ARX password anti-differential and linear analysis security assessment method and system

Abstract

The invention discloses an ARX password anti-differential and linear analysis security assessment method and system, and relates to the password technology, and the method comprises the steps: respectively constructing a differential distribution table CDDT of dependent carry of modular addition and a linear approximation table CLAT of dependent carry; respectively sorting the CDDT and the CLAT according to the differential probability and the linear probability; after sorting, searching the optimal differential feature and the linear feature of the ARX password based on a branch and bound algorithm; and after all plaintext differences and masks are traversed, obtaining the maximum difference and linear feature probability as the maximum difference and linear feature probability of the ARX password of the corresponding round number. The invention provides an ARX password anti-differential and linear analysis security assessment method based on a carry-dependent differential distribution table and a linear approximation table, and solves the problem of anti-differential and linear analysis security assessment in an ARX password design process.

Description

Technical Field

[0001] The present application relates to the field of cryptographic technology, and in particular to a security assessment method and system for ARX cryptography against differential and linear analysis. Background Art

[0002] Symmetric cryptography is an important branch of cryptography and plays an extremely important role in the field of information security. Among symmetric cryptographic algorithms, there is a class of algorithms that only use three basic logical operations: modular addition, cyclic shift, and exclusive OR. This type of algorithm is called an ARX-structured cryptographic algorithm, or ARX cryptography for short. The advantages of ARX cryptography are that it is very simple in design, highly efficient in execution, and very suitable for software and hardware implementation. Therefore, ARX cryptography is very suitable for resource-constrained devices such as RFID and wireless sensor networks.

[0003] Differential analysis and linear analysis are the two most effective analysis methods for symmetric cryptography. Resistance to differential analysis and linear analysis has become one of the most important design criteria for symmetric cryptography. Searching for optimal differential features and linear features is the basic method for evaluating the resistance of ARX cryptography to differential analysis and linear analysis. Currently, the most commonly used automated search methods for differential and linear features include: branch and bound algorithm, MILP (Mixed Integer Linear Programming) based method, and SAT (Boolean Satisfiability Problem) based method.

[0004] The branch-and-bound algorithm was proposed by Mitsuru Matsui (also known as the Matsui algorithm). This method is a depth-first search algorithm that improves the algorithm search efficiency by introducing a branch-and-bound strategy. Alex Biryukov and others first extended the Matsui algorithm to the ARX cipher. They proposed a partial difference distribution table, a difference distribution table with a difference probability greater than a specific threshold. Since the partial difference distribution table cannot accurately characterize the difference probability of modular addition, the method of Biryukov and others is not the optimal difference feature search algorithm. Subsequently, Zhengbin Liu and others proposed a carry-dependent S-box, which converts the modular addition operation of a large state into a carry-dependent S-box of a small state. By constructing a carry-dependent difference distribution table (CDDT) and a carry-dependent linear approximation table (CLAT), and combining it with the branch-and-bound search framework, they proposed a new algorithm for searching the optimal difference and linear features of the ARX cipher.

[0005] The MILP-based method and the SAT-based method are two more general automated search methods. Due to their simple models and good versatility, they have been widely used in the design and analysis of cryptographic algorithms. These two methods transform the search problem of the optimal feature into a mixed integer linear programming problem and a Boolean satisfiability problem, respectively, and use a set of linear inequalities and Boolean logic expressions to describe the differential and mask propagation of the ARX cipher, and then solve them through a dedicated solver. However, for the ARX cipher, because a large number of variables, inequalities or Boolean expressions are required to describe the propagation of differentials and masks, the solver usually takes a very long time to calculate the optimal solution or feasible solution. Although many scholars have proposed many methods to improve the search efficiency, such as optimizing the algorithm model by introducing divide-and-conquer, branch-and-bound strategies, the effect is still very limited for the optimal differential and linear features of the ARX cipher, and it is impossible to find the optimal differential and linear features that reach the security bound within a reasonable time. In addition, in addition to the optimization of the algorithm model itself, the efficiency of the MILP-based and SAT-based methods is mainly determined by the efficiency of the solver.

[0006] Since in the process of algorithm design, designers need to determine parameters or modify the design scheme according to the results of security analysis, and usually need to conduct multiple security assessments, the efficiency of the automated search method is very high. Therefore, improving the efficiency of automated search for the optimal differential and linear features of ARX ciphers is of great significance for evaluating the security of ARX ciphers against differential and linear analysis, and has important practical value and application prospects for the design of ARX cryptographic algorithms. Summary of the invention

[0007] The embodiment of the present application proposes a security assessment method for ARX cipher against differential and linear analysis based on a carry-dependent differential distribution table and a linear approximation table, so as to solve the security assessment problem against differential and linear analysis in the ARX cipher design process.

