Zero-correlation linear discriminator search method for SPN structure based on ensemble propagation and CP

Abstract

The present invention discloses a method for searching for zero-correlation linear discriminators in an SPN-structured block cipher algorithm designed for half-byte / byte blocks, combining linear mask set propagation and CP technology. This method integrates the advantages of existing methods, utilizing the concept of set propagation and combining CP modeling technology to achieve a complete characterization of the LAT table of an S-box using a linear mask propagated with probability 1. This method combines the advantages of existing methods while overcoming their shortcomings. Furthermore, it can fully consider the LAT table to search for conflicts between zero and non-zero sets, and between non-zero and non-zero sets. The method uses model solvability as a criterion, and can be considered together with the extension of the discriminator to form an integrated model.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a zero-correlation linear discriminator search method for a half-byte / byte-oriented SPN structure block cipher algorithm and a combination of a linear mask set propagation method and a CP modeling technology. Background Art

[0002] Zero-correlation linear analysis is an analytical method extended from linear analysis. This method uses the widely existing linear approximation with zero correlation in block cipher algorithms to distinguish cryptographic algorithms from random permutations, thereby performing key recovery attacks [1]. The first step of this analysis method is to find one or more effective and high-round zero-correlation linear discriminators. In order to obtain more accurate and high-round discriminators, a model automation analysis tool is introduced.

[0003] In 2017, Sasaki et al. [2] used the MILP modeling method, took advantage of the unsatisfiability of the model to fix the input and output differences, and used the model's unsolvability as the judgment condition to search for impossible differential discriminators. Similarly, this method was applied to the search for zero-correlated linear discriminators for block ciphers. However, this type of method has two shortcomings: first, it is impossible to traverse all possible input-output mask pairs under practical conditions; second, it is impossible to obtain the propagation path of the discriminator and its corresponding contradiction position. Although Cui et al. [3] proposed a method in 2021 to delete the constraint variables to make the model solvable, so as to find the location where the contradiction occurs, this method is very cumbersome and requires experience to judge the possible location of the contradiction.

[0004] In 2020, Sun et al. [4] combined miss-in-the-middle and CP nibble / byte modeling techniques to achieve the first search for truncated zero-correlation linear discriminators and truncated impossible differential discriminators based on the condition that the model is solvable for the SPN structure block cipher algorithm designed for nibble / byte. Subsequently, Hadipour et al. constructed a unified model for the search and expansion of the discriminator and applied it to the ARX and And-RX structure block cipher algorithms [5-6]. However, the disadvantage of this method is that it cannot take the LAT / DDT of the S-box into account in the mask / differential propagation, and can only obtain contradictions at the nibble / byte level.

[0005] In 2022, Cao et al. [7] used the property of nonlinear components (S-box, 'AND') that there are undisturbed bits in differential propagation, and combined with the miss-in-the-middle technique to construct the search for impossible differential discriminators as a satisfiability problem, so that they can solve the model to obtain the propagation path and contradiction position of the impossible differential discriminator without restricting the input and output differences. This type of method was later applied to the search for zero-correlated linear discriminators. However, this type of method has two defects: first, there is a problem of propagation accuracy. The undisturbed bits can only carry a small amount of DDT / LAT information, resulting in some impossible patterns in the propagation process; second, it can only obtain the contradiction between zero and non-zero bits, but cannot obtain the contradiction between non-zero sets and non-zero sets.

[0006] References:

[0007] [1]Bogdanov A,Rijmen V.Linear hulls with correlation zero and linearcryptanalysis of block ciphers[J].In:Designs,Codes and Cryptography,2014,70(3):369–383;

[0008] [2]Sasaki Y, Todo Y. New impossible differential search tool from de si-gn and cryptanalysis aspects: Revealing structural properties of several ciphers[C] / / Advances in Cryptology–EUROCRYPT 2017:36th Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer International Publishing, 2017:185-215;

[0009] [3]Cui T,Chen S,Fu K,et al.New automatic tool for finding impossibledifferentials and zero-correlation linear approximations[J].Science ChinaInformation Sciences,2021,64:1-3;

[0010] [4]Sun L,Gerault D,Wang W,et al.On the usage of deterministic(related-key)truncated differentials and multidimensional linearapproximations for SPN ciphers[J].IACR Transactions on Symmetric Cryptology,2020:262-287;

