Coordinate function splitting-based S-box 3 shared TI mask implementation method

Abstract

The invention relates to a method for realizing a Threshold Implementation Mask (Threshold Implementation-Like, which is called TI for short) for S box anti-side channel analysis based on coordinate function splitting. For any 5-bit secondary S box, the similar TI can split the S box which cannot directly realize 3-sharing uniform TI into two or more balance sub-functions which can simultaneously realize 3-sharing TI satisfying correctness, incompleteness and uniformity according to a coordinate function of the S box, namely, the TI of the whole S box is converted into the TI of a single balance sub-function. And compared with a direct sharing scheme of the S box, only less additional combinatorial logic consumption is generated. By designing an automatic search algorithm, the splitting length of an S box is as small as possible, sequential logic consumption of TI implementation can be reduced, and finally, RTL codes are designed by using a hardware description language according to a splitting scheme.

Description

Technical Field

[0001] The present invention relates to the hardware implementation of threshold masking for side-channel analysis resistance of S-boxes, and particularly to a method for implementing a quadratic S-box 3-sharing class TI mask based on coordinate function splitting. Technical Background

[0002] Cryptographic algorithms are the core of cryptography and can generally be divided into symmetric cryptographic algorithms and public-key cryptographic algorithms. Among them, the S-box (Substitution Box) is the only core component that provides non-linear transformation in many symmetric cryptographic algorithms, providing the necessary confusion effect for cryptographic algorithms. The security of the S-box largely determines the security of the cryptographic algorithm.

[0003] Traditional S-box designs usually focus on resisting mathematical attacks and are difficult to resist various physical-level attacks such as side-channel attacks. A side-channel attack is an attack where an attacker collects side-channel information such as sound, temperature, and power consumption generated by a cryptographic device during operation, and uses statistical means to obtain the correlation between it and the intermediate state of the cryptographic algorithm to steal sensitive information. The current main side-channel attack is differential power analysis (DPA), that is, using the correlation between the device power consumption and sensitive information (such as: key). The key to resisting side-channel attacks is to weaken or even eliminate the correlation between side-channel information and sensitive information. Among them, masking sensitive information is the mainstream method for resisting side-channel attacks. The mask is generally generated by a random number generator, and all intermediate values in the cryptographic algorithm process are affected by this random number mask, randomizing the intermediate values in the cryptographic device.

[0004] In the implementation of hardware circuits, due to the influence of synthesis layout or input delay, the glitch phenomenon in the circuit is inevitable. General masking methods (such as Boolean masking) cannot resist the influence of glitches, that is, in the presence of glitches, the masked circuit still generates sensitive information leakage. Threshold Implementation (TI) is a new masking method that can eliminate the influence of glitches on the masked circuit. TI is based on a secret sharing scheme. An n-bit input variable is divided into s shares, and each share component is also n bits. Each bit of each n-bit share is added to the sharing function according to a certain rule, and the number of sharing functions is also s. In TI implementation, the number of shares s satisfies the equation s ≤ td + 1, where t represents the algebraic degree of the S-box and d represents the security level. When considering first-order side-channel analysis, the minimum value of the number of TI shares s is equal to 3. An important reason why TI can resist the glitch phenomenon in the circuit is that TI needs to satisfy correctness, incompleteness, and uniformity. Correctness means that the exclusive OR sum of the sharing functions is equal to the value of the original function. Correctness ensures that the cryptographic algorithm will not change the final output value of the algorithm when TI is performed. Incompleteness means that at least one share component is independent of the sharing function. Incompleteness ensures that even if the attacker detects the corresponding line, they cannot obtain all the secret information. Uniformity means that when the input shares are uniformly distributed, the output shares also satisfy uniform distribution. In practice, it is easy to construct TI that satisfies correctness and incompleteness, but it is difficult to implement TI that satisfies uniformity. The solution is to add random bits or increase the number of shares, which usually increases the consumption of the TI hardware implementation of the S-box.

