.2.2.10);

[0135] (3.2.2.15) Transfer the difference obtained in each round of the current reverse search (α,β→γ). i The differential transfer at the concatenation position performs a cyclic shift or XOR operation according to the decryption direction and the round function F to obtain the complete output differential value Tb for each round. i The complete output difference value Db obtained by the reverse operation at the splicing position is used to obtain the optimal difference feature BTb in the reverse search Y rounds. Y ={Db,Tb1,Tb2,…,Tb Y The optimal difference feature probability BPb is obtained by reverse search of Y rounds. Y =P1×P2×…×P Y This concludes the reverse search process.

[0136] Step (4) involves concatenating the two optimal difference features to obtain the overall optimal difference feature. The specific steps are as follows:

[0137] (4.1) The optimal difference feature BTb obtained by reverse search Y rounds Y Invert to obtain RBTb Y However, the differential feature probabilities remain unchanged in each round;

[0138] (4.2) The optimal difference feature BTf obtained from X rounds of forward search X and RBTb Y To splice them together, use T N T represents the final overall N-round difference feature obtained. N =RBTb Y||BTf X where || denotes sequence splicing operation;

[0139] (4.4) Calculate N-round differential feature probability BP N = BPf X x BPb Y ;

[0140] (4.5) End the splicing process, get the optimal differential feature and differential feature probability of N-round search, and end the search.

Claims

1. A method for optimal differential characteristic search of a GPU-based ARX-type block cipher, the method comprising: The method comprises the following steps: (1) selecting a high-probability differential transition to split the search process; selecting a differential transition with a high probability as a splicing position, splitting the multi-round search into forward search and reverse search to reduce the recursive depth of the search; (2) using differential transition construction and probability calculation as a kernel function to design a GPU parallel computing scheme; In each round of forward and reverse search process, a differential transition needs to be constructed and the probability needs to be calculated for each bit state. To improve the efficiency of construction and calculation, a GPU-based parallel computing scheme is designed by using differential transition construction and probability calculation as a kernel function. Each kernel function calculates the differential transition probability of a state with a set parallel size in each round. The calculation efficiency is improved through parallel calculation; (3) completing bidirectional search based on GPU parallel calculation to obtain two parts of optimal differential characteristics; To improve the overall search speed, first perform forward search from the splicing position. Based on the GPU parallel calculation result and the set probability threshold as the pruning judgment condition in the search process, the optimal differential characteristics are searched round by round according to the branch and bound strategy to obtain the optimal differential characteristics of the forward search; Then, the reverse search is continued in the same way to obtain the optimal differential characteristics of the reverse search; (4) splicing the two parts of optimal differential characteristics to obtain the overall optimal differential characteristics; Splice the two parts of optimal differential characteristics obtained by forward search and reverse search to obtain the overall optimal differential characteristics of the ARX type block cipher algorithm, and update the optimal differential characteristic probability. The step (1) of selecting a high-probability differential transition to split the search process comprises the following steps: (1.1) To reduce the problem of excessive recursive depth caused by multi-round search, the entire search problem is split into two parts at the splicing position to reduce the overall recursive depth. Since many optimal differential characteristics of ARX type block cipher have special internal differential transitions in the middle round number, i.e., the differential transition has only one non-zero bit. Here, a differential transition with a probability of 1 is selected as the differential transition at the splicing position. According to the modular addition operation, the differential transition at the splicing position is set as: input differential value α = 0x8...0, input differential value β = 0x0...0, and output differential value γ = 0x8...0, where 0x represents hexadecimal, and the values in the ellipsis are all 0. Assuming that the complete bit length of the modular addition operation is L, the number of 0 is num = (L-8) / 4; (1.2) assuming the target search round is N, the round number where the splicing position is located wherein denotes rounding up; (1.3) The search direction of the splicing position to the target search round number N is forward search, and the search direction of the splicing position to the first round is reverse search. The number of rounds of forward search is X, and the number of rounds of reverse search is Y. Therefore, N = X + Y + 1.

