Method for automated security evaluation of block ciphers against differential cryptanalysis

Abstract

The application belongs to the field of information security, and discloses a method for automatically evaluating the security of a block cipher based on impossible differential, which comprises the following steps: modeling the internal state of the block cipher by using a traceable mode; automatically searching for the longest impossible differential distinguisher of the block cipher to obtain the structure and quantity of the longest impossible differential distinguisher; and evaluating the security of the block cipher according to the structure and quantity of the longest impossible differential distinguisher. The application has a wider application on block ciphers than the method, and uses fewer variables than the method and the UID method.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, and particularly relates to a method for automatically evaluating security of impossible differential of block cipher. BACKGROUND

[0002] In recent years, Internet of Things (IoT) devices have been deployed in many fields. Their operations usually involve access, storage and communication of sensitive and critical information that needs protection. However, due to the limited resources and the demand for low production cost, lightweight cryptographic algorithms have emerged. At present, many lightweight block ciphers have been proposed internationally, such as Present, Simon and Speck, Piccolo, etc. In order to meet the demand for lightweight cryptography, NIST launched a project to solicit, evaluate and standardize lightweight cryptographic algorithms suitable for use in resource-constrained environments. The security research of lightweight block cipher algorithm has always been a hot issue in the field.

[0003] Impossible differential analysis was first proposed by Biham et al. and Knudsen to analyze the security of Skipjack and DEAL, respectively. Subsequently, this analysis method has been widely applied to many block ciphers, such as CRYPTON, ARIA, Camellia, Piccolo-80, Piccolo-128, etc. After manually searching for impossible differential distinguishers, some methods for automatically searching for impossible differential of block cipher have emerged, such as - the method (Kim J, Hong S, Sung J, et al. Impossible Differential Cryptanalysis for Block Cipher Structures [M] / / Johansson T, Maitra S. Progress in Cryptology-INDOCRYPT 2003: Vol. 2904. Berlin, Heidelberg: Springer Berlin Heidelberg, 2003: 82-96.) and the UID-method (Luo Y, Lai X, Wu Z, et al. A unified method for finding impossible differentials of block cipher structures [J]. Information Sciences, 2014, 263: 211-220.), which are both aimed at word-based block ciphers. However, the - This method requires the target algorithm to possess a special property: the differential feature matrices for encryption and decryption must have a "1" property, meaning that the number of "1"s in each column of the matrix is ​​either 0 or 1. This property limits its application in block ciphers. The UID method is... - The improved method utilizes more contradictions to detect impossible difference discriminators. Furthermore, because the XOR relationship of the difference variables is preserved and propagated, the UID-method reduces... The block cipher structure in this method is limited by a matrix with the property of "1". However, the number of variables still increases significantly with the iteration of the round function, compared to... - Same as in the method. Summary of the Invention

[0004] This invention is aimed at To address the limitations of traditional methods and UID-based methods in terms of limited application and numerous variables, this paper proposes an automated differential security assessment method for block ciphers. This method focuses on word-based block ciphers and is based on traceable patterns and... -Method, designing a variant of the traceability model, namely - Traceable pattern, and based on - The traceable pattern proposes a new architecture for constructing impossible differential distinguishers, which involves fewer variables and has greater versatility.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] An automated security assessment method for impossible differential methods in block ciphers includes:

[0007] use - Traceable patterns model the internal state of block ciphers;

[0008] The longest impossible differential discriminant in a block cipher is automatically searched, and the structure and number of the longest impossible differential discriminants are obtained.

[0009] The security of block ciphers is evaluated based on the structure and number of the longest impossible differential distinguishers obtained.

[0010] Furthermore, regarding the aforementioned - Traceability Modes: In describing the difference state, differences are divided into five traceability modes: zero difference, non-zero non-fixed difference, non-zero fixed difference, XOR sum of non-zero fixed difference and non-zero non-fixed difference, and non-fixed difference; the symbols corresponding to each traceability mode are as follows:

[0011]

[0012] Further, the operation rules between each of the traceable modes include:

[0013]

[0014] Wherein, the left table shows the output traceable modes of the five traceable modes after passing through the bijective nonlinear function F or S-box, and the right table shows the XOR result of any two traceable modes.

