2 shared mask method of Bridge3, 4, 5 structure S box

Abstract

The invention relates to a 2-shared mask method of a Bridge3, 4, 5 structure S box, which realizes 2-shared mask of the Bridge3, 4, 5 structure S box by introducing a structural 2-shared mask method and a subcomponent search algorithm, and can search Bridge3, 4, 5S box components with good cryptographic properties through the subcomponent search algorithm, thereby constructing the Bridge3, 4, 5S box with good cryptographic properties. A structural 2-shared mask is applied to a subcomponent, so that a 2-shared mask scheme can meet correctness, incompleteness, uniformity and first-order detection safety, and 2-shared masks of Bridge3, 4 and 5S boxes are completed. And finally, designing RTL-level codes by using a hardware description language according to the mask scheme. The method provided by the invention can be applied to the realization of 2 shared masks of all 2-time 5-bit and 2-time 3-bit permutation affine equivalence classes, and the mask realization difficulty is reduced.

Description

Technical Field

[0001] The present invention relates to the field of side channel attack protection for hardware information security, and in particular to a Bridge 3,4,5 2-shared mask method for structured S-box. Background Art

[0002] Masking the S-boxes is the only solution for protecting against side-channel attacks. Traditional masking methods, such as Boolean masking, resist side-channel attacks by randomizing intermediate values, but they cannot protect against information leakage caused by circuit glitches due to comprehensive layout and input delays during circuit implementation. The Threshold Implementation (TI) masking scheme and the later proposed DOM masking scheme address these issues, but the former requires at least three shared masks, while the latter requires additional bits to achieve randomness on top of the two-shared mask, both of which increase area consumption. Furthermore, these masking schemes must also consider the overall uniformity of the S-boxes, which further complicates the implementation of the two-shared masking scheme. With the increasing demand for low latency and high throughput in communication technology, the two-shared masking scheme for S-boxes has become a research focus due to its advantages of low area consumption and low latency.

[0003] In 2020, Bilgin et al. constructed an S-box with low latency mask by reducing the AND depth of the S-box implementation. They first proposed the Bridge structure, which has cryptographic properties similar to traditional Feistel and Misty structures and a lower AND depth. Subsequently, an unbalanced Bridge structure S-box Bridge 3,4,5 It is proposed that this structure has a lower AND depth, which is conducive to low-latency mask implementation. Current research has not given a specific S-box mask scheme to verify that the constructed S-box is conducive to low-latency mask implementation. Existing research mostly focuses on balanced structures, and the mask implementation of unbalanced structures lacks system optimization. For example, the unbalanced structure S-box in the traditional solution often requires 4 sharing to be implemented, which greatly increases the mask implementation overhead. Previously, for Bridge 3,4,5 There is also a lack of research on the selection and masking scheme of 3-bit and 5-bit sub-components in S-boxes, especially the research on the masking scheme for secondary 5-bit permutation. The existing low-latency S-box construction has not fully verified the actual effectiveness of the masking scheme, resulting in a gap between theory and implementation. Therefore, the study of unbalanced structure S-box Bridge is a good choice. 3,4,5 The 2-shared mask implementation is of great significance. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a Bridge 3,4,5 2-shared mask method for structured S-box.

[0005] A Bridge 3,4,5 The 2-shared mask method of the structured S-box comprises the following steps:

[0006] Step 1: Bridge the S-box 3,4,5 , determine the overall cryptographic property requirements of the S-box, further determine the cryptographic property requirements of subcomponents S3, S4, and S5, search for subcomponents S3, S4, and S5 that meet the cryptographic properties, and apply the low-latency subcomponent search algorithm proposed in this invention to search for subcomponents S3, S4, and S5 that meet the cryptographic properties. Determine the construction form of a single coordinate function of a subcomponent; based on Bridge 3,4,5 The structural characteristics of the S-box (the uniformity of sub-component S4 does not affect the overall uniformity of the S-box). For S3 and S5, according to the algebraic normal form ANF of the coordinate function of the searched sub-component, the affine equivalence class and affine matrix of the coordinate function are determined. According to the affine equivalence class and affine matrix, the sub-components are subjected to 2-shared masking. For S4, a 2-shared masking scheme is given by direct analogy with DOM masking.