2. The GPU-based ARX-type block cipher optimal differential characteristic search method according to claim 1, characterized in that, The step (2) of using differential transition construction and probability calculation as a kernel function to design a GPU parallel computing scheme comprises the following steps: In each round of the forward and reverse search process, a differential transition needs to be constructed on the state bit of each bit of the output differential value and the probability is calculated. To improve the efficiency of construction and calculation, a GPU-based parallel computing scheme is designed based on differential transition construction and probability calculation as the kernel function. Each kernel function calculates the differential transition probability of a state set in each round of parallel scale. The computing efficiency is improved through parallel calculation, as follows: (2.1) To ensure that the calculation of each thread corresponds to different states, each thread is bound to the data of a certain state of the output differential value, as follows: (2.1.1) To improve the efficiency of data transmission between CPU and GPU, the number of parallel construction of differential transition and probability calculation of GPU is set each time, i.e. the parallel scale is m. Here, m = 256. Then, m threads are started in GPU for parallel calculation each time, and each thread executes the kernel function to complete the differential transition construction and probability calculation of a state; (2.1.2) Assuming that the number of threads in each thread block generated by GPU is blockDim, the index of each thread block is blockIdx, and the index of each thread in the thread block is threadIdx, the thread number tid of each thread can be uniquely calculated, i.e. tid = blockDim × blockIdx + threadIdx; (2.1.3) Each thread will have its thread number tid as part of the output difference value to be constructed, denoted as γ tid , γ tid = tid, then the thread number can be tied to the data of some state of the output difference value, ensuring that the data in each thread is different; (2.2) The differential transition construction and probability calculation of the kernel function are completed in each thread, as follows: (2.2.1) Assume that the length of the differential transfer bits to be constructed at present is l, l is equal to an integer multiple of log2 m , wherein log2 m represents the bit length obtained by taking the logarithm of the parallel scale m; an input differential value α and β in the input kernel function is truncated using a mask mask based on l, and the lowest l significant bits are retained, , wherein represents a logical NOT operation, ULL represents an unsigned long integer variable, >> represents a right shift operation, α = α & mask, β = β & mask, wherein & represents a bitwise AND operation; (2.2.2) the output differential value γ in the input kernel function is truncated using the mask mask, and the lowest l significant bits are retained, that is, γ = γ & mask; then the truncated γ is combined with γ tid bound with the thread number to obtain the complete output differential value γ = γ | (γ tid <<(l-log2 m )) of the thread, wherein | represents a bitwise OR operation; (2.2.3) Calculate the difference transition probability P, which is non-zero if and only if the XOR of the three difference values α, β and γ is zero, the value at some bit position other than the most significant bit is the same as the XOR of the values at the high 1 bit positions of the current bit position, and the difference transition is feasible. The value of the probability is where where α[i], β[i] and γ[i] represent the values of the i-th bit of α, β and γ, respectively, and eq is used to determine whether the values of the variables are the same. (2.3) The differential transition α, β→γ and the differential transition probability P are returned to CPU.