[0015] Further, two - traceable modes are contradictory if and only if there is no differential that belongs to both of the two - traceable modes. - traceable modes are contradictory, and only if there is no differential that belongs to both of the two - traceable modes.

[0016] Further, the automatic search of the longest impossible differential distinguisher of the block cipher includes:

[0017] Step a1: let r = 1, num = 0; r represents the round number of the impossible differential, and num represents the number of the impossible differential;

[0018] Step a2: for the input - traceable mode X = (X n-1 ,...,X1,X0)∈{0,1} n and the output - traceable mode Y = (Y n-1 ,...,Y1,Y0)∈{0,1} n , let the - traceable mode of the initial internal state in the encryption direction - traceable mode of the internal state in the decryption direction of the rth round - traceable mode of the internal state in the decryption direction of the rth round Execute steps a3 to a6; wherein X i ,Y i ∈{0,1} represents the - traceable mode of the word, i = 0,1,...,n-1, and n represents the number of words;

[0019] Step a3: for i from 1 to r, execute the following operation: calculate the - traceable mode of the internal state in the encryption direction of the ith round according to the round function and the mode operation rule in the encryption direction Let represent all possible differential tracks with the round number r and the input differential .

[0020] Step a4: for i from r to 1, perform the following operation: calculate the - traceable pattern Let denote all possible differential traces of round r with input difference X and output difference Y.

[0021] Step a5: judge whether each round and each element of and produce contradiction, if yes, get a impossible differential distinguisher of round r with input difference X and output difference Y, and the value of counter num is increased by 1.

[0022] Step a6: judge whether num is 0, if yes, output r-1, and the algorithm ends, at this time the value of r-1 is the round number of the longest impossible differential; otherwise, let r = r+1, num = 0, and perform step a2.

[0023] Further, the method can also automatically search the impossible differential distinguisher of r rounds, including:

[0024] Step b1: let num = 0.

[0025] Step b2: for input - traceable pattern X = (X n-1 ,...,X1,X0)∈{0,1} n and output - traceable pattern Y = (Y n-1 ,...,Y1,Y0)∈{0,1} n , let the - traceable pattern of the initial internal state of encryption direction be - traceable pattern - traceable pattern perform steps b3 to b5; wherein X i ,Y i ∈{0,1} represent the - traceable pattern of the word, i = 0,1,...,n-1, and n represents the number of words.

[0026] Step b3: for i from 1 to r, perform the following operation: calculate Let denote all possible differential traces of round r with input difference X and output difference Y.

[0027] ​​Step b4: for i from r to 1, perform the following operation: calculate the internal state of the decryption direction of the r-i round according to the mode operation rule of the round function and the decryption direction - traceable mode Let denote all possible differential traces of the round number r and the output differential .

[0028] Step b5: judge whether each round and each element of and produce a contradiction, if yes, a round number r, input differential X, output differential Y impossible differential distinguisher is obtained, and the value of the counter num is increased by one.

[0029] Step b6: output num, at this time, the value of num is the number of impossible differential distinguishers of the r rounds.

[0030] Further, in the step b5, whether X and Y are outputted can be selected according to needs.

[0031] Compared with the prior art, the present application has the beneficial effects that:

[0032] The present application aims at - the problem that the application of the method and UID-method is not wide enough and there are many variables, proposes a group cipher impossible differential automatic security evaluation method, takes the word-based group cipher as the research object, designs a variant of the traceable mode, that is - the traceable mode, and constructs a new impossible differential distinguisher construction architecture based on the traceable mode. The architecture is a general extension method and has a wide application prospect, and involves fewer variables. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 The example structure example graph of the "1" property matrix counterexample provided by the embodiment of the present application;

[0034] Figure 2 The flowchart of a group cipher impossible differential automatic security evaluation method of the embodiment of the present application;

[0035] Figure 3 The propagation diagram of the traceable mode of the example structure in example 1 provided by the embodiment of the present application;

[0036] Figure 4 The 11-round impossible differential diagram of the example structure provided by the embodiment of the present application;

[0037] ​​Figure 5 A schematic diagram of a Gen-Skipjack round function structure is provided for embodiments of the present application. DETAILED DESCRIPTION

[0038] For the convenience of understanding, some of the terms appearing in the specific embodiments of the present application are explained as follows:

[0039] (1) -Method

[0040] -Method is a general method that can find various impossible differential characteristics of block cipher structures with certain properties. This method is suitable for block cipher algorithms with bijective S-boxes and based on words. It uses the differential properties of words to realize the automated search of impossible differential distinguishers. For In -Method, the differential is divided into five types: zero differential, non-zero non-fixed differential, non-zero fixed differential, XOR of non-zero fixed differential and non-zero non-fixed differential, and non-fixed differential. The symbols used in -Method and the corresponding differential variable types are shown in Table 1.