[0008] The present application embodiment provides a security assessment method for ARX cipher against differential and linear analysis, including:

[0009] Construct a carry-dependent differential distribution table CDDT and a carry-dependent linear approximation table CLAT of modular addition respectively;

[0010] CDDT and CLAT are ranked according to differential probability and linear probability, respectively;

[0011] After sorting, the optimal differential features and linear features of the ARX cipher are searched based on the branch and bound algorithm;

[0012] After traversing all plaintext differences and masks, the maximum difference and linear feature probability are obtained as the maximum difference and linear feature probability of the ARX cipher with the corresponding number of rounds.

[0013] Optionally, constructing the modularized CDDT and CLAT separately specifically includes:

[0014] Four tables are used to store the output difference and difference probability respectively, where CDDT_D 1 and CDDT_D 0 Used to store the difference, CDDT_P 1 and CDDT_P 0 Used to store differential probabilities, and CDDT_D 1 and CDDT_P 1 Corresponding to the CDDT containing the most significant bit, CDDT_D 0 and CDDT_P 0 The corresponding module adds the CDDT of other parts;

[0015] Two tables are used to store the output mask and linear probability respectively, where CLAT_M stores all possible output masks and CLAT_P stores the corresponding linear probabilities.

[0016] Optionally, constructing the modularly added CDDT and CLAT separately includes constructing a t-bit CDDT using the following method:

[0017] Traverse the t-bit input differentials A, B and output differentials Γ, as well as the three 1-bit carry differentials a, b, c;

[0018] For each value of A, B, Γ and a, b, c, calculate the intermediate variable The value of

[0019] Determine whether A, B→Γ is an impossible differential. If tmp=0, then A, B→Γ is a possible differential propagation, that is, the differential probability is not 0; if tmp≠0, then A, B→Γ is an impossible differential.

[0020] For possible differential propagation, the corresponding differential probability is calculated, and the differential probability and output differential are stored in CDDT_P and CDDT_D, respectively.

[0021] Optionally, constructing the CDDT and CLAT of the modular addition separately includes constructing the t-bit CLAT in the following manner:

[0022] Traverse the t-bit input mask V, W and output mask U, as well as the 1-bit carry e;

[0023] For each value of U, V, W and e, calculate the intermediate variable The value of

[0024] Determine whether V, W→U is zero correlation, if and , indicating that V,W→U is a possible mask propagation, that is, the linear probability is not 0, otherwise V,W→U is zero correlation;

[0025] For possible mask propagations, the corresponding linear probability is calculated, and the linear probability and output mask are stored in CLAT_P and CLAT_M, respectively.

[0026] Optionally, sorting CDDT and CLAT according to differential probability and linear probability respectively includes:

[0027] For CDDT, sort the elements in CDDT_P in descending order of differential probability, and sort the corresponding elements in CDDT_D according to the order of elements in CDDT_P.

[0028] For CLAT, sort the elements in CLAT_P in descending order of linear probability, and sort the corresponding elements in CLAT_M according to the order of elements in CLAT_P.

[0029] Optionally, searching for optimal differential features and linear features of the ARX cipher based on a branch-and-bound algorithm includes:

[0030] At the beginning of the search, set the initial estimate of the maximum feature probability for round r Perform a search, and if the probability of finding If a differential and linear feature of , then this feature must be the optimal feature, and the search ends. Otherwise, set Re-search until the probability is found Differential and linear characteristics;

[0031] In the first round of search, the modular difference and mask are traversed in descending order of probability. That is, for differential features, the corresponding input differences α and β, and the output difference γ are determined according to the value of eq(α, β, γ); for linear features, The value of determines the corresponding input mask v and ω, and the output mask μ;

[0032] Calculate the difference and mask propagation of the intermediate rounds, as well as the difference and linear probability of the round function, and decide whether to proceed to the next round of search based on the branch conditions;

[0033] In the last round, the maximum difference and linear probability of modular addition are calculated according to the Lipmma-Moriai algorithm and the Schulte-Geers algorithm, the branching conditions are determined, and the maximum difference and linear feature probability currently searched are updated.

[0034] Optionally, computing the difference and mask propagation of the intermediate rounds, as well as the difference and linear probability of the round function also includes:

[0035] For a given input difference and mask, directly calculate the difference of modular addition and the upper bound of linear probability at the beginning of the table lookup, and determine whether the upper bound meets the branch condition. If not, return to the previous round;

[0036] Otherwise, search each CDDT and CLAT in turn, use the values ​​in CDDT_P and CLAT_P to update the upper bounds of the differential and linear probabilities, and determine whether they meet the branch conditions. If they do, continue to search for the next CDDT and CLAT, otherwise return to the previous CDDT and CLAT;

[0037] After searching all CDDTs and CLATs, if the differential and linear probabilities still meet the branching conditions, the next round of search will be carried out. When all differential and linear probabilities do not meet the branching conditions, the previous round will be returned.