[0007] Step 2: For subcomponents S3 and S5, input mask Get the output mask y=(y 0 ,y 1 ), and then applying the structured 2-shared mask to get the output mask: And the extended output mask: The final output is recorded as m=(m L ,m R ), take direct 2-shared mask for subcomponent S4. Finally, according to Bridge 3,4,5 The S-box structure combines all subcomponents to implement Bridge 3,4,5 2-shared mask of S-box;

[0008] Step 3: Use hardware description language to write the final RTL-level code according to the mask scheme, and design sub-modules according to the sub-components. The function of the sub-module is to implement the 2-shared mask of the sub-components, and finally obtain the 2-shared mask hardware implementation of the S-box.

[0009] Furthermore, in step 1, the low-latency subcomponent search algorithm specifically includes the following steps:

[0010] Step 1.1, determine the single coordinate function construction form of subcomponents S3, S4, and S5, construct a Boolean function based on {AND, XOR, NOT}, and fix the AND operand of the Boolean function to 1, that is, Where a, b, and c are primary expressions, a, b, and c are collectively referred to as terms, and all constructed primary terms are saved in the set M;

[0011] Step 1.2: Traverse the elements in M in turn as items a, b, c and form the Boolean function y = a· Then go to step 1.3; when constructing the function y, the selection of items a and b cannot be repeated, and item c can be empty; after the traversal is completed, go to step 1.4;

[0012] Step 1.3: For an n-bit input Boolean function, traverse all inputs and count the number of times the output is 0. If the number is 2 n-1 , then y is a balanced function, otherwise it is not a balanced function. If y is not a balanced function, go to step 1.2 to construct the next Boolean function; if y is a balanced function, use this function as the coordinate function y0 of the pre-generated n×n function P, and transform each input variable x in the coordinate function y0 into i The subscript i is incremented by 1 to generate y1, y2, ..., y n-1 When n = 4, directly according to the coordinate function Y = {y0, y1, ..., y n-1 Generate a lookup table L, save the coordinate function Y as the candidate subcomponent coordinate function to the set K, and then jump to step 1.2 to construct the next Boolean function. When n≠4, according to the coordinate function Y={y0,y1,…,y n-1 Generate a lookup table L and determine whether it is a permutation. If so, save the coordinate function Y as the candidate subcomponent coordinate function to the set K and proceed to step 1.2 to construct the next Boolean function. If not, proceed directly to step 1.2 to construct the next Boolean function.

[0013] Step 1.4: Calculate the differential uniformity and linearity of all candidate subcomponents in K. Based on the construction characteristics of the structural S-box, select the candidate subcomponent with good differential uniformity and linearity as the final subcomponent.

[0014] Furthermore, the mask sharing number is 2.

[0015] The beneficial effects of the present invention are:

[0016] The present invention provides a structural S-box Bridge 3,4,5 The proposed 2-shared mask scheme achieves first-order security while satisfying the uniformity that is difficult to achieve with traditional 2-shared mask schemes. This method has the advantages of no uniformity search, low hardware overhead, and full affine class coverage.

[0017] The core idea of the present invention is to use the designed structural mask and low-latency small-bit S-box search algorithm to search for the structural S-box Bridge 3,4,5 The low-latency small-bit subcomponents of the 2-shared mask scheme are applied to these subcomponents to meet the incompleteness, correctness, uniformity and first-order detection security of the 2-shared mask scheme.3,4,5 Compact 2-shared mask implementation of structures.

[0018] The present invention is described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a flow chart of the present invention to realize the shared mask of S box 2.

[0020] Figure 2 It is a structure diagram of structure type 2 shared mask.

[0021] Figure 3 It is an unbalanced S-box Bridge 3,4,5 Structural diagram of .

[0022] Figure 4 It is an unbalanced structure S-box Bridge in the embodiment of the present invention. 3,4,5 2 Shared mask implementation structure diagram.