[0005] TI also has a very important feature, that is, when the TI of a certain permutation-type S-box satisfies correctness, incompleteness, and uniformity, all permutations that are affine equivalent to this S-box can achieve TI that satisfies correctness, incompleteness, and uniformity. All 3-bit permutations are divided into 3 affine equivalence classes, and all 4-bit permutations are divided into 302 affine equivalence classes. Current research on TI schemes for small-bit (3, 4-bit) permutation-type S-boxes all uses the above features of TI. For 5-bit S-boxes, the number of their affine equivalence classes is relatively large. Therefore, there has not been much research on the TI of 5-bit S-boxes. However, 5-bit quadratic permutations can be divided into 75 affine equivalence classes according to affine equivalence, and some of the affine equivalence classes have good cryptographic properties. 5-bit quadratic S-boxes can be used as sub-components of unbalanced structured S-boxes (8-bit structured S-boxes) or as sub-components of larger-bit (more than 8) balanced structured S-boxes. Therefore, studying the TI implementation of 5-bit quadratic S-boxes has important practical significance. Summary of the Invention

[0006] The present invention provides a method for implementing 3 - sharing class TI masking of a quadratic S - box based on coordinate function splitting, which can split a 5 - bit quadratic S - box into l balanced sub - functions according to its coordinate function, which can achieve 3 - sharing TI satisfying correctness, incompleteness, and uniformity Therefore, the 3 - sharing TI of the S - box will be transformed into the 3 - sharing TI of each sub - function F i , and the output mask of each sub - function is the final output mask of the S - box. Among them, the 3 - sharing TI of the split sub - function F i must satisfy correctness, incompleteness, and uniformity, which can ensure that the TI of the S - box also satisfies correctness, incompleteness, and uniformity. The 3 - sharing TI considered in the present invention is two cases: direct sharing scheme and correction terms. The present invention adopts the following technical solutions:

[0007] A method for implementing 3 - sharing class TI masking of a quadratic S - box based on coordinate function splitting includes the following steps:

[0008] Step 1: The S - box is a 5 - bit quadratic S - box, and its coordinate function is expressed as (f0, f1, f2, f3, f4). Set the initial value of the splitting length l to 2, and denote each split sub - function as C l ={F0, F1, …, F l-1}, and C l represents the splitting scheme.

[0009] Step 2: Construct a set U l , and let it store all splitting schemes C l,i with a splitting length of l. The subscript i of C l,i indicates that C l,i is the i - th element in the set U l . Since the present invention does not consider the exchange between sub - functions during the splitting process, all possible splitting cases when 2 ≤ l ≤ 5 are as follows:

[0010] l = 2: The split balanced sub - functions F0 and F1 are respectively (indicating that the input variable of function F0 is 5 - bit, the number of coordinate functions of F0 is 4, and its output variable is 4 - bit), (indicating that the input variable of function F1 is 5 - bit, the number of coordinate functions of F1 is 1, and its output variable is 1 - bit) or (indicating that the input variable of function F0 is 5 - bit, the number of coordinate functions of F0 is 3, and its output variable is 3 - bit), (indicating that the input variable of function F1 is 5 - bit, the number of coordinate functions of F1 is 2, and its output variable is 2 - bit) in two cases, and there are a total of 15 possible splitting schemes (without considering the exchange between sub-functions), that is, there are 15 elements in the set U2.

[0011] l = 3: The split balanced sub-functions F0, F1, and F2 are respectively or For these two cases, there are 15 possible splitting schemes (without considering the exchange between sub-functions), that is, there are 25 elements in the set U3.

[0012] l = 4: The split balanced sub-functions F0, F1, F2, and F3 are respectively There are 10 possible splitting schemes (without considering the exchange between sub-functions), that is, there are 10 elements in the set U4.

[0013] l = 5: There is exactly one splitting scheme, that is, each coordinate function f of the original S-box i is split out to construct the function That is, there is only 1 element in the set U5.

[0014] That is, the number of splitting schemes corresponding to the splitting lengths 2 ≤ l ≤ 5 are |U2| = 15, |U3| = 25, |U4| = 10, and |U5| = 1 respectively.

[0015] Step 3: Traverse the set U l element C l,i , and sequentially verify each sub-function l,i in C corresponding TI mask to see if it satisfies uniformity (that is, to judge is equal to where represents the input mask, represents the output mask. If it means satisfies uniformity, otherwise it means does not satisfy uniformity). If one of the sub-functions does not satisfy uniformity, then consider the next element C l,j , j = i + 1. If each sub-function in C l,j satisfies uniformity, then set the set K l , and store the TI masks corresponding to each sub-function in C l,j as the final mask scheme in the set K l , that is

[0016] Step 4: When all elements in set U l are traversed, check whether set K l is an empty set. If K l is an empty set, it means that there is no TI mask of split length l for this function. Then execute l = l + 1. If l < 5, execute Step 2. If l = 5, directly output the mask scheme F0·F1·F2·F3·F4. When K l is not an empty set, directly output set K l .