[0038] Optionally, searching for the optimal differential feature and linear feature of the ARX cipher based on the branch and bound algorithm also includes, during the differential feature search process, for given n-bit modular addition input differentials α and β, calculating the output differential γ and the differential probability according to the following method:

[0039] Divide the n-bit input differences α and β into m sub-blocks A k and B k (0≤k≤m-1), each sub-block contains t bits;

[0040] Find CDDT_D to get the possible output differential Γ k (0≤k≤m-1), look up CDDT_P to get the corresponding differential probability And calculate the carry difference h(A k )、h(B k ) and h(Γ k ), used to find the next CDDT;

[0041] After finding m CDDTs, cascade m output differentials Γ k (0≤k≤m-1) to obtain the output difference of the modular addition, and convert the corresponding differential probability Multiply to get the difference probability of modular addition

[0042] Optionally, searching for optimal differential features and linear features of the ARX cipher based on the branch and bound algorithm further includes, during the linear feature search process, for given n-bit modular addition input masks ν and ω, calculating the output mask μ and the linear probability C(μ, ν, ω) according to the following method:

[0043] Divide the n-bit input mask ν and ω into m sub-blocks V k and W k (0≤k≤m-1), each sub-block contains t bits;

[0044] Find CLAT_M to get the output mask U of each sub-block k , find CLAT_P to get the corresponding linear probability And, calculate where e k Used to find the next CLAT;

[0045] After searching m CLATs, m output masks U are concatenated k (0≤k≤m-1) to obtain the output mask of the modular addition, and convert the corresponding linear probability Multiplying them gives the linear probability C(μ,ν,ω) of modular addition.

[0046] An embodiment of the present application also proposes a security assessment system for ARX cryptography against differential and linear analysis, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the aforementioned ARX cryptography security assessment method against differential and linear analysis are implemented.

[0047] The embodiment of the present application proposes a security assessment method for ARX cipher against differential and linear analysis based on a carry-dependent differential distribution table and a linear approximation table, so as to solve the security assessment problem against differential and linear analysis in the ARX cipher design process.

[0048] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0050] Figure 1The optimal differential and linear feature search process of the ARX cipher in the embodiment of the present application is shown;

[0051] Figure 2 This is a schematic diagram of using CDDT to calculate the differential probability of modular addition in the embodiment of the present application;

[0052] Figure 3 This is a schematic diagram of the linear probability of modular addition calculated using CLAT in the embodiment of the present application;

[0053] Figure 4 Schematic diagram of differential propagation of the ARX cipher round function according to an embodiment of the present application. DETAILED DESCRIPTION

[0054] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0055] Several related definitions of carry-dependent S-boxes include:

[0056] Define 1n bit modular addition

[0057] set up remember The carry vector is denoted as but:

[0058]

[0059] where carry(x,y) can be iteratively calculated as follows: (1) c 0 =0;

[0060] Definition 2: Carry-dependent S-box

[0061] set up Assumptions n=mt, then It can be converted into the addition of m t-bit numbers. By traversing all possible values ​​of two t-bit addends, we can construct a truth table for t-bit addition, so that we can calculate Because the m t-bit partial sums are related by the carry, the truth table for these partial sums is called a carry-dependent S-box.

[0062] Similarly, a difference distribution table for t-bit addition can be constructed. Due to the influence of carry in addition operation, two adjacent difference distribution tables are related by carry, and such a difference distribution table is called a carry-dependent difference distribution table (CDDT). Similarly, a linear approximation table for t-bit addition can be constructed, and such a linear approximation table is called a carry-dependent linear approximation table (CLAT).

[0063] Theorem 1: Difference probability of n-bit modular addition (Lipmma-Moriai algorithm)

[0064] set up are the input differential and output differential of the analog addition, respectively. mask(n)=2 n -1, wt(x) represents the Hamming weight of x, then

[0065]

[0066] For t bit vector as well as definition .for as well as make

[0067] Then we can also calculate the differential probability of n-bit modular addition according to the following theorem.

[0068] Theorem 3: Difference probability of n-bit modular addition (calculated based on CDDT)

[0069] Let n = mt, A k =α[(k+1)t-1:kt], B k =β[(k+1)t-1:kt],Γ k =γ[(k+1)t-1:kt], 0≤k≤m-1. make

[0070]

[0071] where t 0 =t,t 1 =t-1. Let d k =0(0≤k≤m-2), d m-1 =1, define A -1,B -1 ,Γ -1 is 0, then

[0072]

[0073] Theorem 4 Linear probability of n-bit modular addition (Schulte-Geers algorithm)

[0074] set up They are the output mask and input mask of modular addition, and define M n : for:

[0075]

[0076] make but

[0077]

[0078] in It is a picture The indicator function, x≤y means that for any i∈{0,…,n-1}, there is x i ≤y i ,and

[0079] For t bit vector as well as definition , then the linear probability of n-bit modular addition can also be calculated according to the following theorem.

