ARX cipher security evaluation method and system against differential and linear analysis

Abstract

The application discloses a security evaluation method and system of ARX cipher against differential and linear analysis, and relates to the technical field of ciphers, and comprises the following steps: constructing a differential distribution table CDDT and a linear approximation table CLAT of modulo addition dependent on carry respectively; sorting the CDDT and the CLAT according to differential probability and linear probability respectively; searching optimal differential characteristics and linear characteristics of the ARX cipher based on a branch and bound algorithm after sorting; and obtaining maximum differential and linear characteristic probability as maximum differential and linear characteristic probability of the ARX cipher of a corresponding round after traversing all plaintext differentials and masks. The application proposes a security evaluation method of ARX cipher against differential and linear analysis based on the differential distribution table and the linear approximation table dependent on carry, and solves the problem of security evaluation of ARX cipher against differential and linear analysis in the design process.

Description

TECHNICAL FIELD

[0001] The application relates to the field of cryptography, in particular to a security evaluation method and system for resisting differential and linear analysis of ARX ciphers. BACKGROUND

[0002] Symmetric ciphers are an important branch of cryptography and play an extremely important role in the field of information security. In symmetric ciphers, there is a class of algorithms that only use three basic logical operations: addition modulo, rotation and XOR (XOR). This class of algorithms is called ARX cipher based on ARX structure. The advantage of ARX cipher is that the design is very simple, the execution efficiency is high, and it is very suitable for software and hardware implementation. Therefore, ARX cipher is very suitable for resource-constrained devices such as RFID and wireless sensor networks.

[0003] Differential analysis and linear analysis are the most effective two analysis methods for symmetric ciphers. Resisting differential analysis and linear analysis has become the most important design criterion for symmetric ciphers. Searching for optimal differential characteristics and linear characteristics is a basic method for evaluating the resistance of ARX ciphers to differential analysis and linear analysis. The most commonly used automatic search method for differential and linear characteristics includes branch and bound algorithm, MILP (Mixed Integer Linear Programming) based method and SAT (Boolean Satisfiability Problem) based method.

[0004] The branch and bound algorithm is proposed by Mitsuru Matsui (also known as Matsui algorithm). This method is a depth-first search algorithm that improves the search efficiency of the algorithm by introducing a branch and bound strategy. Alex Biryukov et al. first extended the Matsui algorithm to ARX ciphers. They proposed a partial differential distribution table - a differential distribution table with a differential probability greater than a certain threshold. Since the partial differential distribution table cannot accurately depict the differential probability of the addition modulo, the method of Biryukov et al. is not an optimal differential characteristic search algorithm. Subsequently, Zhengbin Liu et al. proposed a carry-bit-dependent S-box that converts the addition modulo operation of a large state into a carry-bit-dependent S-box of a small state. By constructing a carry-bit-dependent differential distribution table (CDDT) and a carry-bit-dependent linear approximation table (CLAT), and combining the branch and bound search framework, they proposed a new algorithm for searching for optimal differential and linear characteristics of ARX ciphers.

[0005] The MILP-based method and the SAT-based method are two more general automated search methods, which are widely used in the design and analysis of cryptographic algorithms due to their simple model and good generality. These two methods respectively convert the search problem of optimal characteristics into a mixed integer linear programming problem and a Boolean satisfiability problem, use linear inequality groups and Boolean logic expressions to describe the differential and mask propagation of ARX ciphers, and then solve them through special solvers. However, for ARX ciphers, because a very large number of variables, inequalities or Boolean expressions are needed to describe the propagation of differences and masks, the solver usually needs to perform a very long time to calculate the optimal solution or feasible solution. Although many scholars have proposed many methods to improve search efficiency, such as introducing divide and conquer, branch and bound and other strategies to optimize the algorithm model, but for the optimal differential and linear characteristics of ARX ciphers, the effect is still very limited, and it is impossible to find the optimal differential and linear characteristics that reach the security boundary within a reasonable time. In addition, in addition to the optimization of the algorithm model itself, the efficiency of the MILP and SAT-based method is mainly determined by the efficiency of the solver.

[0006] Because in the algorithm design process, the designer needs to determine the parameters or modify the design scheme according to the security analysis result, usually needs to carry out multiple security evaluations, and puts forward very high requirements for the efficiency of the automated search method. Therefore, improving the efficiency of the automated search of the optimal differential and linear characteristics of ARX ciphers is of great significance for evaluating the security of ARX ciphers against differential and linear analysis, and has important practical value and application prospect for the design of ARX cipher algorithms. SUMMARY

[0007] The embodiment of the application proposes an ARX cipher security evaluation method against differential and linear analysis based on the dependent carry differential distribution table and the linear approximation table, and solves the problem of security evaluation against differential and linear analysis in the design process of ARX ciphers.

