SPN structure zero correlation linear discriminator searching method based on set propagation and CP

Abstract

The invention discloses an SPN structure zero-correlation linear discriminator searching method combining linear mask set propagation and CP technology. The method is used for searching a zero-correlation linear discriminator of an SPN structure block cipher algorithm oriented to half-byte / byte design. The method integrates the advantages of the existing method, realizes the complete description of the LAT table of the S box under the condition that the linear mask is propagated with the probability of 1 by utilizing the thought of set propagation and combining the CP modeling technology, has the advantages of the existing method, makes up for the defects of the existing method, and has the advantages of the existing method. And meanwhile, the contradiction between zero and non-zero and between non-zero and non-zero sets can be searched under the condition of completely considering an LAT table, and model solvability is taken as a judgment condition and can form an integral model with expansion of a differentiator to be considered.

Description

Technical Field

[0001] The invention relates to the field of information security, and in particular to a zero-correlation linear discriminator search method for a SPN structure block cipher algorithm designed for half a byte / byte and combining a linear mask set propagation mode with a CP modeling technology. Background Art

[0002] Zero-correlation linear analysis is an analysis method extended from linear analysis. This method uses the linear approximation with zero correlation that is widely present in block cipher algorithms to distinguish cryptographic algorithms from random permutations, thereby performing key recovery attacks [1]. The first step of this analysis method is to find one or more effective and high-round zero-correlation linear discriminators. In order to obtain more accurate and higher-round discriminators, a model automation analysis tool is introduced.

[0003] In 2017, Sasaki et al. [2] used the MILP modeling method, took advantage of the unsatisfiability of the model to fix the input and output differences, and used the model's unsolvability as the judgment condition to search for impossible differential discriminators. Similarly, this method was applied to the search for zero-correlation linear discriminators for block ciphers. However, this type of method has two shortcomings: first, it is impossible to traverse all possible input-output mask pairs under practical conditions; second, it is impossible to obtain the propagation path of the discriminator and its corresponding contradictory position. Although Cui et al. [3] proposed a method in 2021 to delete the constraint variables to make the model solvable, so as to find the location where the contradiction occurs, this method is very cumbersome and requires experience to judge the possible location of the contradiction.

[0004] In 2020, Sun et al. [4] combined miss-in-the-middle and CP nibble / byte modeling techniques, and for the first time realized the search for truncated zero-correlated linear discriminators and truncated impossible differential discriminators based on the condition that the model is solvable for the SPN structure block cipher algorithm designed for nibble / byte. Subsequently, Hadipour et al. constructed a unified model for the search and expansion of the discriminator on this basis, and applied it to the block cipher algorithms of ARX and And-RX structures [5-6]. However, the disadvantage of this method is that the LAT / DDT of the S-box cannot be taken into account in the mask / differential propagation, and only half-byte / byte-level contradictions can be obtained.

[0005] In 2022, Cao et al. [7] used the property of nonlinear components (S-box, 'AND') that there are uninterrupted bits in differential propagation, and combined with the miss-in-the-middle technology to construct the search for impossible differential discriminators as a satisfiability problem, so that the model can be solved without restricting the input and output differences to obtain the propagation path and contradiction position of the impossible differential discriminator. Later, this type of method was also applied to the search for zero-correlated linear discriminators. However, this type of method has two defects: first, there is a problem of propagation accuracy. Uninterrupted bits can only carry a small amount of DDT / LAT information, resulting in some impossible patterns in the propagation process; second, only the contradiction between zero and non-zero bits can be obtained, and the contradiction between non-zero sets and non-zero sets cannot be obtained.

[0006] References:

[0007] [1]Bogdanov A,Rijmen V.Linear hulls with correlation zero and linearcryptanalysis of block ciphers[J].In:Designs,Codes and Cryptography,2014,70(3):369–383;

[0008] [2]Sasaki Y, Todo Y. New impossible differential search tool from de si-gn and cryptanalysis aspects: Revealing structural properties of several ciphers[C] / / Advances in Cryptology–EUROCRYPT 2017:36th Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer International Publishing, 2017:185-215;

[0009] [3]Cui T,Chen S,Fu K,et al.New automatic tool for finding impossibledifferentials and zero-correlation linear approximations[J].Science ChinaInformation Sciences,2021,64:1-3;

[0010] [4]Sun L,Gerault D,Wang W,et al.On the usage of deterministic(related-key)truncated differentials and multidimensional linearapproximations for SPN ciphers[J].IACR Transactions on Symmetric Cryptology,2020:262-287;