[0080] Theorem 5: Linear probability of n-bit modular addition (calculated based on CLAT)

[0081] Let n = mt, U k =μ[(k+1)t-1:kt], V k =ν[(k+1)t-1:kt], W k =ω[(k+1)t-1:kt], 0≤k≤m-1. make

[0082]

[0083] in make So

[0084]

[0085] In view of the shortcomings of the existing automated search methods, the embodiments of the present application provide a security assessment method for ARX ciphers against differential and linear analysis, which obtains more accurate branch conditions of the branch and bound algorithm through the propagation properties of modular addition and mask, thereby improving the algorithm search efficiency. Figure 1 As shown, the method of the embodiment of the present application includes the following steps:

[0086] In step S101, a carry-dependent differential distribution table CDDT and a carry-dependent linear approximation table CLAT of modular addition are constructed respectively. In a specific example, in order to save storage space and improve search efficiency, for each input differential, CDDT only stores possible output differentials and corresponding differential probabilities. Similarly, CLAT only stores possible output masks and corresponding linear probabilities. CDDT and CLAT are sorted according to differential probabilities and linear probabilities, respectively.

[0087] In step S102, after sorting, the optimal differential features and linear features of the ARX cipher are searched based on the branch and bound algorithm.

[0088] In step S103, after traversing all plaintext differences and masks, the maximum difference and linear feature probability are obtained as the maximum difference and linear feature probability of the ARX cipher of the corresponding round number.

[0089] According to the Lipmma-Moriai algorithm, since the most significant bit of the modular difference does not affect the size of the differential probability, the calculation method of the differential probability in the CDDT containing the most significant bit is different from that in the other parts of the CDDT. In order to facilitate the table lookup and calculation of the modular differential probability, the embodiment of the present application constructs two types of CDDT. In some embodiments, constructing the modular CDDT and CLAT respectively specifically includes:

[0090] Four tables are used to store the output difference and difference probability respectively, where CDDT_D 1 and CDDT_D 0 Used to store the difference, CDDT_P 1 and CDDT_P 0 Used to store differential probabilities, and CDDT_D 1 and CDDT_P 1 Corresponding to the CDDT containing the most significant bit, CDDT_D 0 and CDDT_P 0 The corresponding module adds the CDDT of other parts.

[0091] Two tables are used to store the output mask and linear probability respectively, where CLAT_M stores all possible output masks and CLAT_P stores the corresponding linear probabilities.

[0092] Then in some embodiments, sorting CDDT and CLAT according to differential probability and linear probability respectively includes: for CDDT, sorting the elements in CDDT_P in descending order of differential probability, and sorting the corresponding elements in CDDT_D according to the order of elements in CDDT_P. The sorting method of CLAT is similar to that of CDDT.

[0093] The size t of CDDT and CLAT can be any integer that divides n. The larger t is, the higher the algorithm search efficiency is, and the larger the storage space required is. Considering the trade-off between execution time and storage space, the present invention uses 8-bit CDDT and CLAT, where the memory space required to store CDDT is 4×2 3 ×2 16+8 =2 29 Bytes, the memory space required to store CLAT is 2×2×2 16+8 =2 26 byte.

[0094] In some embodiments, constructing the modulo-added CDDT and CLAT separately includes constructing the t-bit CDDT using:

[0095] Traverse the t-bit input differentials A, B and output differentials Γ, as well as the three 1-bit carry differentials a, b, c;

[0096] For each value of A, B, Γ and a, b, c, calculate the intermediate variable The value of

[0097] Determine whether A, B→Γ is an impossible differential. If tmp=0, then A, B→Γ is a possible differential propagation, that is, the differential probability is not 0; if tmp≠0, then A, B→Γ is an impossible differential.

[0098] For possible differential propagation, the corresponding differential probability is calculated, and the differential probability and output differential are stored in CDDT_P and CDDT_D respectively. 1 Store differential probabilities in In CDDT_P 0 The differential probability is stored in The output difference Γ is stored in the corresponding CDDT_D. Finally, CDDT_P is sorted in descending order of the difference probability. 1 and CDDT_P 0 Sort the elements in , and sort the corresponding elements in CDDT_D according to the order of the elements in CDDT_P. The construction method of CDDT is as follows:

[0099]

[0100] CDDT_P 0 [N][A||B],CDDT_D 1 [N][A||B]according to CDDT_P 1 [N][A||B].