[0008] The embodiment of the application provides an ARX cipher security evaluation method against differential and linear analysis, which comprises the following steps:

[0009] A dependent carry differential distribution table CDDT and a dependent carry linear approximation table CLAT of modulo addition are respectively constructed;

[0010] The CDDT and the CLAT are sorted according to the differential probability and the linear probability respectively;

[0011] After sorting, the optimal differential characteristics and linear characteristics of the ARX cipher are searched based on the branch and bound algorithm;

[0012] After all the plaintext differences and masks are traversed, the maximum difference and linear characteristic probability are obtained as the maximum difference and linear characteristic probability of the corresponding round ARX cipher.

[0013] Optionally, constructing the CDDT and CLAT of the modular addition respectively specifically comprises:

[0014] Four tables are used to store the output difference and difference probability respectively, wherein CDDT_D1 and CDDT_D0 are used to store the difference, CDDT_P1 and CDDT_P0 are used to store the difference probability, and CDDT_D1 and CDDT_P1 correspond to the CDDT containing the most significant bit, and CDDT_D0 and CDDT_P0 correspond to the CDDT of the other part of the modular addition;

[0015] Two tables are used to store the output mask and linear probability respectively, wherein CLAT_M stores all possible output masks, and CLAT_P stores the corresponding linear probability.

[0016] Optionally, constructing the CDDT and CLAT of the modular addition respectively comprises constructing a t-bit CDDT in the following manner:

[0017] Traversing the t-bit input difference A, B and output difference Γ, and the 1-bit carry difference a, b and c;

[0018] For each value of A, B, Γ and a, b, c, the value of the intermediate variable tmp is calculated. For each value of A, B, Γ and a, b, c, the value of the intermediate variable tmp is calculated.

[0019] Determine whether A, B→Γ is an impossible difference. If tmp=0, A, B→Γ is a possible difference propagation, i.e. the difference probability is not 0; if tmp≠0, A, B→Γ is an impossible difference.

[0020] For the possible difference propagation, the corresponding difference probability is calculated, and the difference probability and the output difference are stored in CDDT_P and CDDT_D respectively.

[0021] Optionally, constructing the CDDT and CLAT of the modular addition respectively comprises constructing a t-bit CLAT in the following manner:

[0022] Traversing the t-bit input mask V, W and output mask U, and the 1-bit carry e;

[0023] For each value of U, V, W and e, the value of the intermediate variable tmp is calculated. For each value of U, V, W and e, the value of the intermediate variable tmp is calculated.

[0024] Determine whether V, W→U is zero correlation. If and , which means that V, W→U is a possible mask propagation, i.e. the linear probability is not zero, otherwise V, W→U is zero-correlated;

[0025] For possible mask propagations, the corresponding linear probabilities are calculated and stored in CLAT_P and CLAT_M, respectively.

[0026] Optionally, the sorting of CDDT and CLAT according to the differential probabilities and linear probabilities, respectively, comprises:

[0027] For CDDT, the elements in CDDT_P are sorted in descending order of the differential probabilities, and the corresponding elements in CDDT_D are sorted according to the element order of CDDT_P.

[0028] For CLAT, the elements in CLAT_P are sorted in descending order of the linear probabilities, and the corresponding elements in CLAT_M are sorted according to the element order of CLAT_P.

[0029] Optionally, the searching of optimal differential characteristics and linear characteristics of an ARX cipher based on a branch-and-bound algorithm comprises:

[0030] In the initial stage of the search, an initial estimate of the maximum characteristic probability of r rounds is set The search is performed, and if a differential and linear characteristic with probability is found, then the characteristic is certainly the optimal characteristic, and the search is ended, otherwise is set, and the search is restarted until a differential and linear characteristic with probability is found;

[0031] In the first round of the search, the differential and mask of the modular addition are traversed in descending order of the probability, i.e. for a differential characteristic, the corresponding input differentials α and β and the output differential γ are determined according to the value of eq(α, β, γ); for a linear characteristic, the corresponding input masks v and ω and the output mask μ are determined according to the value of .

[0032] The differential and mask propagations of the intermediate rounds and the differential and linear probabilities of the round functions are calculated, and the branch condition is determined to decide whether to proceed to the next round of the search.

[0033] In the last round, the maximum differential and linear probabilities of the modular addition are calculated according to the Lipmma-Moriai algorithm and the Schulte-Geers algorithm, the branch condition is judged, and the maximum differential and linear characteristic probability found so far is updated.

[0034] Optionally, the calculation of the differential and mask propagations of the intermediate rounds and the differential and linear probabilities of the round functions further comprises:

[0035] For a given input difference and mask, the upper bound of the differential and linear probability of the modular addition is calculated directly at the beginning of the table lookup, and it is determined whether the upper bound satisfies the branch condition. If it does not satisfy the branch condition, the previous round is returned;

[0036] Otherwise, each CDDT and CLAT is looked up in turn, the values in CDDT_P and CLAT_P are used to update the upper bound of the differential and linear probability, and it is determined whether the upper bound satisfies the branch condition. If it satisfies the branch condition, the next CDDT and CLAT are looked up, otherwise the previous CDDT and CLAT are returned.