3. The GPU-based ARX-type SPN optimal differential characteristic search method according to claim 2, characterized in that, Step (3) describes the completion of bidirectional search based on GPU parallel calculation to obtain two optimal differential characteristics, as follows: (3.1) The process of forward search for optimal differential characteristics, as follows: (3.1.1) Let BPfe be the probability threshold used in the forward search for making the pruning decision, which is an estimate. Let BPfe1 denote the optimal probability estimate of the forward 1-round search. Since the optimal probability value of the splice position is 1, let BPfe1 = 1 / 4. Let BPfei denote the optimal probability estimate of the i-round search. Then BPfei = BPfei-1 / 2. i i-1 = BPfe​ (3.1.2) For forward search containing X rounds, the current round number is i, i.e. i = 1. If i ≤ X, then: (3.1.2.1) According to the complete bit length L of the modulo addition operation, the total number of times of calling the kernel function in each round is determined as L / log2 m At the jth time of calling the kernel function in each round, the relationship between the bit length l of the differential transfer and j is l=jxlog2 m , let j=1; define a three-dimensional array XDP[i][j][k] to store the differential transfer and the differential transfer probability results of different times of calling the kernel function in each round to start m GPU threads to calculate, wherein the current round number i∈[1,X], the number of times of calling the kernel function in the current round j∈[1,L / log2 m ], and the GPU thread started by each time of calling the kernel function k∈[0,m-1], let k=0; (3.1.2.2) Assuming that the round function of the password algorithm is F, the input differential values α and β are subjected to cyclic shift or XOR operation according to the structure of F before entering the modular addition operation in the forward search in the encryption direction; (3.1.2.3) The input differential values α and β, the output differential value γ, and the bit length l of the differential transition to be constructed are input as the parameters of the kernel function called by the host CPU to the device GPU; (3.1.2.4) The device starts m GPU threads to execute in parallel, and each thread executes the kernel function operation according to the input parameters to construct the differential transition and calculate the probability, and returns the results; (3.1.2.5) The host obtains all the returned differential transitions α, β→γ and differential transition probabilities P from the device, and stores the obtained results in the three-dimensional array XDP[i][j][k] according to the number of rounds, the number of times of calling the kernel function in each round, and the number of GPU threads started each time; (3.1.2.6) Let k = 0, and the host reads the data XDP[i][j][k]; (3.1.2.7) The host end verifies first whether the following condition holds, taking the sum of the optimal probabilities of all previous X-1 rounds and the difference transition probability in XDP[i][j][k] as the pruning condition wherein, denotes the product of the difference transition probabilities constructed in each of the previous i-1 rounds in the current search process, BPf X-i denotes the optimal probability of the X-i round. If the condition holds, go to (3.1.2.8). Otherwise, let k = k + 1, and go to (3.1.2.10). (3.1.2.8) judge whether the current constructed differential transition bit length l is equal to the bit length L of the modular addition operation, if l = L, go to (3.1.2.9), otherwise let j = j + 1, go to (3.1.2.3); (3.1.2.9) judge whether the current search round i is the target round X of forward search, if yes, go to (3.1.2.15), otherwise according to the round function F, perform cyclic shift or XOR operation on the input differential values α and β entering the next round, set the output differential value γ to 0, let i = i + 1, j = 1, go to (3.1.2.2) to enter the search of the next round; (3.1.2.10) The host side re-verify all the optimal probability and the difference transfer probability in XDP[i][j][k] as the pruning condition, turn to (3.1.2.8) if it is true, otherwise turn to (3.1.2.11); (3.1.2.11) The host side re-verify all the optimal probability and the difference transfer probability in XDP[i][j][k] as the pruning condition, turn to (3.1.2.8) if it is true, otherwise turn to (3.1.2.12); (3.1.2.11) judge whether k = m - 1 is true, if true, go to (3.1.2.12), otherwise let k = k + 1, go to (3.1.2.10); (3.1.2.12) Determine if l > log2 m Check if it is true. If true, proceed to (3.1.2.13); otherwise, proceed to (3.1.2.14). (3.1.2.13) the search method is traced back to the last differential transition construction process of the current round, let j = j - 1, k = k + 1, go to (3.1.2.10); (3.1.2.14) Search method backtracks to the last differential transition construction in the previous round, setting i = i - 1, j = L / log2 m , k = k + 1, go to (3.1.2.10); (3.1.2.15) Transfer each round difference obtained by the current forward search (α, β→γ) i and the differential transfer at the splicing position, according to the encryption direction and the round function F, perform a cyclic shift or XOR operation to obtain the complete output differential value Tf of each round i and the complete output differential value Df obtained by the forward operation at the splicing position, to obtain the optimal differential feature BTf of the X rounds of forward search X = {Df, Tf1, Tf2, …, Tf X}, the optimal differential feature probability BPf of the X rounds of forward search X = P1×P2×…×P X , end the forward search process; (3.2) reverse search part of the optimal differential characteristic process, specifically as follows: (3.2.1) Let BPbe be a probability threshold used to make the pruning decision in the backward search, which is an estimation. Let BPbei represent the optimal probability estimation of