[0101] In some embodiments, constructing the modulo-added CDDT and CLAT separately includes constructing the t-bit CLAT using:

[0102] Traverse the t-bit input mask V, W and output mask U, as well as the 1-bit carry e;

[0103] For each value of U, V, W and e, calculate the intermediate variable The value of

[0104] Determine whether V, W→U is zero correlation, if and , indicating that V,W→U is a possible mask propagation, that is, the linear probability is not 0, otherwise V,W→U is zero correlation;

[0105] For possible mask propagation, the corresponding linear probability is calculated, and the linear probability and output mask are stored in CLAT_P and CLAT_M respectively, that is, the linear probability CL is stored in CLAT_P e (U,V,W)=2 -wt(Z) , store the corresponding output mask U in CLAT_M. Finally, sort the elements in CLAT_P in descending order of linear probability, and sort the corresponding elements in CLAT_M according to the order of elements in CLAT_P. The construction method of CLAT is as follows:

[0106]

[0107] In some embodiments, searching for optimal differential features and linear features of the ARX cipher based on a branch and bound algorithm includes:

[0108] At the beginning of the search, set the initial estimate of the maximum feature probability for round r Perform a search, and if the probability of finding If a differential and linear feature of , then this feature must be the optimal feature, and the search ends. Otherwise, set Re-search until the probability is found Differential and linear characteristics.

[0109] In some specific examples, such as Figure 2As shown, in the process of searching for differential features, for a given n-bit modulo-added input differential α and β, the output differential γ and differential probability are calculated as follows:

[0110] Divide the n-bit input differences α and β into m sub-blocks A k and B k (0≤k≤m-1), each sub-block contains t bits;

[0111] Find CDDT_D to get the possible output differential Γ k (0≤k≤m-1), look up CDDT_P to get the corresponding differential probability And calculate the carry difference h(A k )、h(B k ) and h(Γ k ), used to find the next CDDT;

[0112] After finding m CDDTs, cascade m output differentials Γ k (0≤k≤m-1) to obtain the output difference of the modular addition, and convert the corresponding differential probability Multiply to get the difference probability of modular addition

[0113] In some specific examples, such as Figure 3 As shown in the figure, in the linear feature search process, for a given n-bit modulo input mask v and ω, the output mask μ and the linear probability C(μ, ν, ω) are calculated as follows:

[0114] Divide the n-bit input mask ν and ω into m sub-blocks V k and W k (0≤k≤m-1), each sub-block contains t bits;

[0115] Find CLAT_M to get the output mask U of each sub-block k , find CLAT_P to get the corresponding linear probability And, calculate where e k Used to find the next CLAT;

[0116] After searching m CLATs, m output masks U are concatenated k (0≤k≤m-1) to obtain the output mask of the modular addition, and convert the corresponding linear probability Multiplying them gives the linear probability C(μ,ν,ω) of modular addition.

[0117] In the first round of search, the modular difference and mask are traversed in descending order of probability. That is, for differential features, the corresponding input differences α and β, and the output difference γ are determined according to the value of eq(α, β, γ); for linear features, The value of determines the corresponding input masks v and ω, and the output mask μ.

[0118] Calculate the difference and mask propagation of the intermediate rounds, as well as the difference and linear probability of the round function; in some examples, also include: for a given input difference and mask, directly calculate the upper bound of the difference and linear probability of the modular addition at the beginning of the table lookup, determine whether the upper bound meets the branch condition, and if not, return to the previous round.

[0119] Otherwise, search each CDDT and CLAT in turn, use the values ​​in CDDT_P and CLAT_P to update the upper bounds of the differential and linear probabilities, and determine whether they meet the branch conditions. If they do, continue to search for the next CDDT and CLAT, otherwise return to the previous CDDT and CLAT;

[0120] After searching all CDDTs and CLATs, if the differential and linear probabilities still meet the branching conditions, the next round of search will be carried out. When all differential and linear probabilities do not meet the branching conditions, the previous round will be returned.

[0121] In the last round, the maximum difference and linear probability of modular addition are calculated according to the Lipmma-Moriai algorithm and the Schulte-Geers algorithm, the branching conditions are determined, and the maximum difference and linear feature probability currently searched are updated.

[0122] In the specific example, the ARX cryptographic optimal difference and linear feature search algorithm is an improved branch-and-bound algorithm that improves the search efficiency by introducing a new search strategy to improve the accuracy of branch conditions. The branch-and-bound algorithm is a depth-first search algorithm that uses the maximum feature probability B in i rounds. i (1≤i≤r-1) and the maximum characteristic probability B of round r r The initial estimate of Calculate B r .if only It will definitely be able to find the optimal difference and linear features, and The closer to B r , the higher the execution efficiency of the algorithm.