[0037] When all CDDTs and CLATs are looked up, if the differential and linear probability still satisfies the branch condition, the next round of search is performed. When all differential and linear probabilities do not satisfy the branch condition, the previous round is returned.

[0038] Optionally, the method for searching the optimal differential characteristic and linear characteristic of the ARX cipher based on the branch and bound algorithm further comprises the following steps in the search process of the differential characteristic.

[0039] The n-bit input difference α and β are divided into m sub-blocks A k and B k (0≤k≤m-1), each of which contains t bits.

[0040] The CDDT_D is looked up to obtain the possible output difference Γ k (0≤k≤m-1), the CDDT_P is looked up to obtain the corresponding differential probability , and the carry difference h(A k ), h(B k ) and h(Γ k ) are calculated to look up the next CDDT.

[0041] After the m CDDTs are looked up, the output differences Γ k (0≤k≤m-1) are concatenated to obtain the output difference of the modular addition, and the differential probabilities are multiplied to obtain the differential probability of the modular addition

[0042] Optionally, the method for searching the optimal differential characteristic and linear characteristic of the ARX cipher based on the branch and bound algorithm further comprises the following steps in the search process of the linear characteristic.

[0043] The n-bit input mask ν and ω are divided into m sub-blocks V k and W k(0≤k≤m-1), each sub-block contains t bits;

[0044] Finding CLAT_M to get the output mask U of each sub-block k Finding CLAT_P to get the corresponding linear probability and calculating where e k is used to find the next CLAT;

[0045] After finding m CLATs, the output mask of modulo addition is obtained by concatenating m output masks U k (0≤k≤m-1), the corresponding linear probability is multiplied to get the linear probability of modulo addition C(μ,ν,ω).

[0046] The embodiment of the application also proposes an ARX cipher security evaluation system against differential and linear analysis, comprising a processor and a memory, wherein the memory stores a computer program, and the computer program is executed by the processor to realize the steps of the ARX cipher security evaluation method against differential and linear analysis as described above.

[0047] The embodiment of the application proposes an ARX cipher security evaluation method against differential and linear analysis based on the differential distribution table and the linear approximation table depending on the carry, and solves the problem of security evaluation against differential and linear analysis in the design process of the ARX cipher.

[0048] The above description is only a summary of the technical scheme of the application, in order to more clearly understand the technical means of the application, the specific embodiments of the application can be implemented according to the content of the description, and in order to make the above and other purposes, characteristics and advantages of the application more obvious and easy to understand, the following specific embodiments of the application are described. BRIEF DESCRIPTION OF DRAWINGS

[0049] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included to provide a description of preferred embodiments, and are not meant to limit the present application. Moreover, the same reference numerals are used throughout the several drawings to represent similar or analogous items. In the drawings:

[0050] Figure 1 The figure is the optimal differential and linear feature search flow of the ARX cipher of the embodiment of the application;

[0051] Figure 2 The figure is the schematic diagram of calculating the differential probability of modulo addition using CDDT in the embodiment of the application;

[0052] Figure 3 The figure is the schematic diagram of calculating the linear probability of modulo addition using CLAT in the embodiment of the application;

[0053] Figure 4 Differential propagation of the ARX cipher round function of the embodiments of the present application. DETAILED DESCRIPTION

[0054] Exemplary embodiments of the present disclosure will be described more fully hereinafter with reference to the accompanying drawings; however, they are not limited to the embodiments set forth herein but can be implemented in various forms. The present disclosure will be described herein with reference to the drawings, in which like reference numerals denote like elements throughout the various figures. The embodiments of the present disclosure are described herein with reference to the drawings, in which like reference numerals denote like elements throughout the various figures.

[0055] Several related definitions involved in carry-bit-dependent S-boxes include:

[0056] Definition 1 n-bit modular addition

[0057] Let Let The carry vector of is denoted as Then:

[0058]

[0059] where carry(x, y) can be computed iteratively as follows: (1) c0= 0;

[0060] Definition 2 Carry-bit-dependent S-box

[0061] Let Suppose n = mt, then can be transformed into the addition of m t-bit numbers. By traversing all possible values of the two t-bit addends, a truth table of t-bit addition can be constructed, so that can be computed by table lookup. Since the partial sums of m t-bit numbers are related through carries, the truth table of these partial sums is called a carry-bit-dependent S-box.

[0062] Similarly, a difference distribution table of t-bit addition can be constructed. Due to the influence of carries in the addition operation, two adjacent difference distribution tables are related through carries. Such a difference distribution table is called a carry-bit-dependent difference distribution table (CDDT). Likewise, a linear approximation table of t-bit addition can be constructed. Such a linear approximation table is called a carry-bit-dependent linear approximation table (CLAT).

[0063] Theorem 1 Differential probabilities of n-bit modular addition (Lipmaa-Moriai algorithm)

[0064] Let be the input and output differences of modular addition, respectively, and let mask(n) = 2 n -1, wt(x) denotes the Hamming weight of x, then

[0065]

[0066] For a t-bit vector and define For and let

[0067] Then the differential probabilities of n-bit modular addition can also be computed according to the following theorem.