[0011] [5]Hadipour H,Sadeghi S,Eichlseder M.Finding the Impossible:Aut o-mated search for full impossible-differential,zero-correlation,and integralattacks[C] / / Annual International Conference on the Theory and Applicatio nsof Cryptographic Techniques.Cham:Springer Nature Switzerland,2023:128-157;

[0012] [6]Chakraborty D,Hadipour H,Nguyen P H,et al.Finding completeimpossibledifferential attacks on AndRX ciphers and efficient distinguishersfor ARX designs[J].IACR Transactions on Symmetric Cryptology,2024,2024(3);

[0013] [7]Cao W, Zhang W, Zhou C. New Automatic Search Tool for Searching for Impossible Differentials Using Undisturbed Bits[C] / / International Conference on Information Security and Cryptology. Cham: Springer Nature Switzerland, 2022: 43-63. Summary of the Invention

[0014] In response to the problems with zero-correlation linear discriminator search methods identified in the prior art, this paper proposes a novel propagation characterization method for linear masks. Based on this method and CP modeling techniques, a new zero-correlation linear discriminator search model is constructed. This new model integrates the advantages of existing methods while addressing their shortcomings: Firstly, it uses model solvability as a criterion, traversing all possible input-output mask pairs and quickly and accurately locating inconsistencies. Secondly, it can identify inconsistencies at the bit / nibble / byte level, as well as between non-zero sets.

[0015] The technical solution for achieving the purpose of the present invention is:

[0016] The SPN structure zero-correlation linear discriminator search method based on set propagation and CP includes the following steps:

[0017] (1) Preprocessing of S-box, P-permutation and column confusion:

[0018] According to the properties of the algorithm round function, inverse round function structure and linear mask propagation, the XOR operation of S-box, P permutation row shift and column confusion is pre-calculated in units of half a byte / byte to calculate all sets Φ that may be generated during the linear propagation process. O , all possible propagation patterns sbox_pattern of the S-box and all possible propagation patterns xor_pattern of the XOR operation;

[0019] (2) Possible modes for calculating contradiction points:

[0020] Based on the set Φ obtained in step (1) O , decision set Φ O Is there an intersection between any two elements in the , so as to obtain all possible patterns of contradiction points?

[0021] (3) Build the model and solve it:

[0022] The set Φ obtained by step (1) O , sbox_pattern and xor_pattern, construct the forward propagation model M of the linear mask B and back-propagation model M F , connect M through the set contradiction points B With M F The model is constructed into a model M U , add relevant constraints and set the search mode for solving.

[0023] The beneficial effects of the present invention are:

[0024] (1) The method of the present invention proposes a new linear mask propagation method and, combined with CP modeling technology, constructs a new zero-correlation linear discriminator search method for the SPN structure block cipher algorithm designed for half-byte / byte. The new model uses the solvability of the model as the judgment condition, which solves the problem that the search model based on the unsolvable model cannot traverse all possible input-output mask pairs under practical conditions and cannot obtain the propagation path of the discriminator and its corresponding contradictory position.

[0025] (2) The method of the present invention has high accuracy. It can fully consider the LAT table when characterizing the propagation of the S-box, avoid errors caused by non-interfered bits, and obtain the contradictions between zero and non-zero, and non-zero and non-zero sets, so that under the new model, a longer number of rounds and a larger number of effective zero-correlation linear discriminators can be searched. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 To calculate the set Φ O , sbox_pattern and xor_pattern flow chart. DETAILED DESCRIPTION

[0027] The present invention will be further described below with reference to the embodiments and drawings, but the present invention is not limited thereto.

[0028] Example

[0029] The SPN structure zero-correlation linear discriminator search method based on set propagation and CP includes the following steps:

[0030] (1) Preprocessing of S-box, P-permutation and column confusion:

[0031] According to the properties of the algorithm round function, inverse round function structure and linear mask propagation, the XOR operation of S-box, P permutation row shift and column confusion is pre-calculated in units of half a byte / byte to calculate all sets Φ that may be generated during the linear propagation process. O, all possible propagation patterns sbox_pattern of the S-box and all possible propagation patterns xor_pattern of the XOR operation;

[0032] (2) Possible modes for calculating contradiction points:

[0033] Based on the set Φ obtained in step (1) O , decision set Φ O Is there an intersection between any two elements in the , so as to obtain all possible patterns of contradiction points?