[0017] Step 5: Write the final RTL-level code using a hardware description language according to the mask scheme. Among them, according to the split length l of the output mask scheme, design l sub-modules correspondingly. The function of the sub-module is the TI implementation of the corresponding split sub-function F i , and finally instantiate the sub-module in the main module.

[0018] The beneficial effects of the present invention are as follows: The method of the present invention can obtain a 3-sharing uniform mask scheme for any 5-bit quadratic permutation. Compared with the classical TI implementation (such as: direct sharing scheme, modified parameters), the method of the present invention splits the TI implementation circuit of the original permutation into several independent sub-circuit modules, and the split length reaches the minimum. Some combinational logics reused in the original circuit may copy the combinational logic to their respective sub-circuits through the splitting step, thus increasing the overall combinational logic consumption. However, the finally implemented mask scheme must satisfy correctness, incompleteness, and uniformity, that is, satisfy the first-order side-channel analysis security. Description of the Drawings

[0019] Figure 1 is a general flowchart of the mask scheme obtained by using this method based on the splitting of the coordinate function.

[0020] Figure 2 is the RTL view of the 3-sharing TI hardware implementation of the S-box of the Keccak algorithm.

[0021] Figure 3 is the RTL view of the 3-sharing TI hardware implementation of the S-box function F0 of the Keccak algorithm.

[0022] Figure 4 is the RTL view of the 3-sharing TI hardware implementation of the S-box function F1 of the Keccak algorithm.

[0023] Figure 5 is the RTL view of the 3-sharing TI hardware implementation of the S-box of the Ascon algorithm.

[0024] Figure 6 is for the unbalanced structured S-box Bridge 3,4,5 (left) and Misty 5,3,5(Right) Structure diagram.

[0025] Figure 7 It is a non - balanced structure - type S - box Bridge 3,4,5 (Left) and Misty 5,3,5 (Right) TI - like implementation diagram. Specific implementation manner

[0026] The principles and features of the present invention will be described below in conjunction with the accompanying drawings. The examples given are only used to explain the present invention and are not intended to limit the scope of application of the present invention.

[0027] The construction principle of the 3 - shared TI - like mask designed in the present invention is to split the known S - box that cannot achieve 3 - shared uniform TI through direct sharing schemes or modified parameter addition into two or more sub - functions that can achieve 3 - shared uniform TI according to the coordinate function. Let S be a 5 - bit quadratic permutation - type S - box, and its input variable is represented as Its output variable is represented as When its minimum splitting length is l, it is split into l functions F0, …, F that can achieve correctness, non - completeness, and uniformity according to the coordinate function of S l-1 , where Functions F0, …, F l-1 The 3 - shared TI of is successively represented as Let be the input mask of According to the input variable x, masks are independently generated respectively The present invention will independently generate an additional mask x j , 1 ≤ j ≤ l - 1 is called the extended mask of the input variable x. When the splitting length is l, the number of extended masks x j is l - 1. Among them, to ensure that the mask scheme meets the correctness, the extended mask x j has the following relationship with the input variable x:

[0028]

[0029] The independently generated extended masks x1 , x2 … x l-1 are successively used as the input masks of Let be the output mask of , is the output mask of S. When the splitting length is l, the TI - like input masks x , x1 , x2 … x l-1 have a length of 2 (5×3)×l , and there are 2 (5×(3-1))×lThe next step is to design the RTL code for the S-box mask scheme and convert the function The corresponding input masks are used as the input of each sub-module. According to TI's specific solution (direct sharing or modified parameter addition), the logic circuit RTL code is written, and the output masks of each module are y0 , y1 ,… y l-1 After the combination, it is used as the final output mask of the S-box mask scheme y , the output mask is represented as For any split length l, the output mask of the S-box is y The length is always 2 5×3 , that is, the output mask y Total 2 5×(3-1) Encoding method, and output mask y Any encoding of corresponds to a TI-like mask ( x , x1 , x2 … x l-1 ) have 2 5×(3-1)×(l-2) There are different encoding methods, so the uniformity is satisfied. i The TI of satisfies incompleteness, so the class TI of the overall S-box satisfies incompleteness.