[0068] Theorem 3 Differential probabilities of n-bit modular addition (based on CDDT computation)

[0069] Let n = mt, A k = α[(k+1)t-1:kt], B k = β[(k+1)t-1:kt], Γ k = γ[(k+1)t-1:kt], 0≤k≤m-1. For let

[0070]

[0071] where t0= t, ti= t-1. Let d k = 0 (0≤k≤m-2), d m-1 = 1, define A -1 , B -1 , Γ -1 to be 0, then

[0072]

[0073] Theorem 4 Linear probabilities of n-bit modular addition (Schulte-Geers algorithm)

[0074] Let be the output and input masks of modular addition, respectively, and define M n : to be:

[0075]

[0076] Let then

[0077]

[0078] where is the indicator function of the graph , x≤y means that x i ≤y i for all i∈{0,…,n-1}, and

[0079] For a t-bit vector and define Then the linear probability of n-bit modular addition can also be computed as follows.

[0080] Theorem 5 Linear probability of n-bit modular addition (based on CLAT computation)

[0081] Let n=mt, U k =μ[(k+1)t-1:kt], V k =ν[(k+1)t-1:kt], W k =ω[(k+1)t-1:kt], 0≤k≤m-1. For Let

[0082]

[0083] where Let Then

[0084]

[0085] In view of the deficiencies of the existing automatic search method, the embodiment of the application provides a security evaluation method of ARX cipher against differential and linear analysis. Through the differential and mask propagation properties of modular addition, more accurate branch conditions of the branch and bound algorithm are obtained, and the search efficiency of the algorithm is improved. As shown in Figure 1 the method provided by the embodiment of the application includes the following steps:

[0086] In step S101, a carry-dependent differential distribution table CDDT and a carry-dependent linear approximation table CLAT are constructed, respectively. In a specific example, in order to save storage space and improve search efficiency, for each input difference, the CDDT only stores possible output differences and corresponding differential probabilities. Similarly, the CLAT only stores possible output masks and corresponding linear probabilities. The CDDT and the CLAT are sorted according to the differential probabilities and the linear probabilities, respectively.

[0087] In step S102, after sorting, the optimal differential characteristics and linear characteristics of the ARX cipher are searched based on a branch and bound algorithm.

[0088] In step S103, after all plaintext differences and masks are traversed, the maximum differential characteristic probability and the maximum linear characteristic probability are obtained as the maximum differential characteristic probability and the maximum linear characteristic probability of the corresponding round ARX cipher.

[0089] According to the Lipmma-Moriai algorithm, since the most significant bit of the modular addition difference does not affect the size of the differential probability, the calculation method of the differential probability of the CDDT containing the most significant bit is different from that of the other parts of the CDDT. In order to facilitate table lookup and calculation of the differential probability of the modular addition, the embodiments of the present application construct two types of CDDT. In some embodiments, constructing the CDDT and the CLAT of the modular addition respectively specifically includes:

[0090] Four tables are used to store the output differences and the differential probabilities, respectively, wherein the CDDT_D1 and the CDDT_D0 are used to store the differences, the CDDT_P1 and the CDDT_P0 are used to store the differential probabilities, and the CDDT_D1 and the CDDT_P1 correspond to the CDDT containing the most significant bit, and the CDDT_D0 and the CDDT_P0 correspond to the CDDT of the other parts of the modular addition.

[0091] Two tables are used to store the output masks and the linear probabilities, respectively, wherein the CLAT_M stores all possible output masks, and the CLAT_P stores the corresponding linear probabilities.

[0092] Then in some embodiments, sorting the CDDT and the CLAT according to the differential probabilities and the linear probabilities respectively includes: for the CDDT, the elements in the CDDT_P are sorted in descending order of the differential probabilities, and the corresponding elements in the CDDT_D are sorted according to the element order of the CDDT_P. The sorting manner of the CLAT is similar to that of the CDDT.

[0093] The size t of the CDDT and the CLAT can be any integer that is an integer multiple of n, and the larger the t is, the higher the search efficiency is, and the larger the required storage space is. Considering the trade-off between execution time and storage space, the present application uses 8-bit CDDT and CLAT, wherein the memory space required for storing the CDDT is 4x23 x2 16+8 = 2 29 bytes, the memory space required for storing CLAT is 2 x 2 x 2 16+8 = 2 26 bytes.