[0041] Table 1 -Method variable symbols

[0042] Symbol Corresponding difference type 0 Zero difference 1 Non-zero non-fixed difference 1 * ]] Non-zero fixed difference 2 * ]] XOR of non-zero fixed difference and non-zero non-fixed difference t (t≥2) Non-fixed difference

[0043] Kim et al. transformed the differential propagation in block ciphers into matrix operations and defined the operation rules of differential variables in matrix operations. -Method requires that the differential characteristic matrix of encryption and decryption has the "1" property, i.e., the number of "1"s in each column of the matrix is 0 or 1. A specific example is given below.

[0044] Example 1: With the help of the example structure shown in Figure 1 illustrates the attributes possessed by the "1" property. Since there are multiple "1"s in the second and third columns of the matrix ε, the example structure does not have a "1" property matrix. In other words, we cannot use -Method searches for impossible differential distinguishers of the example structure.

[0045] In addition, for -Method, the number of variables is v+4, where v is the number of non-fixed differentials. As the iteration of the round function, the number of non-fixed differentials will increase, which will result in a very large number of variables.

[0046] - The method is based on the intermediate differential contradiction technique, some contradictions will be used to generate impossible differential distinguishers. Note that the contradiction is based on the specific input and output differences, not on the five differential types, whether the values of the two differential types corresponding to the differences are contradictory. For example, 1 * and 2 * Whether it can constitute a contradiction depends on whether the non-zero fixed differences in the input and output differences take the same value. Assuming that γ and γ' are two non-zero fixed differences with different values, δ is a non-zero non-fixed difference, when the non-zero fixed differences in the input and output differences are both γ, there is γ⊕δ≠γ. In this case 2* cannot correspond to 1*. Otherwise, the contradiction is not true, because γ can be equal to γ'⊕δ.

[0047] (2) UID-Method

[0048] In 2014, Luo et al. proposed the UID-Method, which is an improvement of the - Method, reducing some limitations of the original method and adding some new conditions for judging contradictions. The UID-Method mainly studies word-based iterative block ciphers with bijective S-boxes and automatically searches for impossible differential distinguishers through matrix operations. For the UID-Method, the differences are divided into four types: zero difference, non-zero non-fixed difference, non-zero fixed difference, and non-fixed difference. The symbols used in the UID-Method are defined in Table 2.

[0049] Table 2 Symbols of variables in the UID-Method

[0050] Symbol Indicates 0 Zero difference li Non-zero non-fixed difference mi Non-zero fixed difference ri Non-fixed difference

[0051] The contradiction of two difference vectors is defined as follows:

[0052] Definition 1: Two difference vectors X = (Xn-1, Xn-2,..., X0) and Y = (Yn-1, Yn-2,..., Y0) are contradictory if there exists a subset such that the XOR of the differences in the subset is always unequal, i.e.

[0053]

[0054] For example, if X = (l1⊕m1, l1⊕m1⊕m2) and Y = (m3, m3), then X and Y are contradictory because X0⊕X1 = m2 cannot be equal to Y0⊕Y1 = 0. However, these two vectors are not contradictory in the - Method. Therefore, the UID-Method utilizes more contradictions to detect impossible differential distinguishers. In addition, since the XOR relationship of the difference variables is preserved and propagated, the UID-Method reduces the - The method has the limitation that the structure of the block cipher has a "1" property matrix. However, the number of variables still increases significantly with the iteration of the round function, and the complexity of the method is - The method has the limitation that the structure of the block cipher has a "1" property matrix. However, the number of variables still increases significantly with the iteration of the round function, and the complexity of the method is

[0055] The present application will be further explained in conjunction with the accompanying drawings and specific embodiments:

[0056] As Figure 2 shown, a method for automated security evaluation of impossible differential of a block cipher, comprising:

[0057] Using - a traceable mode to model the internal state of the block cipher;

[0058] Automatically searching for the longest impossible differential distinguisher of the block cipher, obtaining the structure and number of the longest impossible differential distinguisher;

[0059] According to the structure and number of the longest impossible differential distinguisher of the block cipher obtained, the security of the block cipher is evaluated.