[0034] (3) Build the model and solve it:

[0035] The set Φ obtained by step (1) O , sbox_pattern and xor_pattern, construct the forward propagation model M of the linear mask B and back-propagation model M F , connect M through the set contradiction points B With M F The model is constructed into a model M U , add relevant constraints and set the search mode for solving.

[0036] Reference Figure 1 , step (1) pre-processes the S-box, P permutation and column confusion. Assuming that each round of block cipher iteration requires K S-boxes, the S-box size is c bits, and the block length of the algorithm is c*K bits, then calculate the set Φ O , sbox_pattern and xor_pattern are as follows:

[0037] (1.1) Create an initial empty set Φ O and convert the elements {0},{1},{2}…{2 c -1}Add to the set Φ O , consider every possible input mask case;

[0038] (1.2) Set the set Φ according to the round function structure O Updated operation sequence and recorded possible propagation modes of S-box and XOR operation;

[0039] If there is a column confusion operation, the given matrix is ​​matrix, then first find (matrix T ) -1 , and then convert it into the corresponding XOR operation;

[0040] When the S-box and XOR operation are performed, the generated set Φ is calculated. OAnd the corresponding possible patterns sbox_pattern, xor_pattern steps are as follows:

[0041] S-box operation: set Φ O The element S in in (S in ∈Φ O ) When passing through the S box, query its LAT table. If the set generated after passing through the S box Then S out Add to set Φ O ;

[0042] If S out ∈Φ O , then the set Φ O No update, while recording the possible propagation mode of S box [S in →S out ] into sbox_pattern, then the propagation constraint of the S-box is expressed by Equation 1:

[0043] table[[S in ,S out ],sbox_pattern](Formula 1);

[0044] XOR operation: From the set Φ O Choose any two elements S1 and S2 (S1∈Φ O ,S2∈Φ O ) performs an XOR operation, if The resulting collection Then add S3 to the set Φ O ;

[0045] If S3∈Φ O , then the set Φ O Not updated, but records the possible propagation modes of the XOR operation to xor_pattern;

[0046] table[[S1,S2,S3],xor_pattern](Formula 2).

[0047] Step (2) calculates all possible patterns of contradiction_pattern from the set Φ O Pick any two elements S X and S Y (S X ∈Φ O ,S Y ∈Φ O ), if S X and S Y There is no intersection Then the flag indicates a contradiction occurs and set CFlag = 1;

[0048] If S X and S Y have an intersection, then set CFlag = 0, and at the same time add [S X , S Y , CFlag] to contradiction_pattern.

[0049] Step (3) Build the model and solve it. Let M B The input mask for each round of the model is B i,j , M F The input mask for each round of the model is F i,j , 0 ≤ i ≤ RD, 0 ≤ j < K. The constraints for building the model are as follows:

[0050] (3.1) Contradiction point determination:

[0051] Set contradiction points at the positions of the input and output masks for each round, and connect M B and M F to build a model M U , and ensure that there is at least one nibble / byte position with a contradiction in the model M U . The constraint is shown in Equation 4:

[0052] table[[B i,j , F (RD-i),j , CFlag i,j , contradiction_pattern] (Equation 3);

[0053]

[0054] (3.2) Initial condition constraints:

[0055] The initial constraint is to restrict that the values of the input masks B B and M F , F 0,j , F 0,j of the model M

[0056]

[0057] (3.3) Solve the model M U :

[0058] Since by default MiniZinc only outputs the optimal solution when solving optimization problems, if the parameter -a is added, all feasible solutions can be output;

[0059] Let the model MU The model file is model_file.mzn, and the specific command for solving the model is formula 6:

[0060] minizinc model_file.mzn-a(Formula 6);

[0061] Finally, by calling the solver in MiniZinc through the command in Equation 6 to solve the model, all the RD wheel zero-correlation linear discriminators and the corresponding specific locations of contradictions can be obtained.