[0030] Taking the 3-shared TI mask of the S-box of the Keccak algorithm as an example, the Keccak algorithm was selected as the SHA-3 standard. The S-box of this algorithm is a 5-bit quadratic permutation, which belongs to the 68th class of the 5-bit quadratic permutation affine equivalence class. The current 3-shared TI method cannot meet its uniformity requirements. The coordinate function of the S-box of the Keccak algorithm is expressed as follows:

[0031] f0=x0+(x1+1)x2

[0032] f1=x1+(x2+1)x3

[0033] f2=x2+(x3+1)x4

[0034] f3=x3+(x4+1)x0

[0035] f4=x4+(x0+1)x1

[0036] Among them, the input variables of the S box are When the split length l = 2, the sub-functions split according to the coordinate function TI Mask All meet the requirements of correctness, incompleteness and uniformity. Among them, the coordinate functions f0, f1, and f2 of the original S-box are the coordinate functions of the sub-function F0, and f3 and f4 are the coordinate functions of the sub-function F1. Let the input mask of the original S-box bex and an additional independently generated extended input mask x1 are respectively The input masks, the relationship between the class TI input mask and the input variable x of the S-box is as follows:

[0037]

[0038] The minimum splitting length of the coordinate function that can be achieved by the S-box of the Keccak algorithm to meet the TI requirement is 2. The following lists all the splitting schemes with a splitting length of 2 for the S-box that meet the requirements:

[0039]

[0040] There are a total of 5 different splitting schemes, which are respectively expressed as (0,1,2)·(3,4), (0,1,4)·(2,3),

[0041] (0,3,4)·(1,2), (1,2,3)·(0,4), (2,3,4)·(0,1). Among them, the sub-functions split are represented in the form of k-tuples The number i represents the original S-box coordinate function f i , and also serves as the coordinate function of the new sub-function. Taking the first sub-functions F0 and F1 listed as examples, design the 3-sharing TI schemes corresponding to the sub-functions F0 and F1 respectively:

[0042] The 3-sharing TI scheme of the sub-function F0 is represented as follows:

[0043]

[0044] Its output mask is denoted as The output of the shared function is denoted as 0 ≤ i ≤ 2, 0 ≤ j ≤ 2. It satisfies uniformity, so for any output mask y0 in its encoding method, the corresponding input mask x has 2 4 different encoding methods. The RTL view of this module is as Figure 3 shown.

[0045] The 3-sharing TI scheme of the sub-function F1 is represented as follows:

[0046]

[0047] The output mask is denoted as The output of the shared function is denoted as 3 ≤ i ≤ 4, 0 ≤ j ≤ 2. Meet the uniformity, so any output mask y1 The encoding method, the corresponding input mask x1 There are a total of 2 6 Different encoding methods. The RTL view of this module is as Figure 4 Shown.

[0048] The RTL view of the mask scheme of the overall S-box is as Figure 2 Shown. Since the input mask x ( The input mask of ) and the input expansion mask x1 ( The input mask of ) are independent of each other. Therefore, for the S-box class TI of the overall Keecak, any output mask y The encoding method, its corresponding class TI input mask has a total of 2 10 Encoding methods, meet the uniformity, because And Meet the correctness and incompleteness, so the overall S-box class TI mask meets the correctness and incompleteness.

[0049] Among all 75 classes of 5-bit quadratic permutation affine representative classes, 30 classes of affine representative classes can directly implement 3-share uniform TI. This paper gives the representative elements of the remaining 45 classes of affine equivalence classes (classes 28-30, 32, 35-75) of 5-bit quadratic permutation, as shown in Table 1, and gives the splitting scheme in the case of the minimum current splitting length in turn (this splitting scheme is not unique, for example, there are 12 splitting schemes with a splitting length of 2 in class 28 that meet the mask requirements, which are respectively expressed as: (0,1,3,4)·(2), (0,2,3,4)·(1), (1,2,3,4)·(0), (0,1,3)·(2,4), (0,1,4)·(2,3), (0,2,3)·(1,4), (0,2,4)·(1,3), (0,3,4)·(1,2), (1,2,3)·(0,4), (1,2,4)·(0,3), (1,3,4)·(0,2), (2,3,4)·(0,1)), and any one splitting scheme in Table 1 is selected.