[0060] The technical solutions of the present application will be described in detail below.

[0061] 1 An architecture for constructing impossible differential

[0062] In this section, we introduce and discuss a new architecture for constructing impossible differential distinguishers, called We first use - a traceable mode to model the internal state. Then, we introduce an automated search method based on - a traceable mode, and analyze its complexity. Finally, we compare with - the method and the UID-method.

[0063] 1.1 Modeling the internal state with - a traceable mode

[0064] In this subsection, we propose - a traceable mode.

[0065] Definition 2 (Traceable mode): If each internal state of a block cipher can be divided into n basic units (a basic unit can be 1 bit or 1 word), each unit has some specific properties (such as differential properties or linear properties), and these specific properties can always be transferred from one round to another with probability 1, these specific properties are called traceable mode, and the set of these properties is called traceable mode set.

[0066] - Traceable patterns are an abstraction and improvement of the two methods mentioned above, where originated from - Methods. In terms of describing the difference states, the differences can be classified into five traceable patterns: zero difference, non-zero non-fixed difference, non-zero fixed difference, XOR of non-zero fixed difference and non-zero non-fixed difference, and non-fixed difference. In terms of describing the propagation of differences, we use the operations between traceable patterns to characterize the propagation of differences in block ciphers. This operation is more simple and less restrictive than the matrix operations in the - Methods and the matrix operations in UID-Method. In - The symbols used in traceable patterns are defined in Table 3. The operation rules between traceable patterns are shown in Table 4.

[0067] Table 3 - Symbols of traceable patterns

[0068] Symbol Description 0 Zero difference 1 Non-zero fixed difference 2 Non-zero non-fixed difference 3 XOR sum of non-zero fixed difference and non-zero non-fixed difference 4 Non-fixed difference

[0069] Table 4 Operation rules between traceable patterns

[0070]

[0071] Table 4 shows the corresponding output traceable patterns of the five traceable patterns after passing through a bijective nonlinear function F or S-box on the left side. The XOR result of any two traceable patterns is shown on the right side.

[0072] Two - Traceable patterns are defined as follows.

[0073] Definition 3: For all five - Traceable patterns, any two - Traceable patterns are pattern-contradictory if and only if there does not exist a difference that belongs to both of the two - Traceable patterns.

[0074] The "0-1" pattern and the "0-2" pattern are naturally contradictory. In the analysis of the - When propagating differentials using traceable patterns, we discovered the following facts: If the 1-modes in the input and output differentials have the same difference, the XOR sum of two 1-modes is a 0-mode, while the XOR sum of a 1-mode and a 3-mode is a 2-mode. For example, if α is a non-zero fixed difference and β is a non-zero non-fixed difference, this means α⊕β is a 3-mode, then α⊕α=0 is a zero difference, i.e., a 0-mode, and α⊕(α⊕β)=β is a 2-mode. In this example, 1-modes represent the same non-zero fixed difference, meaning the XOR of two active modes can be an inactive mode. This slows down differential propagation, allowing the differential to reach full propagation in longer rounds. For block ciphers, finding the longest impossible difference and evaluating the security of block ciphers based on impossible difference analysis is a crucial issue for designers. Therefore, in this context, we present the operational rules between traceable patterns. Since modes 1 and 3 can also lead to contradictions, the contradictions used to detect impossible differences are the "0-1" mode contradiction, the "0-2" mode contradiction, and the "1-3" mode contradiction.

[0075] The above situation does exist in practice because analysts only need to take the same difference for all active words in a specific analysis. To better explain the operational rules of traceable patterns, we will illustrate this using an example structure in Example 2.

[0076] Example 2: Suppose the input - If the traceable pattern is (0,0,1,1), where all 1 patterns have the same non-zero fixed difference, then the example structure... - Traceable model propagation, such as Figure 3 As shown.