[0094] In some embodiments, constructing the CDDT and CLAT of modular addition respectively includes constructing a t-bit CDDT in the following way:

[0095] traversing the input differences A, B and output difference Γ of t bits, and the carry differences a, b, c of 3 bits;

[0096] calculating the value of the intermediate variable for each value of A, B, Γ and a, b, c;

[0097] determining whether A, B→Γ is an impossible difference, if tmp = 0, then A, B→Γ is a possible difference propagation, i.e. the difference probability is not 0; if tmp≠0, then A, B→Γ is an impossible difference;

[0098] for the possible difference propagation, calculating the corresponding difference probability, and storing the difference probability and the output difference in CDDT_P and CDDT_D respectively, i.e. storing the difference probability in CDDT_P1 and storing the difference probability in CDDT_P0 and the output difference Γ is stored in the corresponding CDDT_D. Finally, the elements in CDDT_P1 and CDDT_P0 are sorted in the order of descending difference probability, and the corresponding elements in CDDT_D are sorted according to the element order of CDDT_P. The construction method of CDDT is as follows:

[0099]

[0100] CDDT_P0[N][A||B], CDDT_D1[N][A||B] according to CDDT_P1[N][A||B].

[0101] In some embodiments, constructing the CDDT and CLAT of modular addition respectively includes constructing a t-bit CLAT in the following way:

[0102] traversing the input masks V, W and output mask U of t bits, and the carry e of 1 bit;

[0103] calculating the value of the intermediate variable for each value of U, V, W and e;

[0104] whether V, W→U is zero correlation, if and , it means that V, W→U is a possible mask propagation, i.e. the linear probability is not 0, otherwise V, W→U is zero correlation;

[0105] For the possible mask propagation, the corresponding linear probability is calculated and the linear probability and the output mask are stored in CLAT_P and CLAT_M respectively, i.e. the linear probability CL e (U, V, W) = 2 -wt(Z) the corresponding output mask U is stored in CLAT_M. Finally, the elements in CLAT_P are sorted in the order of the linear probability from large to small, and the corresponding elements in CLAT_M are sorted according to the element order of CLAT_P. The construction method of CLAT is as follows:

[0106]

[0107] In some embodiments, searching the optimal differential characteristic and linear characteristic of an ARX cipher based on a branch and bound algorithm comprises:

[0108] In the initial stage of the search, the initial estimate value of the maximum characteristic probability of r rounds is set The search is performed, and if a differential and linear characteristic with probability is found, the characteristic is certainly the optimal characteristic, the search is ended, otherwise is set and the search is restarted until a differential and linear characteristic with probability is found.

[0109] In some specific examples, as shown in Figure 2 in the search process of the differential characteristic, for a given n-bit modulo addition input differential α and β, the output differential γ and the differential probability are calculated as follows

[0110] The n-bit input differentials α and β are divided into m sub-blocks A k and B k (0≤k≤m-1), each of which contains t bits;

[0111] The possible output differential Γ is found by looking up CDDT_D k (0≤k≤m-1), the corresponding differential probability is found by looking up CDDT_P and the carry differential h(A k ), h(B k ) and h(Γ k ) are calculated to find the next CDDT;

[0112] After finding m CDDTs, the output differentials of the m CDDTs are concatenated k (0≤k≤m-1) to get the output differential of the modular addition, and the corresponding differential probabilities are multiplied to get the differential probability of the modular addition

[0113] In some specific examples, as shown in Figure 3 , in the search process of linear characteristics, for a given n-bit input mask v and ω of the modular addition, the output mask μ and the linear probability C(μ,ν,ω) are calculated as follows:

[0114] The n-bit input masks v and ω are divided into m sub-blocks V k and W k (0≤k≤m-1), each of which contains t bits;

[0115] The output mask U k of each sub-block is found by searching CLAT_M, and the corresponding linear probability is found by searching CLAT_P , where e k is used to find the next CLAT;

[0116] After finding m CLATs, the output masks U k (0≤k≤m-1) of the m CLATs are concatenated to get the output mask of the modular addition, and the corresponding linear probabilities are multiplied to get the linear probability of the modular addition C(μ,ν,ω).

[0117] In the first round of the search process, the differential and mask of the modular addition are traversed in the order of probability from large to small, that is, for the differential characteristics, the corresponding input differentials α and β and the output differential γ are determined according to the value of eq(α,β,γ); for the linear characteristics, the corresponding input masks v and ω and the output mask μ are determined according to the value of .

[0118] The differential and mask of the intermediate round are calculated, and the differential and linear probability of the round function are calculated; in some examples, it further includes: for a given input differential and mask, the upper bound of the differential and linear probability of the modular addition is directly calculated at the beginning of the table search, and it is judged whether the upper bound meets the branch condition, if not, the previous round is returned.

[0119] Otherwise, each CDDT and CLAT is found in turn, the values in CDDT_P and CLAT_P are used to update the upper bound of the differential and linear probability, and it is judged whether it meets the branch condition, if it meets, the next CDDT and CLAT are searched, otherwise, the previous CDDT and CLAT are returned.

[0120] When all CDDT and CLAT are searched, if the difference and linear probabilities still satisfy the branch condition, the next round of search is performed, and when all difference and linear probabilities do not satisfy the branch condition, the last round is returned.

[0121] In the last round, the maximum difference and linear probabilities of modulo addition are calculated according to the Lipmma-Moriai algorithm and the Schulte-Geers algorithm, the branch condition is judged, and the maximum difference and linear feature probability searched at present is updated.