the i-th round of backward search. Since the optimal probability value of the splice position is 1, let BPbei = 1 / 4. The optimal probability estimation of the i-th round is equal to half of the optimal probability estimation of the i-1-th round, i.e., BPbei = BPbei-1 / 2. Set the three-dimensional array XDP[][][] to be empty. i = BPbei-1 / 2. i-1 Set the three-dimensional array XDP[][][] to be empty. (3.2.2) for reverse search containing Y rounds, the current round is i, let i = 1, if i ≤ Y, then: (3.2.2.1) According to the complete bit length L of the modulo addition operation, the total number of times of calling the kernel function in each round is determined as L / log2 m , the relationship between the bit length l of the differential transfer and j is l=jxlog2 m , let j=1; the three-dimensional array XDP[i][j][k] stores the differential transfer and the differential transfer probability results calculated by m GPU threads respectively started by different times of calling the kernel function in each round, wherein i∈[1,Y], the current round number of times of calling the kernel function j∈[1,L / log2 m ], and the GPU thread k started by each time of calling the kernel function k∈[0,m-1], let k=0; (3.2.2.2) assuming that the round function of the cryptographic algorithm is F, perform reverse search in the decryption direction, and perform cyclic shift or XOR operation on the input differential values α and β before entering the modular addition operation of F according to the structure of F; (3.2.2.3) input the input differential values α and β, the output differential value γ, and the bit length l of the differential transition to be constructed as parameters to call the kernel function of the device-side GPU from the host-side CPU; (3.2.2.4) the device side starts m GPU threads to execute in parallel, each thread executes the kernel function operation according to the input parameters, constructs the differential transition and calculates the probability, and returns the result; (3.2.2.5) the host side obtains all the returned differential transitions α, β → γ and differential transition probabilities P from the device side, and stores the obtained results into a three-dimensional array XDP[i][j][k] according to the number of rounds searched, the number of times the kernel function is called each round, and the number of GPU threads started each time; (3.2.2.6) let k = 0, the host side reads the data XDP[i][j][k]; (3.2.2.7) The host end verifies the optimal probability of all previous Y-1 rounds and the difference transfer probability in XDP[i][j][k] as a pruning condition, first verify whether it is true, where, represents the product of the difference transfer probability constructed in each of the previous i-1 rounds in the current search process, BPb Y-i represents the optimal probability of Y-i rounds; if it is true, go to (3.2.2.8), otherwise let k=k+1, go to (3.2.2.10); (3.2.2.8) judge whether the current constructed differential transition bit length l is equal to the bit length L of the modular addition operation, if l = L, go to (3.2.2.9), otherwise let j = j + 1, go to (3.2.2.3); (3.2.2.9) judge whether the current search round i is the target round Y of reverse search, if yes, go to (3.2.2.15), otherwise according to the round function F, perform cyclic shift or XOR operation on the input differential values α and β entering the next round, set the output differential value γ to 0, let i = i + 1, j = 1, go to (3.2.2.2) to enter the search of the next round; (3.2.2.10) Host side re-verify all the optimal probability and the difference transfer probability in XDP[i][j][k] as the pruning condition, turn to (3.2.2.8) if it is true, otherwise turn to (3.2.2.11); (3.2.2.11) judge whether k = m-1 is true, turn to (3.2.2.12) if it is true, otherwise let k = k+1, and turn to (3.2.2.10). (3.2.2.12) Determine if l > log2 m Check if it is true. If it is true, proceed to (3.2.2.13); otherwise, proceed to (3.2.2.14). (3.2.2.13) the search method is traced back to the last differential transition construction process of the current round, let j = j - 1, k = k + 1, go to (3.2.2.10); (3.2.2.14) Search method backtracks to the last differential transition construction in the previous round, setting i = i - 1, j = L / log2 m , k = k + 1, go to (3.2.2.10); (3.2.2.15) Transfer each round difference obtained by current reverse search (a, b→g) i and the differential transfer at the splicing position, according to the decryption direction and the round function F, perform a cyclic shift or XOR operation to obtain the complete output differential value Tb of each round i and the complete output differential value Db obtained by the reverse operation at the splicing position, to obtain the optimal differential characteristic BTb of the reverse search Y rounds Y = {Db, Tb1, Tb2, …, Tb Y}, the optimal differential characteristic probability BPb of the reverse search Y rounds Y = P1×P2×…×P Y , end the reverse search process.

4. The GPU-based ARX-type SPN optimal differential characteristic search method according to claim 3, characterized in that, The two parts are spliced to obtain the whole optimal differential feature according to step (4), and the specific steps are as follows: (4.1) The optimal differential feature BTb obtained by reverse searching the number of Y wheels Y RBTb is obtained by reversing Y But the differential feature probability of each round does not change; (4.2) The optimal differential feature BTf obtained by the forward search X rounds X and RBTb Y are spliced, and T N represents the overall N-round differential feature finally obtained, T N = RBTb Y || BTf X , wherein || represents a sequence splicing operation; (4.4) Calculate N round difference feature probability BP N = BPf X x BPb Y ; (4.5) End the splicing process to obtain the optimal differential feature and the differential feature probability of N rounds of search, and end the search.

Images