[0062] This paper proposes a zero-correlation linear discriminator search method that combines linear mask set propagation with CP technology. This method is used to search for zero-correlation linear discriminators for SPN-structured block cipher algorithms designed for nibbles / bytes. This method integrates the advantages of existing methods, leveraging the concept of set propagation and combining CP modeling techniques to achieve a complete characterization of the LAT table of the S-box using a linear mask propagated with probability 1. While retaining the advantages of existing methods and overcoming their shortcomings, it can also fully consider the LAT table while searching for conflicts between zero and non-zero sets, and between non-zero and non-zero sets. The method uses model solvability as a criterion, and can be considered in conjunction with the extension of the discriminator as a holistic model.

Claims

1. A zero-correlation linear discriminator search method for SPN structure based on set propagation and CP, characterized by: The following steps are involved: (1) Preprocessing of S-box, P-permutation and column confusion: According to the properties of the algorithm round function, inverse round function structure and linear mask propagation, the XOR operations of S-box, P permutation row shift and column confusion are pre-calculated in units of half byte / byte, and all possible sets generated during the linear propagation process are calculated. , all possible propagation patterns sbox_pattern of the S-box and all possible propagation patterns xor_pattern of the XOR operation; (2) Possible modes for calculating contradiction points: Based on the set obtained in step (1) , decision set Is there an intersection between any two elements in the , so as to obtain all possible patterns of contradiction points? (3) Build the model and solve it: The set obtained by step (1) , sbox_pattern and xor_pattern, build the forward propagation model of linear mask and back-propagation models Connect through the set contradiction points and Model built into a model , add relevant constraints and set the search mode for solving.

2. The SPN structure zero-correlation linear discriminator search method based on set propagation and CP according to claim 1 is characterized by: Step (1) pre-processes the S-box, P permutation and column confusion. Assuming that each round of block cipher iteration requires K S-boxes and the S-box size is c bits, the block length of the algorithm is c* bits, then calculate the set , sbox_pattern and xor_pattern are as follows: (1.1) Create an initial empty collection and convert the elements {0},{1},{2}…{2 c -1}Add to collection , consider every possible input mask case; (1.2) Set the collection according to the round function structure Updated operation sequence and recorded possible propagation modes of S-box and XOR operation; If there is a column confusion operation, the given matrix is ​​matrix, then first find (matrix T ) -1 , and then convert it into the corresponding XOR operation; When the S-box and XOR operation are performed, the resulting set is calculated. And the corresponding possible patterns sbox_pattern, xor_pattern steps are as follows: S-box Operations: Sets Elements in When passing through the S-box, query its LAT table. If the set generated after passing through the S-box , then Add to Collection ; like , then the set No update, while recording the possible propagation mode of S box [ ] into sbox_pattern, then the propagation constraint of the S-box is expressed by Equation 1: table , sbox_pattern] (Formula 1); XOR operation: from the set Select any two elements and Perform XOR operation, if The resulting collection , then Add to Collection ; like , then the set Not updated, but records the possible propagation modes of XOR operations[ ] into xor_pattern; table[[ ], xor_pattern] (Equation 2).

3. The SPN structure zero-correlation linear discriminator search method based on set propagation and CP according to claim 1 is characterized by: Step (2) calculates all possible patterns of contradiction points, from the set Pick any two elements and ,like and There is no intersection ⋂ =∅, then a sign contradiction occurs and let CFlag = 1; like and If there is an intersection, set CFlag = 0, and set [ ] to contradiction_pattern.

4. The SPN structure zero-correlation linear discriminator search method based on set propagation and CP according to claim 3 is characterized by: Step (3) constructs the model and solves it, assuming The input mask of each round of the model is The input mask of each round of the model is The constraints for model construction are as follows: (3.1) Contradiction determination: Set up conflict points at the input and output mask positions of each round and connect them through the constraints of formula 3 and Model built into a model , and make sure that There is at least one nibble / byte position contradiction in , and its constraint is shown in Equation 4: table , contradiction_pattern] (Formula 3); ≥ 1 (Formula 4); (3.2) Initial condition constraints: The initial constraints are to limit the model and Input Mask The value of cannot be zero, and its conditional constraints are shown in Formula 5: (Formula 5); (3.3) Solving the model : By default, MiniZinc only outputs the optimal solution when solving optimization problems. If the parameter -a is added, all feasible solutions can be output. Set up model The model file is , the specific command for solving the model is Equation 6: (Formula 6); Finally, by calling the solver in MiniZinc through the command in Equation 6 to solve the model, all the RD wheel zero-correlation linear discriminators and the corresponding specific locations of contradictions can be obtained.

Images