[0122] In a specific example, the ARX cipher optimal difference and linear feature search algorithm is an improved branch and bound algorithm, which introduces a new search strategy to improve the accuracy of the branch condition, thereby improving the search efficiency. The branch and bound algorithm is a depth-first search algorithm, which uses the initial estimate value of i-round maximum feature probability B i (1≤i≤r-1) and r-round maximum feature probability B r . Calculate B r . As long as it can always find the optimal difference and linear feature, and the closer to B r , the higher the execution efficiency of the algorithm.

[0123] The optimization strategy adopted by the embodiments of the present application includes two aspects: (1) traverse the plaintext difference and mask according to the order of difference and linear probability from large to small, and once it is found that the plaintext difference and mask of a certain probability do not satisfy the branch condition, prune in advance, and there is no need to traverse the plaintext difference and mask with lower probability; (2) use the upper bound of the difference and linear probability to improve the accuracy of the branch condition. First, since CDDT and CLAT are sorted in order of difference and linear probability from large to small, given the input difference and mask, the upper bound of the difference and linear probability of modulo addition can be calculated in advance, and it is judged whether the branch condition is satisfied or not-satisfied. If the branch condition is not satisfied, prune in advance. Secondly, in the table lookup process, CDDT and CLAT are performed in order one by one, and for the CDDT and CLAT that have not been searched, the upper bound of the difference and linear probability is used in the branch condition, and the lower bound of the probability is set for the CDDT and CLAT being searched at present, which can exclude the difference and mask that do not satisfy the branch condition faster.

[0124] Since the "three branches" and the "XOR" operation are mutually opposite with respect to the difference and linear mask, the search process of the linear feature is completely similar to the difference feature, and the embodiments of the present application are introduced by taking the search of the difference feature as an example. The difference propagation of the round function of the ARX cipher is shown in Figure 4 , wherein F represents a linear function including cyclic shift, XOR operation, etc.

[0125] (1) Initial search phase (setting parameter values)

[0126] In order to reduce The value of affects search efficiency. This invention searches for differential features according to a strategy of ranking differential feature probabilities from high to low, that is, letting . Each time, the search proceeds to find a difference feature that satisfies a specific probability (the current maximum probability). Once a difference feature is found, it is guaranteed to be the optimal difference feature. If no difference feature with this probability is found, the probability is reduced, and the search is repeated, i.e., let... (The probability of the modulus addition difference is an integer power of 2). The advantage of this search strategy is that it does not require manual selection of initial values. (in order to satisfy) The value of is usually relatively small, which increases the execution time of the algorithm, but improves the execution efficiency of the algorithm to some extent.

[0127] (2) First round of search (traversing plaintext differences)

[0128] The plaintext differences are traversed in descending order of probability. If a plaintext difference with a certain probability is found to no longer satisfy the branching condition, it is pruned early and the search returns to the initial search phase. There is no need to traverse plaintext differences with lower probabilities; that is, traversing only those that satisfy the branching condition... For each difference ΔX0, ΔY1, and ΔZ1, calculate ΔX1 = F -1 (ΔY1).

[0129] The specific traversal method is as follows: Let the input difference of the n-bit modulus be α = (α n-1 ,…,α0) and β=(β n-1 ,…,β0), the output difference is γ=(γ n-1 According to the Lipmma-Moriai algorithm, the necessary and sufficient condition for (α,β→γ) to be a possible differential propagation path is: When α i-1 =β i-1 =γ i-1 hour, For a possible differential propagation, its differential probability is... Therefore, the difference probability can be determined first based on the value of eq(α,β,γ), and then the corresponding input difference α and β, as well as the output difference γ, can be determined.

[0130] For example, when When α, β, and γ are in this state, the following conditions must be satisfied: α i =β i =γ i= 0 (0≤i≤n-2). Thus, for n-bit addition, there are 4 differential that propagate with probability 1 — (a, β→γ) is a trivial differential when a = β = γ = 0. When the conditions that a, β and γ satisfy are:

[0131]

[0132] For other differential probability values, the differential propagation can be computed sequentially according to the Lipmma-Moriai algorithm.

[0133] (3) Intermediate round search (finding CDDT to compute differential probability)

[0134] For input differential ΔX i-1 and ΔY i = F(ΔZ i-1 ), first compute the upper bound of its differential probability q, and judge whether the branch condition is satisfied. If not, return to the previous round. Then, find each CDDT in order from low to high. For the CDDT currently being found, replace the upper bound of its differential probability with the value in CDDT_P, and update the upper bound of the addition differential probability q, then judge whether the branch condition is satisfied. If not, return to the previous CDDT, otherwise continue to find the next CDDT. Finally, when all CDDTs are found, if the differential probability still satisfies the branch condition, then compute the differential probability p i of the current round and the output differential ΔZ i , and proceed to the next round of search. When all differential probabilities do not satisfy the branch condition, return to the previous round.