[0050] The present invention implements the above masking scheme using the hardware description language Verilog HDL. The masking implementation file of the 5-bit quadratic permutation representative elements listed in Table 1 is logically synthesized using the synthesis tool Synopsys Design Compiler L-2016.03-SP1. The process library adopted is SMIC 180nm, with its specification being slow, and the working conditions are: the working temperature is 125 °C, and the working voltage is 1.62V. The Gate Equivalent is used to evaluate the hardware implementation area consumption of the 5-bit quadratic permutation without 3-sharing uniform TI when using the masking scheme of the present invention, as shown in Table 1.

[0051] Table 1. Representative elements of affine equivalence classes 28 - 30, 32, 35 - 75 and their class TI masking splitting schemes and implementation consumptions

[0052]

[0053]

[0054]

[0055] Currently, although 3-sharing uniform TI has not been given for the affine equivalence classes 28 - 30, 32, 35 - 75 of the 5-bit quadratic permutation, someone has given a direct 4-sharing TI scheme, which can be applied to the above equivalence classes to achieve uniform TI masking. The class TI masking proposed by the present invention is compared with the 4-sharing TI in terms of implementation consumption, and the results are shown in Table 2.

[0056] Table 2. Comparison of implementation consumptions of 3-sharing class TI and 4-sharing TI for 5-bit quadratic permutation representative elements [GE]

[0057]

[0058]

[0059] In addition, similar to the TI masking, for the class TI masking proposed by the present invention, when a class TI masking that satisfies the security property with a permutation splitting length of l is given, the class TI masking of all permutations affine equivalent to the permutation can be deduced. The Ascon algorithm is the current NIST lightweight cryptography standard. Taking the S-box of the Ascon algorithm as an example, the S-box of the Ascon algorithm and the S-box of the Keecak algorithm both belong to affine equivalence class 68. The S-box of the Ascon algorithm consists of three parts, namely the S-box linear layer A, the χ5 mapping, and the S-box affine layer B. Among them, the S-box linear layer and the affine layer add the following operations respectively at the input and output of χ5: x i +(x i+1 +1)x i+2 as follows:

[0060] A: (x4, x3, x2, x1, x0) → (x4 + x3, x3, x2 + x1, x1, x0 + x4)

[0061] B: (x4, x3, x2, x1, x0) → (x4, x3 + x2, x2 + 1, x1 + x0, x0 + x4)

[0062] The following introduces an implementation method of a type of TI mask for the S-box of the Ascon algorithm. The Ascon algorithm can be expressed as Split the χ5 mapping (the S-box of the Keccak algorithm) into two sub-functions that can achieve direct 3-sharing TI Taking the splitting scheme (0, 1, 2)·(3, 4) as an example, to ensure the correctness of the TI type, the mask of the linear layer A needs to be Repeatedly added to That is The mask of the affine layer B And Are different It needs to be compounded after Output, that is And use it as the output of the TI mask of the S-box of Ascon. The RTL view of the mask scheme of the S-box of the Ascon algorithm is as Figure 5 Shown, the implementation of this TI mask of the S-box consumes 255.67 GE

[0063] To construct an S-box that is easy to mask with low latency, non-balanced structured S-box construction is usually considered. Among them, the 5-bit quadratic S-box can be used as a sub-component of the non-balanced structured S-box. The present invention considers two non-balanced structured S-boxes: Bridge 3,4,5 And Misty 5,3,5 Among them, the Bridge 3,4,5 Structured S-box is composed of a 3-bit sub-component S3, a 4-bit sub-component S4, and a 5-bit sub-component S5. The Misty 5,3,5 Structured S-box is composed of a 3-bit sub-component S3 and two 5-bit sub-components Composed, and its specific construction method is as Figure 6 Shown. Apply the proposed 3-sharing TI mask of the present invention to the sub-components of the non-balanced structured S-box to implement the S-box mask, as Figure 7 Shown. And compare it with the mask implementation of the 8-bit non-balanced structured S-box of the currently known algorithm (Fantomas, a type of LS-Design cipher), and the results are shown in Table 3