[0011] [5]Hadipour H,Sadeghi S,Eichlseder M.Finding the Impossible:Aut o-mated search for full impossible-differential,zero-correlation,and integralattacks[C] / / Annual International Conference on the Theory and Applicatio nsof Cryptographic Techniques.Cham:Springer Nature Switzerland,2023:128-157;

[0012] [6]Chakraborty D,Hadipour H,Nguyen P H,et al.Finding completeimpossibledifferential attacks on AndRX ciphers and efficient distinguishersfor ARX designs[J].IACR Transactions on Symmetric Cryptology,2024,2024(3);

[0013] [7]Cao W, Zhang W, Zhou C. New Automatic Search Tool for Searching for Impossible Differentials Using Undisturbed Bits[C] / / International Conference on Information Security and Cryptology. Cham: Springer Nature Switzerland, 2022: 43-63. Summary of the invention

[0014] In view of the problems of the zero-correlation linear discriminator search method pointed out in the background technology, the present invention proposes a new propagation characterization method of linear mask, and constructs a new zero-correlation linear discriminator search model based on this method and CP modeling technology. The new model integrates the advantages of the existing methods and makes up for their shortcomings: on the one hand, it takes the solvability of the model as the judgment condition, can traverse all possible input-output mask pairs, and can quickly and accurately locate the contradictory position; on the other hand, it can obtain contradictions at the bit / half byte / byte level, and can also obtain contradictions between non-zero sets and non-zero sets.

[0015] The technical solution for achieving the purpose of the present invention is:

[0016] The SPN structure zero-correlation linear discriminator search method based on set propagation and CP includes the following steps:

[0017] (1) Preprocessing of S-box, P-permutation and column confusion:

[0018] According to the properties of the algorithm round function, inverse round function structure and linear mask propagation, the XOR operations of S-box, P permutation row shift and column confusion are pre-calculated in units of half a byte / byte to calculate all sets Φ that may be generated during the linear propagation process. O , all possible propagation patterns sbox_pattern of the S-box and all possible propagation patterns xor_pattern of the XOR operation;

[0019] (2) Possible modes for calculating contradiction points:

[0020] Based on the set Φ obtained in step (1) O , the decision set Φ O Whether there is an intersection between the elements in each pair, so as to obtain all possible patterns of contradiction points contradiction_pattern;

[0021] (3) Build the model and solve it:

[0022] The set Φ obtained by step (1) O , sbox_pattern and xor_pattern, construct the forward propagation model M of the linear mask B and the back-propagation model M F , connect M through the set contradiction points B With M F The model is constructed into a model M U , add relevant constraints and set the search mode for solving.

[0023] The beneficial effects of the present invention are:

[0024] (1) The method of the present invention proposes a new linear mask propagation method, and combines the CP modeling technology to construct a new zero-correlation linear discriminator search method for the SPN structure block cipher algorithm designed for half a byte / byte. The new model uses the model solvability as the judgment condition, which solves the problem that the search model based on the model unsolvability is unable to traverse all possible input-output mask pairs under actual conditions and cannot obtain the propagation path of the discriminator and its corresponding contradictory position.

[0025] (2) The method of the present invention has high accuracy. It can fully consider the LAT table when characterizing the propagation of the S-box, avoid errors caused by non-interfered bits, and obtain the contradictions between zero and non-zero, non-zero and non-zero sets, so that under the new model, it is possible to search for effective zero-correlation linear discriminators with longer rounds and more numbers. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 To calculate the set Φ O , sbox_pattern and xor_pattern flow chart. DETAILED DESCRIPTION

[0027] The present invention is further described below with reference to the embodiments and drawings, but is not intended to limit the present invention.

[0028] Example

[0029] The SPN structure zero-correlation linear discriminator search method based on set propagation and CP includes the following steps:

[0030] (1) Preprocessing of S-box, P-permutation and column confusion:

[0031] According to the properties of the algorithm round function, inverse round function structure and linear mask propagation, the XOR operations of S-box, P permutation row shift and column confusion are pre-calculated in units of half a byte / byte to calculate all sets Φ that may be generated during the linear propagation process. O, all possible propagation patterns sbox_pattern of the S-box and all possible propagation patterns xor_pattern of the XOR operation;

[0032] (2) Possible modes for calculating contradiction points:

[0033] Based on the set Φ obtained in step (1) O , the decision set Φ O Whether there is an intersection between the elements in each pair, so as to obtain all possible patterns of contradiction points contradiction_pattern;

[0034] (3) Build the model and solve it:

[0035] The set Φ obtained by step (1) O , sbox_pattern and xor_pattern, construct the forward propagation model M of the linear mask B and the back-propagation model M F , connect M through the set contradiction points B With M F The model is constructed into a model M U , add relevant constraints and set the search mode for solving.