[0135] Using the upper bound of the differential probability in the branch condition can determine whether the branch condition is satisfied in advance, and as the table lookup process proceeds, the upper bound of the differential probability is updated by using the value in CDDT_P, further improving the accuracy of the branch condition and faster excluding the differential that does not satisfy the branch condition. Because in the process of table lookup, if it is found that a certain output differential does not satisfy the branch condition, it can be pruned in advance, and there is no need to traverse the remaining output differentials.

[0136] The specific calculation process is as follows: suppose the input differentials of the kth (0≤k≤m-1) CDDT are A k and B k , and the upper bound of the differential probability is PS B,k , then

[0137]

[0138] The upper bound of the differential probability of the addition is The table lookup process starts from the 0th CDDT and finds the (m-1)th CDDT in turn. When the kth CDDT is found, the probability value p in CDDT_P is used i,k Replace PS B,k to update the value of q and output the corresponding output difference Γ in CDDT_D k Then, it is judged whether the branch condition is met. If the (k-1)th CDDT is returned, otherwise the (k+1)th CDDT is continued to be searched. When the (m-1)th CDDT is searched, if the differential probability still meets the branch condition, the differential probability of the current round is calculated and the output difference ΔZ i = Γ m-1 ||…||Γ0.

[0139] The branch condition that needs to be met for searching the differential feature of the next round is that is When the kth CDDT is searched, the upper bound of probability is:

[0140]

[0141] Therefore,

[0142] Let

[0143] In the table lookup process, for each CDDT, only the output difference whose probability is greater than or equal to p' k (0≤k≤m-1) needs to be traversed. Compared with the existing method (Liu's algorithm, which needs to traverse all output differences of CDDT), the present application can exclude the differential that does not meet the branch condition faster, reduce the traversal space of the output difference, and therefore has higher search efficiency.

[0144] (4) The last round of search (update the maximum differential feature probability)

[0145] For the input differential ΔX r-1 and ΔY r =F(ΔZ r-1 ), the maximum differential probability is calculated according to the Lipmma-Moriai algorithm Then, it is judged whether the branch condition is met If the branch condition is met, the maximum probability of the r-round differential feature is The program returns the maximum differential feature probability, and the search process ends. If the branch condition is not met, the last round is returned to continue searching.

[0146] The embodiment of the application provides a method for automatically searching optimal differential and linear characteristics of ARX ciphers, optimizes a branch and bound algorithm by using a more strict pruning condition, improves algorithm search efficiency, and can obtain a security bound of ARX ciphers against differential and linear analysis in a short time. The method can be used for security evaluation of ARX ciphers against differential and linear analysis, and assists in design of ARX cipher algorithms, and has high practical value and application prospect.

[0147] The embodiment of the application also provides a security evaluation system for ARX ciphers against differential and linear analysis, which comprises a processor and a memory, and the memory stores a computer program, and the computer program is executed by the processor to realize the steps of the security evaluation method for ARX ciphers against differential and linear analysis.

[0148] It should be noted that in the embodiments of the application, the terms "comprising", "containing" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such a process, method, article or device. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of another identical element in the process, method, article or device comprising the element.

[0149] The serial numbers of the above embodiments of the application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0150] Through the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment method can be realized by means of software and necessary general hardware platform, of course, it can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the application can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a plurality of instructions for making a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) execute the method described in each embodiment of the application.

[0151] The embodiments of the application are described above in combination with the drawings, but the application is not limited to the above specific embodiments, and the above specific embodiments are only illustrative, not restrictive, and those skilled in the art can make many forms under the guidance of the application without departing from the scope of the application and the protection scope of the claims.

Claims

1. A security assessment method for ARX cryptography resistant to differential and linear analysis, characterized in that, include: Construct the carry-dependent differential distribution table CDDT and the carry-dependent linear approximation table CLAT for modulo addition, respectively. Sort CDDT and CLAT according to differential probability and linear probability respectively; After sorting, the optimal differential and linear features of the ARX cipher are searched based on the branch-and-bound algorithm. After traversing all plaintext differences and masks, the maximum difference and linear feature probability are obtained as the maximum difference and linear feature probability of the corresponding round ARX cipher. Constructing the modulated CDDT and CLAT separately includes constructing them using the following methods. Bit CDDT: Traversal Bit input difference and output difference and three 1-bit carry-differentials ; for and For each value of , calculate the intermediate variable. The value; judge Is it an impossible difference? If ,but It is a possible differential propagation, i.e., the differential probability is not zero; if ,but It is an impossible difference; For possible differential propagation, calculate the corresponding differential probability and store the differential probability and output differential in CDDT_P and CDDT_D respectively.

2. The security assessment method for ARX cryptography resistant to differential and linear analysis as described in claim 1, characterized in that, The specific construction of the CDDT and CLAT for modular addition includes: Four tables are used to store the output difference and the difference probability respectively. CDDT_D1 and CDDT_D0 are used to store the difference, CDDT_P1 and CDDT_P0 are used to store the difference probability, and CDDT_D1 and CDDT_P1 correspond to the CDDT containing the most significant bit, and CDDT_D0 and CDDT_P0 correspond to the CDDT with the modulo plus the other parts. Two tables are used to store the output mask and the linear probability, respectively. CLAT_M stores all possible output masks, and CLAT_P stores the corresponding linear probabilities.