[0023] Figure 5 It is an unbalanced structure S-box Bridge in the embodiment of the present invention. 3,4,5 2 Shared mask hardware implementation RTL view. DETAILED DESCRIPTION

[0024] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0025] The core of the design idea and method of the present invention is to use the designed structural mask and low-latency small-bit S-box search algorithm to search for small-bit subcomponents of the unbalanced structural S-box, and apply the structural mask to these subcomponents to meet the incompleteness, correctness, uniformity and first-order detection security of the 2-shared mask scheme. While reducing the search difficulty and implementation consumption, it completes the Bridge 3,4,5 Compact 2-shared mask implementation of structures.

[0026] like Figure 1 As shown, the method for realizing unbalanced structured S-box 2 shared mask of the present invention comprises the following steps:

[0027] Step 1: Bridge for the structural S-box 3,4,5 (See the attached diagram of the S-box structure. Figure 3), the cryptographic properties of the S-box as a whole are required to be differential uniformity ≤ 16, linearity ≤ 64, which is the optimal property currently conjectured to be achievable by this structure. In order to reduce the search space and reduce the difficulty of the search, the cryptographic properties of the subcomponents are required to be (differential uniformity ≤ 2, linearity ≤ 8 of S3; differential uniformity ≤ 4, linearity ≤ 8 of S3; differential uniformity ≤ 4, linearity ≤ 16 of S5), and subcomponents S3, S4 and S5 that meet the cryptographic properties are searched. The low-latency subcomponent search algorithm proposed in this invention is applied to search for subcomponents S3, S4 and S5 that meet the cryptographic properties. Determine the structural form of the single coordinate function of the subcomponent; based on Bridge 3,4,5 The structural characteristics of the S-box (the uniformity of sub-component S4 does not affect the overall uniformity of the S-box). For S3 and S5, according to the algebraic normal form ANF of the coordinate function of the searched sub-component, the affine equivalence class and affine matrix of the coordinate function are determined. According to the affine equivalence class and affine matrix, the sub-components are subjected to 2-shared masking. For S4, a 2-shared masking scheme is given by direct analogy with DOM masking.

[0028] A 2-shared mask scheme with secondary 3- and 5-bit permutations is given:

[0029] There are three types of affine equivalence classes of quadratic 5-bit Boolean functions: Give the affine equivalence class of quadratic 5-bit Boolean functions 2-shared mask representing element:

[0030] make Represents input variables Input mask, f j Represents a shared function.

[0031] The representative element is y=x0, and two shared functions f0~f1 are used. For each shared function f j , using the intermediate register z in sequence i Stores the result of its calculation. 0 ,y 1 Represents the output mask corresponding to the output variable y. The 2-shared mask scheme is as follows:

[0032]

[0033] The representative element is z = x0 + x1 x2, and four shared functions f0 to f3 are used. For each shared function f j , using the intermediate register z in sequence i Store its calculation results. 0 ,z 1 Represents the output mask corresponding to the output variable z. The 2-shared mask scheme is as follows:

[0034]

[0035] The representative element is t = x0 + x1x2 + x3x4, and 6 shared functions f0 to f5 are used. For each shared function f j , using the intermediate register t in sequence i Store the calculation results. 0 ,t 1 Represents the output mask corresponding to the output variable t. The 2-shared mask scheme is as follows:

[0036]

[0037] There are two types of affine equivalence classes of quadratic 3-bit Boolean functions, Give the affine equivalence class of quadratic 3-bit Boolean functions 2-shared mask representing element:

[0038] make Represents input variables Input mask, f j Represents a shared function.

[0039] The representative element is y=x0, and two shared functions f0~f1 are used. For each shared function f j , using the intermediate register z in sequence i Stores the result of its calculation. 0 ,y 1 Represents the output mask corresponding to the output variable y. The 2-shared mask scheme is as follows:

[0040]

[0041] The representative element is z = x0 + x1 x2, and four shared functions f0 to f3 are used. For each shared function f j , using the intermediate register z in sequence i Store its calculation results. 0 ,z 1 Represents the output mask corresponding to the output variable z. The 2-shared mask scheme is as follows:

[0042]

[0043]

[0044] For the structural type 2-shared mask of each affine equivalent representative element given above, it is easy to verify that the XOR sum of its output mask is equal to the original function, so the correctness is satisfied. Observing the shared function form of each representative element 2-shared mask, it is found that each shared function fj Only receives input signal x k Any shared mask of Therefore incompleteness is satisfied.