[0077] 1.2 Based on - Impossible Differential Automated Search Architecture for Traceable Patterns

[0078] In this subsection, we propose a method based on - An impossibly differential automated search architecture for traceable patterns, using This is used to represent the architecture.

[0079] because - The traceable pattern is word-based, and "0,1" represents zero difference and non-zero fixed difference, respectively. Therefore, traversing non-zero X = (X n-1 (,...,X1,X0) and Y=(Y n-1 ,...,Y1,Y0),X i ,Y i ∈{0,1}, i=0,1,...,n-1, we can determine whether all differences are impossible differences, where X=(X n-1 (,...,X1,X0) represents the input - Traceable pattern, Y = (Y n-1 ,...,Y1,Y0) represents the output - Traceable pattern, X i ,Y i ∈{0,1} represents the input - Traceable pattern, n represents the number of words. Usually, impossible differential distinguishers are constructed with intermediate fault techniques, The contradiction in is the pattern contradiction that has been analyzed and discussed in the last subsection. In addition, the construction of this kind of distinguisher is based on two directions: the encryption direction and the decryption direction.

[0080] We denote the r-round propagation results in the encryption direction and the decryption direction by R' (r) and R' (-r) respectively. - Traceable pattern. In order to detect whether the input difference X and the output difference Y are an r-round impossible differential, we first need to "encrypt" X and "decrypt" Y according to the operation rules between the traceable patterns. The internal state of the i-th round in the two directions is denoted by - Traceable pattern. The i-th round in the encryption direction and the decryption direction are denoted by and Then, we detect whether there exists a that contradicts If there exists a that is a contradictory pattern, we store X and Y.

[0081] Algorithm 1 is the pseudo code for searching the longest impossible differential distinguisher using .

[0082]

[0083]

[0084] Algorithm 2 can calculate the number of impossible differentials of any length and select whether to output the corresponding impossible differential structure according to the needs.

[0085]

[0086] Example 3: For the example structure, running Algorithm 1 can get the longest impossible differential is 11 rounds. The impossible differential constructed using - Traceable pattern is shown in Table 5. In order to verify its correctness, we will illustrate how to use pattern contradiction to judge the impossible differential. The detailed information of the 11-round impossible differential (0, 0, 0, a)→(a, 0, 0, 0) is shown in Table 6, where a is a non-zero fixed difference. The output difference of the i-th round in the encryption direction is denoted by Figure 4 ; the output difference of the i-th round in the decryption direction is denoted by . denotes.

[0087] Table 5 Longest impossible differential of the example structure obtained using Algorithm 1

[0088]

[0089] Since the input differential of the 11-round impossible differential is (0, 0, 0, α), where α is a nonzero fixed differential, the differential U 3 after 3 rounds is (α, 0, 0, 0).

[0090] The output differential of the 11-round impossible differential is (α, 0, 0, 0), where α is a nonzero fixed differential. According to the decryption process, the following analysis is made.

[0091] 1. Since V 11 = (α, 0, 0, 0), V 10 = (0, α, α, 0).

[0092] 2. Since V 9 = (0, 0, α, 0).

[0093] 3. Since V 9 = (0, 0, α, 0), V 8 = (0, 0, 0, α).

[0094] 4. Since a nonzero fixed differential α will lead to a nonzero non-fixed differential β after F8, V 7 = (α, β, 0, 0).

[0095] 5. V 6 = (0, α, α β, β).

[0096] 6. Since a nonzero fixed differential β will lead to a nonzero non-fixed differential γ after F6, there is

[0097] 7.

[0098] Since and γ is a nonzero non-fixed differential, there is Therefore, the differential characteristic (0, 0, 0, a)→(a, 0, 0, 0) of 11 rounds is theoretically an impossible differential. To verify this impossible differential by experiment, we take the S-box in PRESENT (Bogdanov A, Knudsen L R, Leander G, et al. PRESENT: An Ultra-Lightweight Block Cipher [C] / / Paillier P, Verbauwhede I. Cryptographic Hardware and Embedded Systems-CHES 2007. Berlin, Heidelberg: Springer, 2007: 450-466.) as the F function in the example structure. Then, the example structure can be regarded as a block cipher with 4 branches, and the size of each branch is 4 bits. By traversing the plaintext space, we find that there is no pair of plaintext and ciphertext satisfying the differential (0, 0, 0, a)→(a, 0, 0, 0) of 11 rounds, a≠0, a∈{0, 1} 4 . Therefore, the differential output by Algorithm 1 is indeed an impossible differential. The total time consumed by the experiment is 10.5 seconds.