3. The security assessment method for ARX cryptography resistant to differential and linear analysis as described in claim 2, characterized in that, Constructing the modulated CDDT and CLAT separately includes constructing them using the following methods. Bit CLAT: Traversal Bit input mask and output mask and 1 bit carry ; for and For each value of , calculate the intermediate variable. The value; judge Is it zero correlation? If and ,illustrate It is a possible mask propagation, i.e., the linear probability is not 0; otherwise... It is zero correlation; For possible mask propagation, calculate the corresponding linear probability and store the linear probability and output mask in CLAT_P and CLAT_M respectively.

4. The security assessment method for ARX cryptography resistant to differential and linear analysis as described in claim 2, characterized in that, The sorting of CDDT and CLAT based on differential probability and linear probability respectively includes: For CDDT, sort the elements in CDDT_P in descending order of difference probability, and sort the corresponding elements in CDDT_D according to the element order of CDDT_P. For CLAT, sort the elements in CLAT_P in descending order of linear probability, and sort the corresponding elements in CLAT_M according to the element order of CLAT_P.

5. The security assessment method for ARX cryptography resistant to differential and linear analysis as described in claim 2, characterized in that, The optimal differential and linear features of the ARX cipher, based on the branch-and-bound algorithm, include: In the initial stage of the search, set Initial estimate of the probability of the largest feature in a round Perform a search; if found, the probability is... If a certain difference and linear feature is found, then that feature must be the optimal feature, and the search ends; otherwise, set... Search again until the probability is found. The difference and linear characteristics; In the first round of search, the modulo-added differences and masks are traversed in descending order of probability; that is, for the difference features, according to... The value of determines the corresponding input difference. and and output difference For linear features, according to The value determines the corresponding input mask. and and output mask ; Calculate the differential and mask propagation of the intermediate rounds, as well as the differential and linear probabilities of the round functions, and decide whether to proceed to the next round of search based on the branch conditions; In the final round, the maximum difference and linear probability of the modulus are calculated based on the Lipmma-Moriai algorithm and the Schulte-Geers algorithm. The branch conditions are then determined and the currently searched maximum difference and linear feature probabilities are updated.

6. The security assessment method for ARX cryptography resistant to differential and linear analysis as described in claim 5, characterized in that, Calculating the differential and mask propagation of the intermediate wheels, as well as the differential and linear probabilities of the wheel functions, also includes: Given the input difference and mask, at the beginning of the table lookup, directly calculate the upper bound of the modulo-added difference and linear probability, and determine whether the upper bound satisfies the branch condition. If not, return to the previous round. Otherwise, search for each CDDT and CLAT in turn, use the values ​​in CDDT_P and CLAT_P to update the upper bounds of the difference and linear probabilities, and determine whether they meet the branching condition. If they do, continue to search for the next CDDT and CLAT; otherwise, return to the previous CDDT and CLAT. After searching all CDDTs and CLATs, if the difference and linear probabilities still satisfy the branching condition, proceed to the next round of search; if none of the difference and linear probabilities satisfy the branching condition, return to the previous round.

7. The security assessment method for ARX cryptography resistant to differential and linear analysis as described in claim 5, characterized in that, Searching for optimal differential and linear features in ARX cryptography based on the branch-and-bound algorithm also includes, during the search for differential features, considering a given... Bit modulo input difference and Calculate the output difference using the following method. and difference probability : Will Bit input differential and Divided into Sub-block and Each sub-block contains Bit; Search Obtain the possible output difference Search Obtain the corresponding difference probability And calculating carry difference , and Used to find the next CDDT; After searching After one CDDT, through cascading Each output difference Obtain the modulo-added output difference, and then convert the corresponding difference probability. Multiplying yields the modulo-addition difference probability. .

8. The security assessment method for ARX cryptography resistant to differential and linear analysis as described in claim 5, characterized in that, The search for optimal differential and linear features in ARX cryptography based on the branch-and-bound algorithm also includes, during the search for linear features, given... Bit modulo input mask and Calculate the output mask as follows: and linear probability : Will Bit input mask and Divided into Sub-block and Each sub-block contains Bit; Search Obtain the output mask for each sub-block Search Obtain the corresponding linear probability , and, calculation ,in Used to find the next CLAT; After searching After each CLAT, through cascading Output mask Obtain the modulo-added output mask, and then convert the corresponding linear probabilities Multiplication yields a linear probability modulo addition. .

9. A security assessment system for ARX cryptography that resists differential and linear analysis, characterized in that, It includes a processor and a memory, the memory storing a computer program that, when executed by the processor, implements the steps of the security assessment method for ARX cryptographic resistance to differential and linear analysis as described in any one of claims 1 to 8.

Images