[0045] The traversal algorithm can be used to verify that the structure type 2 shared mask meets the uniformity and first-order detection security:

[0046] For any n-bit input variable x, the corresponding mask x L ,x R There are 2 2n A coding method that traverses all inputs, applies the structured 2 shared mask to these inputs, obtains the output mask and, and converts the output mask m of each time into L ,m R Add to set C. After the traversal, if the size of set C is 2 2n , then the output mask also has 2 2n The encoding method and the masking scheme satisfy uniformity.

[0047] Similarly, traverse all mask inputs x, for each possible mask combination x L ,x R , calculate the output of its shared function, generate intermediate register variables (such as t0, t1 and z0, z1), count the frequency of occurrence of each intermediate register variable combination, and generate a frequency spectrum P. For any input variable x, the frequency spectrum P of the intermediate register variables is a fixed value, indicating that the frequency spectrum is independent of the input variable and the mask meets the first-order detection security.

[0048] It is easy to prove that under affine equivalence, the correctness and uniformity of the structural two-shared mask of Boolean functions remain unchanged, but the incompleteness of the two-shared mask is not necessarily unchanged under affine equivalence. Because affine transformations confuse input variables before masking, they may destroy the independence between input masks. Therefore, when the affine transformation destroys the independence of the input masks of nonlinear gates, the present invention considers adding a register stage at its output to ensure the independence of the input masks and thus ensure the incompleteness of the mask.

[0049] Using the low-latency small-bit S-box search algorithm, we search for subcomponents that meet the cryptographic properties: 3-bit subcomponent S3 and 5-bit subcomponent S5. The process is as follows:

[0050] Determine the single coordinate function construction form of subcomponents S3 and S5, construct a Boolean function based on {AND, XOR, NOT}, and fix the AND operand (#AND) of the Boolean function to 1, that is, Where a, b, and c are linear expressions (no AND logic gates, only XOR or NOT logic gates, or no logic gates). a, b, and c are collectively referred to as terms. Save all constructed linear terms to a set M, and select elements in M in turn as terms a, b, and c to form a Boolean function. Among them, when constructing the constructor y, the selection of items a and b cannot be repeated (to ensure that the final sub-component is quadratic and meet the low latency requirement), and item c can be empty.

[0051] For an n-bit input Boolean function, traverse all inputs and count the number of times the output is 0. If the number is 2 n -1 , then y is a balanced function, otherwise it is not a balanced function. If y is not a balanced function, construct the next Boolean function; if y is a balanced function, use this function as the coordinate function y0 of the pre-generated n×n function P, and transform each input variable x in the coordinate function y0 into i The subscript i is incremented by 1 to generate y1, y2, ..., y n-1 When n=4, according to the coordinate function Y={y0, y1, ..., y n-1} Generate a lookup table L and save the subcomponent to the set K. When n≠4, according to the coordinate function Y={y0,y1,…,y n-1 Generate a lookup table L and determine whether it is a permutation. If so, save the subcomponent to the set K. Calculate the cryptographic properties of the subcomponents in K. Based on the construction characteristics of the structured S-box, select appropriate subcomponents so that the final S-box satisfies differential uniformity ≤ 16 and linearity ≤ 64.

[0052] Select a subcomponent combination that meets the requirements from K. An example is given below: subcomponent S3, with a differential uniformity of 2, a linearity of 8, and a coordinate function expression of y i =x i +(x i+1 +1)x i+2 ; Subcomponent S4, differential uniformity is 4, linearity is 8, coordinate function expression is y i =x i+2 x i+3 ; Subcomponent S5, differential uniformity is 4, linearity is 16, coordinate function is y i =x i +x i+1 +(x i+1 +x i+2 +x i+3 )x i+4 (where i is the S-box output bit index, all modulo operations)

[0053] The subcomponent lookup table is as follows:

[0054] S3=[0,3,6,1,5,4,2,7]

[0055] S4=[0,0,0,4,0,0,8,12,0,2,0,6,1,3,9,15]

[0056] S5=[0,17,3,22,6,29,13,18,12,15,27,28,26,19,5,8,24,11,30,9,23,14,25,4,21,20,7,2,10,1,16,31]

[0057] Step 2: Apply the structural 2-shared mask provided by the present invention to these subcomponents, and finally complete the masking: perform structural 2-shared masking on subcomponents S3 and S5, and directly perform 2-shared masking on subcomponent S4:

[0058] Each coordinate function of subcomponent S3 is (i is the coordinate index, modulo 3 operation), expressed as A i , B i All are affine transformations, and B0~B2 are identity permutations.