[0036] Reference Figure 1 , step (1) preprocesses the S-box, P permutation and column confusion. Assuming that each round of block cipher iteration requires K S-boxes, the size of the S-box is c bits, and the block length of the algorithm is c*K bits, then calculate the set Φ O , sbox_pattern and xor_pattern are as follows:

[0037] (1.1) Create an initial empty set Φ O , and replace the elements {0},{1},{2}…{2 c -1}Add to the set Φ O , consider every possible input mask case;

[0038] (1.2) Set the set Φ according to the round function structure O Updated order of operations and recorded possible propagation modes of S-box and XOR operations;

[0039] If there is a column confusion operation, the given matrix is ​​matrix, then first find (matrix T ) -1 , and then convert it into the corresponding XOR operation;

[0040] When the S-box and XOR operation are performed, the resulting set Φ is calculated. OAnd the corresponding possible patterns sbox_pattern, xor_pattern steps are as follows:

[0041] S-box operation: set Φ O The element S in in (S in ∈Φ O ) When passing through the S-box, query its LAT table. If the set generated after passing through the S-box Then S out Add to collectionΦ O ;

[0042] If S out ∈Φ O , then the set Φ O No update, while recording the possible propagation mode of S-box [S in →S out ] to sbox_pattern, the propagation constraint of the S-box is expressed by equation 1:

[0043] table[[S in ,S out ],sbox_pattern](Formula 1);

[0044] XOR operation: From the set Φ O Choose any two elements S 1 and S 2 (S 1 ∈Φ O ,S 2 ∈Φ O ) performs an XOR operation, if The resulting collection Then S 3 Add to collectionΦ O ;

[0045] If S 3 ∈Φ O , then the set Φ O No update, but record the possible propagation modes of XOR operation to xor_pattern;

[0046] table[[S 1 ,S 2 ,S 3 ],xor_pattern](Formula 2).

[0047] Step (2) calculates all possible patterns of contradiction_pattern from the set Φ O Pick any two elements S X and S Y (SX ∈Φ O , S Y ∈Φ O ), if S X and S Y has no intersection, that is then mark the contradiction occurred and set CFlag = 1;

[0048] If S X and S Y have an intersection, then set CFlag = 0, and at the same time add [S X , S Y , CFlag] to contradiction_pattern.

[0049] Step (3) Build the model and solve it. Let M B The input mask of each round of the model is B i,j , M F The input mask of each round of the model is F i,j , 0 ≤ i ≤ RD, 0 ≤ j < K. The constraints built by the model are as follows:

[0050] (3.1) Contradiction point determination:

[0051] Set contradiction points at the input and output mask positions of each round, and connect M B and M F to build a model M U , and ensure that there is at least one nibble / byte position with a contradiction in the model M U . Its constraint is shown in Equation 4:

[0052] table[[B i,j , F (RD-i),j , CFlag i,j , contradiction_pattern] (Equation 3);

[0053]

[0054] (3.2) Initial condition constraints:

[0055] The initial constraint is to limit the values of the input masks B B and F F of the model M 0,j and M 0,j from being zero. Its conditional constraint is shown in Equation 5:

[0056]

[0057] (3.3) Solve the model M U :

[0058] By default, MiniZinc will only output the optimal solution when solving optimization problems. If the parameter -a is added, all feasible solutions can be output.

[0059] Assume model M U The model file is model_file.mzn, and the specific command for solving the model is formula 6:

[0060] minizinc model_file.mzn-a(Formula 6);

[0061] Finally, by calling the solver in MiniZinc through the formula (6) command to solve the model, all the RD wheel zero-correlation linear discriminators and the corresponding specific locations of contradictions can be obtained.

[0062] The present invention proposes a zero-correlation linear discriminator search method combining linear mask set propagation and CP technology, which is used to search for zero-correlation linear discriminators of SPN structure block cipher algorithms designed for half-bytes / bytes. The method integrates the advantages of existing methods, uses the idea of ​​set propagation, and combines CP modeling technology to realize the linear mask under the condition of probability 1 propagation to fully characterize the LAT table of the S box, and has the advantages of existing methods and makes up for its shortcomings. At the same time, it can fully consider the LAT table to search for contradictions between zero and non-zero, non-zero and non-zero sets, and use the model solvability as the judgment condition, which can be considered as an overall model with the extension of the discriminator.