[0123] The optimization strategy adopted in the embodiment of the present application includes two aspects: (1) traversing the plaintext differential and mask in order from large to small according to the differential and linear probability. Once it is found that the plaintext differential and mask of a certain probability does not meet the branch condition, it is pruned in advance, and there is no need to traverse the plaintext differential and mask with a lower probability; (2) using the upper bounds of differential and linear probability to improve the accuracy of the branch condition. First, since CDDT and CLAT are sorted in order from large to small according to the differential and linear probability respectively, given the input differential and mask, the upper bounds of the differential and linear probability of the modulo addition can be calculated in advance, and it can be judged whether the branch condition is met-if the branch condition is not met, it is pruned in advance. Secondly, in the table lookup process, CDDT and CLAT are performed one by one in order. For CDDT and CLAT that have not been searched, the upper bounds of differential and linear probability are used in the branch condition, and the probability lower bound is set for the CDDT and CLAT currently being searched, which can eliminate the differential and mask that do not meet the branch condition more quickly.

[0124] Since the "three-branch" and "XOR" operations are dual to each other with respect to differential and linear masks, the search process of linear features is completely similar to that of differential features. The present application embodiment takes the search for differential features as an example for introduction. Figure 4 As shown, F represents a linear function including operations such as circular shift and XOR.

[0125] (1) Initial search phase (setting parameter values)

[0126] To reduce The value of affects the search efficiency. The present invention searches for differential features according to the strategy of high to low probability of differential features, that is, In this way, each time we search for a differential feature that satisfies a specific probability (the current maximum probability). Once a differential feature is found, it must be the optimal differential feature. If a differential feature with this probability cannot be found, we lower the probability and search again, that is, (The probability of differential modular addition is an integer power of 2.) The advantage of this search strategy is that it does not require manual selection of initial values. (In order to satisfy The value of is usually small, so it will increase the execution time of the algorithm), which improves the execution efficiency of the algorithm to a certain extent.

[0127] (2) The first round of search (traversing plaintext differences)

[0128] Traverse the plaintext differences in descending order of differential probability. Once it is found that a plaintext difference with a certain probability does not meet the branch condition, prune it in advance and return to the initial search stage. There is no need to traverse the plaintext differences with a lower probability. That is, traverse the plaintext differences that meet the branch condition. Each difference ΔX 0,ΔY 1 and ΔZ 1 , and calculate ΔX 1 =F -1 (ΔY 1 ).

[0129] The specific traversal method is as follows: Assume that the input difference of the n-bit modular addition is α=(α n-1 ,…,α 0 ) and β=(β n-1 ,…,β 0 ), the output difference is γ=(γ n-1 ,…,γ 0 ), according to the Lipmma-Moriai algorithm, the necessary and sufficient condition for (α, β→γ) to be a possible differential propagation is: , when α i-1 =β i-1 =γ i-1 hour, For a possible differential propagation, the differential probability is Therefore, the differential probability can be determined first according to the value of eq(α, β, γ), and then the corresponding input differentials α and β, and the output differential γ can be determined.

[0130] For example, when When , the conditions satisfied by α, β and γ are: , α i =β i =γ i =0(0≤i≤n-2). Therefore, for n-bit modular addition, there are 4 differentials propagated with probability 1 - when α=β=γ=0, (α,β→γ) is a trivial differential. When , the conditions satisfied by α, β and γ are:

[0131]

[0132] For other differential probability values, their differential propagation can be calculated in sequence according to the Lipmma-Moriai algorithm.

[0133] (3) Intermediate round search (search CDDT to calculate differential probability)

[0134] For the analog-addition input differential ΔX i-1 and ΔY i =F(ΔZ i-1 ), first calculate the upper bound q of its differential probability, and determine whether the branch condition is met If not, return to the previous round. Then, search each CDDT in order from low to high. For the CDDT currently being searched, use the value in CDDT_P to replace the upper bound of its differential probability, and update the upper bound q of the modulo differential probability, and then determine whether the branch condition is met. If not, return to the previous CDDT, otherwise continue to search for the next CDDT. Finally, after searching all CDDTs, if the differential probability still meets the branch condition, then calculate the differential probability p of the current round i and output differential ΔZ i , and conduct the next round of search. When all differential probabilities do not meet the branching conditions, return to the previous round.

[0135] By using the upper bound of the differential probability in the branch condition, it is possible to determine in advance whether the branch condition is met, and as the table lookup process proceeds, the upper bound of the differential probability is updated using the value in CDDT_P to further improve the accuracy of the branch condition and more quickly eliminate the differentials that do not meet the branch condition. Because during the table lookup process, if a certain output differential is found to not meet the branch condition, it can be pruned in advance without traversing the remaining output differentials.