[0059] By observing the form of coordinate function, it is easy to obtain A i (Given in matrix form, the same below).

[0060] Among them, A0~A2 are:

[0061]

[0062] because And the representation of the coordinate function is consistent, A i The corresponding mask is brought into the previous text The 2-shared mask of S3 can be obtained.

[0063] 2 Shared masks are as follows:

[0064]

[0065] Each coordinate function of subcomponent S5 is (i is the coordinate index, modulo 5 operation), expressed as A i , B i All are affine transformations, and B0~B4 are identity permutations.

[0066] By observing the form of coordinate function, it is easy to obtain A i .

[0067] Among them, A0~A4 are:

[0068]

[0069]

[0070] because And the representation of the coordinate function is consistent, A i The corresponding mask is brought into the previous text The 2-shared mask of S5 can be obtained.

[0071] 2 Shared masks are as follows:

[0072]

[0073] Perform direct 2-share masking on S4 and select the mask as follows: (i is the coordinate index, modulo 4 operation):

[0074]

[0075] By observing the form of the above mask, it is easy to prove that the mask scheme meets the correctness and incompleteness. Then, the uniformity verification algorithm proposed by the present invention is applied to verify whether the output masks of sub-components S3 and S5 meet the uniformity. The specific process is as follows:

[0076] Generate input mask for input x of subcomponent S5 Applying the above 2-shared mask scheme, we can directly get the output mask (y 0 ,y 1 ), apply the structure type 2 shared mask proposed by the present invention (the structure diagram of the structure type 2 shared mask is shown in the attached Figure 2 ), the input mask Output mask (y 0 ,y 1 ), Extended input mask As input, get the output mask and the expanded output mask:

[0077] Output mask:

[0078] Extended output mask:

[0079] Traverse all inputs of x, generate input mask and expand input mask (x l ,x R ), and get the corresponding (m l ,m R ), added to set C. For S5, input mask and extended input mask (x L ,x R )Total 2 10A coding method, if the mask output satisfies the uniformity, then the output mask and the expanded output mask (m L ,m R ) should also have 2 10 The encoding method is that the size of set C should be 2 10 , after checking, the size of set C is 2 10 , the masking scheme satisfies uniformity. Traverse the input x, count and generate the frequency spectrum P of the intermediate register variable combination. After inspection, for any x, the frequency spectrum P is a fixed value, and the masking scheme satisfies the first-order detection security. Applying the same steps, it can be verified that the structural type 2 shared mask of subcomponent S3 also satisfies uniformity and first-order detection security. In summary, the correctness, incompleteness, uniformity and first-order detection security of the mask are all met. Combining the masking schemes of the subcomponents, we get the unbalanced structural type S-box Bridge 3,4,5 2-shared mask scheme, the structural 2-shared mask implementation structure diagram is shown in Figure 4 In this example, the differential uniformity of the S-box is required to be ≤16 and the linearity is required to be ≤64. The final result of the S-box is that the differential uniformity is 16 and the linearity is 64.

[0080] Step 3: Use hardware description language to write the final RTL level code according to the mask scheme, and design submodules according to the number of subcomponents. The function of the submodule is to realize the 2-shared mask of the subcomponents, and finally obtain the 2-shared mask hardware implementation of the S-box. The RTL view is attached. Figure 5 The results are compared with the mask implementation of the 8-bit unbalanced structured S-box of the currently known algorithm (Fantomas, an LS-Design cipher), and are shown in Table 1.