[0064] Table 3. Comparison of mask consumption of 8-bit non-balanced structured S-boxes

[0065]

[0066] The S-box lookup tables of some known algorithms and the sub-component lookup tables of the unbalanced structured S-box constructed by the present invention are as follows:

[0067] Keecak = [0, 9, 18, 11, 5, 12, 22, 15, 10, 3, 24, 1, 13, 4, 30, 7, 20, 21, 6, 23, 17, 16, 2, 19, 26, 27, 8, 25, 29, 28, 14, 31]

[0068] Ascon = [4, 11, 31, 20, 26, 21, 9, 2, 27, 5, 8, 18, 29, 3, 6, 28, 30, 19, 7, 14, 0, 13, 17, 24, 16, 12, 1, 25, 22, 10, 15, 23]

[0069] Fantomas:

[0070] S3 = [0, 3, 6, 1, 5, 4, 2, 7]

[0071]

[0072] Bridge 3,4,5 :

[0073] S3 = [0, 3, 6, 1, 5, 4, 2, 7]

[0074] S4 = [0, 0, 0, 4, 0, 0, 8, 12, 0, 2, 0, 6, 1, 3, 9, 15]

[0075] S5 = [0, 17, 3, 22, 6, 29, 13, 18, 12, 15, 27, 28, 26, 19, 5, 8, 24, 11, 30, 9, 23, 14, 25, 4,

[0076] 21, 20, 7, 2, 10, 1, 16, 31]

[0077] Misty 5,3,5 :

[0078] S3 = [0, 3, 6, 1, 5, 4, 2, 7]

[0079]

[0080] Among all 75 affine equivalence classes of the current 5-bit quadratic permutation, 30 affine equivalence classes (classes 1 to 27, 31, 33, 34) have 3-share uniform TI, and the remaining 45 affine equivalence classes do not give 3-share TI schemes. By using the method of the present invention, 3-share masking schemes for the remaining 45 affine equivalence classes (classes 28 to 30, 32, 35 to 75) of the 5-bit quadratic permutation can be obtained, all of which satisfy correctness, incompleteness, and uniformity. 3-share masking schemes for the 5-bit S-boxes of some known cryptographic algorithms (such as Keecak and Ascon cryptographic algorithms) can also be realized. In addition, the 5-bit quadratic S-box permutation can also be used as a component of an 8-bit unbalanced structured S-box to construct an S-box that is easy to mask with low latency. Therefore, by using the method of the present invention, an 8-bit unbalanced structured S-box masking implementation can be further constructed. The above is an example of the best implementation mode of the present invention, and the parts not described in detail are all common general knowledge of those skilled in the art. The protection scope of the present invention is subject to the content of the claims, and any equivalent transformation based on the technical inspiration of the present invention is also within the protection scope of the present invention.

Claims

1. A method for implementing a 3-shared TI mask of an S-box based on coordinate function splitting, comprising the following steps: Step 1: The S-box is an n-bit quadratic S-box, and the coordinate function is expressed as (f0, f1, ..., f n ), the split length l is 2, 3, ..., n; according to the split length l, the S box is split into l balanced sub-functions F0, ..., F according to the coordinate function. l-1 , and each splitting scheme satisfies the condition: l balanced subfunctions F0,…,F l-1 The sum of the coordinate functions (f0,f1,...,f n ); Consider all possible combinations of coordinate functions and construct the set U l Save all splitting schemes with a split length of l, and obtain the corresponding set U when l is 2, 3, ..., n respectively l ; Step 2: Let l = 2 and traverse the set U l All the splitting schemes in , when a splitting scheme corresponds to l balanced sub-functions F0,…,F l-1 The TI masks of all satisfy the correctness, incompleteness and uniformity at the same time. Then the l balanced subfunctions F0,…,F l-1 The corresponding masking scheme is stored in the set K l , go to step 3, otherwise set l = l + 1 and execute step 2 again; Step 3: According to the set K l The mask scheme in the hardware description language is used to write the final RTL level code to design l sub-modules, and the function of the sub-module is the F corresponding to the split sub-function i The TI mask is implemented and the sub-module is finally instantiated in the main module.

2. The method for implementing the S-box 3 shared TI-like mask based on coordinate function splitting according to claim 1 is characterized in that: n is equal to 5.

Images