[0136] The specific calculation process is as follows: Assume that the input difference of the kth (0≤k≤m-1) CDDT is A k and B k , the upper bound of its differential probability is PS B,k ,So

[0137]

[0138] The upper bound of the differential probability of modular addition is The table lookup process starts from the 0th CDDT and searches through the m-1th CDDT. When searching for the kth CDDT, the probability value p in CDDT_P is used. i,k Replace PS B,k To update the value of q, and output the corresponding output difference Γ in CDDT_D k , and then determine whether the branch condition is met. If If the k-1th CDDT is found, the k+1th CDDT will be returned. If the k-1th CDDT is found, the k+1th CDDT will be searched. If the differential probability still meets the branch condition when searching for the m-1th CDDT, the differential probability of the current round will be calculated. and the output differential ΔZ i =Γ m-1 ||…||Γ 0 .

[0139] The branching condition that needs to be satisfied to search for the next round of differential features is Right now When searching for the kth CDDT, the probability upper bound is:

[0140]

[0141] therefore,

[0142] remember,

[0143] In the table lookup process, for each CDDT, we only need to traverse the probability greater than or equal to p′ k Compared with the existing method (Liu et al.'s algorithm, which requires traversing all output differences of CDDT), the present invention can more quickly eliminate differences that do not meet the branching conditions and reduce the traversal space of output differences, so the search efficiency is higher.

[0144] (4) Final round of search (updating the maximum differential feature probability)

[0145] For the analog-addition input differential ΔX r-1 and ΔY r =F(ΔZ r-1 ), calculate the maximum difference probability according to the Lipmma-Moriai algorithm Then determine whether the branch condition is met If the branching condition is met, then the maximum probability of the r-round differential feature is The program returns the maximum differential feature probability, and the search process ends. If the branch condition is not met, it returns to the previous round to continue searching.

[0146] The embodiment of the present application provides a method for automatically searching for the optimal differential and linear features of the ARX cipher, which improves the algorithm search efficiency by optimizing the branch and bound algorithm using more stringent pruning conditions, and can obtain the security bounds of the ARX cipher against differential and linear analysis in a relatively short time. The method of the present application can be used for the security assessment of the ARX cipher against differential and linear analysis, and assists in the design of the ARX cipher algorithm, and has high practical value and application prospects.

[0147] An embodiment of the present application also proposes a security assessment system for ARX cryptography against differential and linear analysis, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the aforementioned ARX cryptography security assessment method against differential and linear analysis are implemented.

[0148] It should be noted that in the various embodiments of the present application, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0149] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0150] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0151] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A security assessment method for ARX cipher against differential and linear analysis, characterized in that: include: Construct a carry-dependent differential distribution table CDDT and a carry-dependent linear approximation table CLAT of modular addition respectively; CDDT and CLAT are ranked according to differential probability and linear probability, respectively; After sorting, the optimal differential features and linear features of the ARX cipher are searched based on the branch and bound algorithm; After traversing all plaintext differences and masks, the maximum difference and linear feature probability are obtained as the maximum difference and linear feature probability of the ARX cipher with the corresponding number of rounds.

2. The security assessment method for ARX cryptography against differential and linear analysis as claimed in claim 1, characterized in that: The construction of modular CDDT and CLAT respectively includes: Four tables are used to store the output difference and the difference probability respectively, where CDDT_D1 and CDDT_D0 are used to store the difference, CDDT_P1 and CDDT_P0 are used to store the difference probability, and CDDT_D1 and CDDT_P1 correspond to the CDDT containing the most significant bit, and CDDT_D0 and CDDT_P0 correspond to the CDDT modulo the other parts; Two tables are used to store the output mask and linear probability respectively, where CLAT_M stores all possible output masks and CLAT_P stores the corresponding linear probabilities.

3. The security assessment method for ARX cipher against differential and linear analysis as claimed in claim 2, characterized in that: Constructing the CDDT and CLAT of modular addition separately includes constructing a t-bit CDDT using the following method: Traverse the t-bit input differentials A, B and output differentials Γ, as well as the three 1-bit carry differentials a, b, c; For each value of A, B, Γ and a, b, c, calculate the intermediate variable The value of Determine whether A, B→Γ is an impossible differential. If tmp=0, then A, B→Γ is a possible differential propagation, that is, the differential probability is not 0; if tmp≠0, then A, B→Γ is an impossible differential. For possible differential propagation, the corresponding differential probability is calculated, and the differential probability and output differential are stored in CDDT_P and CDDT_D, respectively.