[0099] By running Algorithm 2, we can obtain some impossible differentials of other rounds of the example structure, as shown in Table 6.

[0100] Table 6 Impossible differentials of the example structure

[0101]

[0102] 1.3 Complexity analysis

[0103] Generally, to determine whether a differential characteristic is an impossible differential, its corresponding input differential and output differential should be given. For a block cipher with mn-bit plaintext size, there are (2 mn -1)(2 mn -1) differential characteristics with non-zero input and output differentials. However, since most block ciphers satisfy mn≥64, mn represents the size of the block, and m represents the size of the word, it is unrealistic to test all non-zero differential characteristics. However, for word-based differential analysis, the differential of each sub-block is either zero or non-zero, and only these two possibilities exist. Therefore, the time complexity can be reduced from (2 mn -1) 2 to (2 n -1) 2 . For example, the corresponding parameters of AES are n = 16 and m = 8, and the time complexity is reduced to (2 16 -1) 2 ≈2 32 .

[0104] For an iterative block cipher with n words, the data complexity of Algorithm 1 is negligible. For an r-round cipher algorithm, it's necessary to retain the traceable pattern for each round and each word to detect pattern contradictions; this storage space can be reused repeatedly when detecting differential features. Therefore, the storage complexity is also negligible. The time complexity of Algorithm 1 consists of two parts. The first part is the complexity of traversing all non-zero differential features. The second part is determining whether each word in each round has a pattern contradiction, but this part is negligible. Therefore, the time complexity is (2^n)^n. n -1) 2 ≈O(2 2n ).

[0105] 1.4 and Comparison of -method and UID-method

[0106] -method: Its applicability is wider. The "1" property and the number of nonlinear bijective functions in the round function limit its applicability. - The application of the method. But... In this context, differential propagation in word-based iterative block ciphers is transformed into a pattern operation, which overcomes the aforementioned limitations. For example, the example structure in Example 1 does not possess the "1" property, therefore... - The method cannot analyze its security, but Can.

[0107] UID-method: Fewer variables are used. For the UID-method, the difference is determined by variables 0, l i ,m i ,r i Let i ∈ {1, 2, ...}. Each sub-block in the internal state of the cipher requires a variable to store the difference information. The number of variables is determined by the number of blocks in the block cipher and the number of iterations in the round function. Therefore, if the UID-method is used to search for impossible differences in block ciphers with a large number of blocks and iterations, the number of variables will be very large. This problem can be solved because it only uses five variables, "0, 1, 2, 3, 4", to trace the propagation of the difference. This is similar to Gen-Skipjack (e.g.) Figure 5As an example, for UID-method, a 16-round impossible differential (0, 0, 0, li)→(l2, 0, 0, l2) with 10 variables was found in (Luo Y, Lai X, Wu Z, et al. A unified method for finding impossible differentials of block cipher structures [J]. Information Sciences, 2014, 263: 211-220.), but for Table 7 shows the 16-round impossible differentials with 5 variables. Table 8 shows more results. In the same case, our time complexity is much smaller than UID- method. The time complexity of UID-method is ((n+1) n -1) 2 , while the time complexity of our method is (2 n -1) 2 , where n is the number of words. For Gen-Skipjack, 10 variables are used in UID- method, and the time complexity is ((4+1) 4 -1) 2 ≈2 18.57 . But our method only uses 5 variables, and the time complexity is (2 4 -1) 2 ≈2 7.81 , which is 2 -10.76 times of UID-method.

[0108] The most important difference among the three methods is the classification of differentials. In - method, differentials are classified into five types, and impossible differentials can be constructed by exploiting the compatibility among them. To search more precisely, Luo et al. considered more differential information. In UID-method, differentials are classified into four types, but each type of variable represents a different differential value. It is worth noting that non-fixed differentials are not used to construct contradictions in both methods, but they occupy a large amount of storage space. In addition, for block ciphers with large block size and iteration number, the number of variables grows exponentially. Therefore, in framework, differentials are classified into five types, and each sub-block involved in the internal state of the cipher can only have five possible assignments.