[0081] Table 1 Comparison of mask consumption of 8-bit unbalanced structured S-box

[0082] S-Box structure Area (GE) Fantomas <![CDATA[Misty 5,3,5 ]]> 758 Structure of the present invention <![CDATA[Bridge 3,4,5 ]]> 696

[0083] The foregoing is an example of the best mode of carrying out the present invention. Any portion not described in detail herein is common knowledge within the skill of one of ordinary skill in the art. The scope of protection of the present invention is determined by the claims. Any equivalent transformation based on the technical teachings of the present invention is also within the scope of protection of the present invention.

Claims

1. A Bridge 3,4,5 The 2-shared mask method of the structured S-box is characterized in that The following steps are involved: Step 1: Bridge the S-box 3,4,5 , determine the cryptographic property requirements of the S-box as a whole, further determine the cryptographic property requirements of subcomponents S3, S4, and S5, search for subcomponents S3, S4, and S5 that meet the cryptographic properties, and apply the low-latency subcomponent search algorithm proposed in this invention to search for subcomponents S3, S4, and S5 that meet the cryptographic properties. Determine the construction form of a single coordinate function of a subcomponent; based on Bridge 3,4,5 The structural characteristics of the S-box (the uniformity of sub-component S4 does not affect the overall uniformity of the S-box). For S3 and S5, according to the algebraic normal form ANF of the coordinate function of the searched sub-component, the affine equivalence class and affine matrix of the coordinate function are determined. According to the affine equivalence class and affine matrix, the sub-components are subjected to 2-shared masking. For S4, a 2-shared masking scheme is given by direct analogy with DOM masking. Step 2: For subcomponents S3 and S5, input mask Get the output mask y=(y 0 ,y 1 ), and then applying the structured 2-shared mask to get the output mask: And the extended output mask: The final output is recorded as m=(m L ,m R ), take direct 2-shared mask for subcomponent S4. Finally, according to Bridge 3,4,5 The S-box structure combines all subcomponents to implement Bridge 3,4,5 2-shared mask of S-box; Step 3: Use hardware description language to write the final RTL-level code according to the mask scheme, and design sub-modules according to the sub-components. The function of the sub-module is to implement the 2-shared mask of the sub-components, and finally obtain the 2-shared mask hardware implementation of the S-box.

2. The Bridge according to claim 1 3,4,5 The 2-shared mask method of the structured S-box is characterized in that In step 1, the low-latency subcomponent search algorithm specifically includes the following steps: Step 1.1, determine the single coordinate function construction form of subcomponents S3, S4, and S5, construct a Boolean function based on {AND, XOR, NOT}, and fix the AND operand of the Boolean function to 1, that is, Where a, b, and c are primary expressions, a, b, and c are collectively referred to as terms, and all constructed primary terms are saved in the set M; Step 1.2: Traverse the elements in M in turn as items a, b, c and form a Boolean function Then go to step 1.3; when constructing the function y, the selection of items a and b cannot be repeated, and item c can be empty; after the traversal is completed, go to step 1.4; Step 1.3: For an n-bit input Boolean function, traverse all inputs and count the number of times the output is 0. If the number is 2 n-1 , then y is a balanced function, otherwise it is not a balanced function. If y is not a balanced function, go to step 1.2 to construct the next Boolean function; if y is a balanced function, use this function as the coordinate function y0 of the pre-generated n×n function P, and transform each input variable x in the coordinate function y0 into i The subscript i is incremented by 1 to generate y1, y2, ..., y n-1 When n = 4, directly according to the coordinate function Y = {y0, y1, ..., y n-1 Generate a lookup table L, save the coordinate function Y as the candidate subcomponent coordinate function to the set K, and then jump to step 1.2 to construct the next Boolean function. When n≠4, according to the coordinate function Y={y0,y1,…,y n-1 Generate a lookup table L and determine whether it is a permutation. If so, save the coordinate function Y as the candidate subcomponent coordinate function to the set K and proceed to step 1.2 to construct the next Boolean function. If not, proceed directly to step 1.2 to construct the next Boolean function. Step 1.4: Calculate the differential uniformity and linearity of all candidate subcomponents in K. Based on the construction characteristics of the structural S-box, select the subcomponent that meets the requirements as the final subcomponent.

3. The Bridge according to claim 1 3,4,5 The 2-shared mask method of the structured S-box is characterized in that The mask sharing number is 2.

Images