4. The security assessment method for ARX cipher against differential and linear analysis as claimed in claim 2, characterized in that: Separately constructing the CDDT and CLAT of the modular addition includes constructing the t-bit CLAT using the following method: Traverse the t-bit input mask V, W and output mask U, as well as the 1-bit carry e; For each value of U, V, W and e, calculate the intermediate variable e t The value of Determine whether V, W→U is zero correlation, if and This means that V, W→U is a possible mask propagation, that is, the linear probability is not 0, otherwise V, W→U is zero correlation; For possible mask propagations, the corresponding linear probability is calculated, and the linear probability and output mask are stored in CLAT_P and CLAT_M, respectively.

5. The security assessment method for ARX cipher against differential and linear analysis as claimed in claim 2, characterized in that: Sorting CDDT and CLAT according to differential probability and linear probability respectively includes: For CDDT, sort the elements in CDDT_P in descending order of differential probability, and sort the corresponding elements in CDDT_D according to the order of elements in CDDT_P; For CLAT, sort the elements in CLAT_P in descending order of linear probability, and sort the corresponding elements in CLAT_M according to the order of elements in CLAT_P.

6. The security assessment method for ARX cipher against differential and linear analysis as claimed in claim 2, characterized in that: The optimal differential features and linear features of ARX ciphers searched based on the branch-and-bound algorithm include: At the beginning of the search, set the initial estimate of the maximum feature probability for round r Perform a search, and if the probability of finding If a differential and linear feature of , then this feature must be the optimal feature, and the search ends. Otherwise, set Re-search until the probability is found Differential and linear characteristics; In the first round of search, the modular difference and mask are traversed in descending order of probability. That is, for differential features, the corresponding input differences α and β, and the output difference γ are determined according to the value of eq(α, β, γ); for linear features, The value of determines the corresponding input mask v and ω, and the output mask μ; Calculate the difference and mask propagation of the intermediate rounds, as well as the difference and linear probability of the round function, and decide whether to proceed to the next round of search based on the branch conditions; In the last round, the maximum difference and linear probability of modular addition are calculated according to the Lipmma-Moriai algorithm and the Schulte-Geers algorithm, the branching conditions are determined, and the maximum difference and linear feature probability currently searched are updated.

7. The security assessment method for ARX cipher against differential and linear analysis as claimed in claim 6, characterized in that: Computing the differences and mask propagation of the intermediate rounds, as well as the differences and linear probabilities of the round functions also includes: For a given input difference and mask, directly calculate the difference of modular addition and the upper bound of linear probability at the beginning of the table lookup, and determine whether the upper bound meets the branch condition. If not, return to the previous round; Otherwise, search each CDDT and CLAT in turn, use the values ​​in CDDT_P and CLAT_P to update the upper bounds of the differential and linear probabilities, and determine whether they meet the branch conditions. If they do, continue to search for the next CDDT and CLAT, otherwise return to the previous CDDT and CLAT; After searching all CDDTs and CLATs, if the differential and linear probabilities still meet the branching conditions, the next round of search will be carried out. When all differential and linear probabilities do not meet the branching conditions, the previous round will be returned.

8. The security assessment method for ARX cipher against differential and linear analysis as claimed in claim 6, characterized in that: The search for the optimal differential features and linear features of the ARX cipher based on the branch and bound algorithm also includes, in the differential feature search process, for a given n-bit modular addition input differential α and β, calculating the output differential γ and differential probability according to the following method: Divide the n-bit input differences α and β into m sub-blocks A k and B k (0≤k≤m-1), each sub-block contains t bits; Find CDDT_D to get the possible output differential Γ k (0≤k≤m-1), look up CDDT_P to get the corresponding differential probability And calculate the carry difference h(A k )、h(B k ) and h(Γ k ), used to find the next CDDT; After finding m CDDTs, cascade m output differentials Γ k (0≤k≤m-1) to obtain the output difference of the modular addition, and convert the corresponding differential probability Multiply to get the difference probability of modular addition 9. The security assessment method for ARX cipher against differential and linear analysis as claimed in claim 6, characterized in that: The search for the optimal differential feature and linear feature of the ARX cipher based on the branch and bound algorithm also includes, in the process of searching for the linear feature, for a given n-bit modular addition input mask v and ω, calculating the output mask μ and the linear probability C(μ, v, ω) according to the following method: Divide the n-bit input mask ν and ω into m sub-blocks V k and W k (0≤k≤m-1), each sub-block contains t bits; Find CLAT_M to get the output mask U of each sub-block k , find CLAT_P to get the corresponding linear probability And, calculate where e k Used to find the next CLAT; After searching m CLATs, m output masks U are concatenated k (0≤k≤m-1) to obtain the output mask of the modular addition, and convert the corresponding linear probability Multiplying them gives the linear probability C(μ,ν,ω) of modular addition.

10. A security assessment system for ARX cryptography against differential and linear analysis, characterized in that: The invention comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the steps of the security assessment method for ARX cipher against differential and linear analysis as claimed in any one of claims 1 to 9 are implemented.

Images