[0109] Table 7 is based on the 16-round Gen-Skipjack impossible differentials

[0110]

[0111] Table 8 Impossible Differences of Gen-Skipjack

[0112]

[0113] 2 Applications

[0114] To verify the correctness of the architecture, we will The results were applied to ten typical block ciphers and structures. For an IoT cipher, we found a full-round ID and two IDs that were five rounds longer than the full-round ID. For two ISO standard ciphers, we found an ID that was one round longer than the previous results and two new IDs with the same length as the previous longest ID. Table 9 summarizes the detailed results and comparisons.

[0115] Specifically, for ALLPC, we discovered 1756 full-round (25-round) IDs and two 30-round IDs. For SKINNY, considering single keys and monotonic handles, we discovered 408 new 11-round IDs. Further research revealed 12 IDs with one more round than previously found. For CLEFIA, using our framework, we found two new 9-round IDs with the same length as the previous longest ID. For LBlock, TWINE, Feistel, Gen-RC6, Gen-Skipjack, Gen-CAST256, and SMS4, we rediscovered known IDs.

[0116] Table 9 Summary of Impossible Differentials for Ten Block Ciphers and Structures

[0117]

[0118]

[0119] in:

[0120] Reference 1: Beierle C, Jean J, S,et al.The SKINNY Family of BlockCiphers and its Low-Latency Variant MANTIS[C] / / Advances in Cryptology-CRYPTO2016.2016.

[0121] Document 2: Mala H, Dakhilalian M, Shakiba M. Impossible Differential Attacks on 13-Round CLEFIA-128[J]. Journal of Computer Science and Technology, 2011, 26(4): 744-750.

[0122] Document 3: Luo Y, Lai X. Improvements for Finding Impossible Differentials of Block Cipher Structures[J]. Security and Communication Networks, 2017, 2017: 1-9.

[0123] Document 4: Suzaki T, Minematsu K, Morioka S, et al. TWINE: A Lightweight Block Cipher for Multiple Platforms[C] / / Selected Areas in Cryptography: 19th International Conference. 2012.

[0124] Document 5: Kim J, Hong S, Sung J, et al. Impossible Differential Cryptanalysis for Block Cipher Structures[M] / / Johansson T, Maitra S. Progress in Cryptology-INDOCRYPT 2003: Vol. 2904. Berlin, Heidelberg: Springer Berlin Heidelberg, 2003: 82-96.

[0125] Document 6: Luo Y, Lai X, Wu Z, et al. A unified method for finding impossible differentials of block cipher structures[J]. Information Sciences, 2014, 263: 211-220.

[0126] Document 7: Choy J, Yap H. Impossible Boomerang Attack for Block Cipher Structures [M] / / Takagi T, Mambo M. Advances in Information and Computer Security: Vol. 5824. Berlin, Heidelberg: Springer Berlin Heidelberg, 2009: 22-37.

[0127] Document 8: Yap H. Impossible Differential Characteristics of Extended Feistel Networks with Provable Security against Differential Cryptanalysis [M] / / Kim H kon, Kim T hoon, Kiumi A. Advances in Security Technology: Vol. 29. Berlin, Heidelberg: Springer Berlin Heidelberg, 2009: 103-121.

[0128] In summary, with the development of the Internet of Things, the demand for lightweight block ciphers is increasing. In the present application, we propose a new architecture for constructing impossible differential distinguishers which is suitable for word-based block ciphers or structures. First, we extend the traceable patterns to such ciphers and structures. Then, we transform the propagation of differences in the target object into operations of these five patterns. Finally, by using pattern operations and intermediate phase fault techniques, we propose an architecture for constructing impossible differential distinguishers. The architecture does not require the round function of the target object to have the "1" property, which makes the architecture have more extensive applications. The time complexity of the algorithm is O(2 2n), where n denotes the number of words, the data and memory complexity can be neglected. As applications, we analyze 10 lightweight block cipher algorithms and structures. For the block cipher ALLPC suitable for the Internet of Things, we obtain a full-round impossible differential and two impossible differential distinguishers with 5 rounds more than the full round. For the international ISO standard SKINNY, we find an impossible differential distinguisher with 1 round more than the previous optimal result; for the international ISO standard CLEFIA, we find two new impossible differential distinguishers with the same maximum round number as the current longest. For LBlock, TWINE, Feistel, Gen-RC6, Gen-Skipjack, Gen-CAST256 and SMS4, we rediscover some known impossible differential distinguishers. A large number of practical applications confirm that is a method with high efficiency and universality.