Claims

1. A zero-correlation linear discriminator search method for SPN structure based on set propagation and CP, characterized in that: The following steps are involved: (1) Preprocessing of S-box, P-permutation and column confusion: According to the properties of the algorithm round function, inverse round function structure and linear mask propagation, the XOR operations of the S-box and P-permutation row shift and column confusion are pre-calculated in units of half a byte / byte, and all sets Φ that may be generated in the linear propagation process are calculated. O , all possible propagation patterns sbox_pattern of the S-box and all possible propagation patterns xor_pattern of the XOR operation; (2) Possible modes for calculating contradiction points: Based on the set Φ obtained in step (1) O , the decision set Φ O Whether there is an intersection between the elements in each pair, so as to obtain all possible patterns of contradiction points contradiction_pattern; (3) Build the model and solve it: The set Φ obtained by step (1) O , sbox_pattern and xor_pattern, construct the forward propagation model M of the linear mask B and the back-propagation model M F , connect M through the set contradiction points B With M F The model is constructed into a model M U , add relevant constraints and set the search mode for solving.

2. According to claim 1, the SPN structure zero-correlation linear discriminator search method based on set propagation and CP is characterized by: Step (1) preprocesses the S-box, P permutation and column confusion. Assuming that each round of block cipher iteration requires K S-boxes, the S-box size is c bits, and the block length of the algorithm is c*K bits, then the set Φ is calculated. O , sbox_pattern and xor_pattern are as follows: (1.1) Create an initial empty set Φ O , and replace the elements {0},{1},{2}…{2 c -1}Add to the set Φ O , consider every possible input mask case; (1.2) Set the set Φ according to the round function structure O Updated order of operations and recorded possible propagation modes of S-box and XOR operations; If there is a column confusion operation, the given matrix is ​​matrix, then first find (matrix T ) -1 , and then convert it into the corresponding XOR operation; When the S-box and XOR operation are performed, the resulting set Φ is calculated. O And the corresponding possible patterns sbox_pattern, xor_pattern steps are as follows: S-box operation: set Φ O The element S in in (S in ∈Φ O ) When passing through the S-box, query its LAT table. If the set generated after passing through the S-box Then S out Add to collectionΦ O ; If S out ∈Φ O , then the set Φ O No update, while recording the possible propagation mode of S-box [S in →S out ] to sbox_pattern, the propagation constraint of the S-box is expressed by equation 1: table[[S in ,S out ],sbox_pattern](Formula 1); XOR operation: From the set Φ O Choose any two elements S1 and S2 (S1∈Φ O ,S2∈Φ O ) performs an XOR operation, if The resulting collection Then add S3 to the set Φ O ; If S3∈Φ O , then the set Φ O No update, but record the possible propagation modes of XOR operation to xor_pattern; table[[S1,S2,S3],xor_pattern](Formula 2).

3. The SPN structure zero-correlation linear discriminator search method based on set propagation and CP according to claim 1 is characterized by: Step (2) calculates all possible patterns of contradiction points, from the set Φ O Pick any two elements S X and S Y (S X ∈Φ O ,S Y ∈Φ O ), if S X and S Y There is no intersection Then a flag contradiction occurs and CFlag=1; If S X and S Y If there is an intersection, set CFlag = 0 and set [S X ,S Y ,CFlag] is added to contradiction_pattern.

4. The SPN structure zero-correlation linear discriminator search method based on set propagation and CP according to claim 1 is characterized by: In step (3), the model is constructed and solved. Let M B The input mask for each round of the model is B i,j , M F The input mask for each round of the model is F i,j , 0 ≤ i ≤ RD, 0 ≤ j < K. The constraints for model construction are as follows: (3.1) Determination of contradictions: Set up conflict points at the input and output mask positions of each round, and connect M through the constraints of formula 3 B With M F The model is constructed into a model M U , and ensure that in model M U There is at least one contradiction in the half-byte / byte position, and its constraint is shown in Equation 4: table[[B i,j ,F (RD-i),j ,CFlag i,j ,contradiction_pattern (Formula 3); (3.2) Initial condition constraints: The initial constraint is to restrict the model M B With M F Input Mask B 0,j 、F 0,j The value of cannot be zero, and its conditional constraints are shown in Formula 5: (3.3) Solve the model M U : By default, MiniZinc will only output the optimal solution when solving optimization problems. If the parameter -a is added, all feasible solutions can be output. Assume model M U The model file is model_file.mzn, and the specific command for solving the model is formula 6: minizinc model_file.mzn-a(Formula 6); Finally, by calling the solver in MiniZinc through the formula (6) command to solve the model, all the RD wheel zero-correlation linear discriminators and the corresponding specific locations of contradictions can be obtained.

Images