[0129] The above only shows the preferred embodiments of the present application, it should be noted that for those skilled in the art, without departing from the principles of the present application, can make a number of improvements and refinements, these improvements and refinements should also be considered as the protection scope of the present application.

Claims

1. A method of automated security evaluation of impossible differential of a block cipher, characterized by, Comprise: Utilizing - the traceable model models the internal state of a block cipher; for the - in the traceable model, in describing a differential state, a difference is classified into five traceable patterns: zero difference, non-zero non-fixed difference, non-zero fixed difference, XOR of non-zero fixed difference and non-zero non-fixed difference, and non-fixed difference; The symbols corresponding to each traceable mode are 0, 1, 2, 3 and 4 in turn; The operation rules between each traceable mode comprise: where the left table shows the output traceable patterns of the five traceable patterns after passing through the bijective nonlinear function F or S-box, and the right table shows the XOR result of any two traceable patterns; two -Contradictory definitions of traceable modes are as follows: for all five -Traceable modes, any two -Traceable modes are contradictory if and only if there is no differential that belongs to both -Traceable modes. Automatically search for the longest impossible differential distinguisher of the block cipher, obtain the structure and number of the longest impossible differential distinguisher; the automatic search for the longest impossible differential distinguisher of the block cipher comprises: Step a1: Let , ; denotes the number of rounds for which the differential is impossible, num denotes the number of impossible differentials; Step a2: Input - Traceability Mode and output - Traceability Mode Let the initial internal state of the encryption direction be - Traceability Mode Decryption direction number internal state of the wheel - Traceability Mode Perform steps a3 to a6; where Representing words - Traceability mode , Indicates the number of characters; Step a3: for i from 1 to r, do: compute the encryption direction i-th round internal state of the round - traceable pattern , let denote all possible differential traces of the round number and input difference ; Step a4: for i from 1 to r, do: compute the decryption direction i-th round internal state of the round - traceable mode , let denote all possible differential traces of the round number and output difference ; Step a5: judging and whether each round and each element produces a contradiction, if yes, a impossible differential distinguisher with round number , input difference , output difference is obtained, the value of counter is added by one; Step a6: Determine Is it 0? If it is equal to 0, then output... The algorithm ends at this point. The value of is the number of rounds in which the longest possible difference cannot be made; otherwise, let , Execute step a2; According to the obtained structure and number of the longest impossible differential distinguisher of the block cipher, the security of the block cipher is evaluated.

2. The method of automated security evaluation of a block cipher against impossible differential cryptanalysis according to claim 1, characterized in that, The method can also automate the search A wheel impossible differential discriminator, comprising: Step b1 : Let ; Step b2: on input - traceable mode and output - traceable mode , let - traceable mode , decrypt direction the - traceable mode - traceable mode perform steps b3 to b5; wherein denotes the - traceable mode of a word, , denotes the number of words; Step b3: for i from 1 to r, perform the following operation: compute , let denote all possible differential traces of round number and input difference according to the mode operation rule of the round function and the encryption direction. Step b4: for i from 1 to r, perform the following operation: compute the decryption direction i-th round state from the previous round state and the pattern operation rule of the decryption direction of the round - traceable pattern , let denote all possible differential traces of the round number and the output differential ; Step b5: judging and whether each round and each element produces a contradiction, if yes, a round number , input difference , output difference of impossible differential distinguisher is obtained, the value of counter is added one; Step b6: output At this time The value of The number of impossible differential distinguishers of the round.

3. The method of automated security evaluation of a block cipher against impossible differential cryptanalysis according to claim 2, characterized in that, In step b5, it can be selected whether to output or not according to necessity and .

Images