A bridge 3,4,5 2-sharing mask method for structured s-boxes

Abstract

This invention relates to a bridge 3,4,5 This invention introduces a structural 2-shared masking method and a sub-component search algorithm to achieve a method for masking S-boxes. 3,4,5 The 2-shared mask of the S-box structure can be used to search for cryptographically sound bridges through a subcomponent search algorithm. 3,4,5 S-box components are used to construct a cryptographically sound Bridge. 3,4,5 S-box. Applying a structural 2-shared mask to the sub-components ensures that the 2-shared mask scheme satisfies correctness, incompleteness, uniformity, and first-order probe security, and completes the bridge... 3,4,5 The S-box uses a 2-shared mask. Finally, based on the masking scheme, RTL-level code is designed using a hardware description language. This invention's method can be applied to the implementation of 2-shared masks for all 2-fold 5-bit and 2-fold 3-bit permutation affine equivalence classes, reducing the difficulty of mask implementation.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of side-channel attack protection of hardware information security, and particularly relates to a 2-share masking method of a Bridge 3,4,5 structure S-box. BACKGROUND

[0002] For side-channel attack protection, masking S-box is the only solution. Traditional masking methods such as Boolean masking resist side-channel attacks by randomizing intermediate values, but they cannot resist information leakage caused by circuit glitches caused by comprehensive layout and input delay in circuit implementation. The threshold implementation (TI) masking scheme and the later proposed DOM masking scheme solve these problems, but the former requires at least 3-share masking, and the latter requires additional bits to meet randomness on the basis of 2-share masking, which increases the additional area consumption. In addition, such masking schemes also need to consider the uniformity of the S-box as a whole, which are the implementation difficulties of 2-share masking schemes. With the increasing demand for low latency and high throughput in communication technology, 2-share masking schemes for S-boxes have become a research focus due to their low area consumption and low latency.

[0003] In 2020, Bilgin et al. constructed an S-box with low latency masking by reducing the AND depth of the S-box implementation, and first proposed a Bridge structure, which has similar cryptographic properties to traditional Feistel and Misty structures and lower AND depth. Subsequently, an unbalanced Bridge structure S-box Bridge 3,4,5 was proposed, which has lower AND depth and is beneficial to low latency masking implementation. The current research does not give the specific masking scheme of the S-box to verify that the constructed S-box is beneficial to low latency masking implementation. Existing researches are mostly focused on balanced structures, and the masking implementation of unbalanced structures lacks systematic optimization. For example, the unbalanced structure S-box in the traditional scheme often needs 4 shares to implement, which dramatically increases the masking implementation overhead. Previous research on 3-bit and 5-bit sub-components selection and masking schemes in Bridge 3,4,5 S-boxes is also relatively lacking, especially the masking scheme for quadratic 5-bit permutation. The existing low latency S-box construction does not fully verify the actual efficiency of the masking scheme, resulting in a gap between theory and implementation. Therefore, it is of great significance to study the 2-share masking implementation of the unbalanced structure S-box Bridge 3,4,5 . SUMMARY

[0004] The technical problem to be solved by the present application is to provide a 2-share masking method of a Bridge 3,4,5 structure S-box in view of the above problems and requirements.

[0005] A Bridge 3,4,5 The 2-sharing mask method of the structure S-box includes the following steps:

[0006] Step 1: determining the overall cryptographic property requirements of the structure S-box Bridge 3,4,5 , further determining the cryptographic property requirements of the sub-components S3, S4 and S5, searching for the sub-components S3, S4 and S5 satisfying the cryptographic property, and applying the low-latency sub-component search algorithm proposed in the application to search for the sub-components S3, S4 and S5 satisfying the cryptographic property. 3,4,5 Determine the construction form of the single coordinate function of the sub-component; based on the structure characteristics of Bridge 0 (the uniformity of the sub-component S4 does not affect the overall uniformity of the S-box), for S3 and S5, determine the affine equivalence class to which the coordinate function of the searched sub-component belongs according to the algebraic normal form ANF of the coordinate function, the affine matrix, and perform 2-sharing mask on the sub-component according to the affine equivalence class and the affine matrix, and for S4, directly analogize the DOM mask to give a 2-sharing mask scheme;

[0007] Step 2: for the sub-components S3 and S5, obtain the output mask y = (y 0 , y 1 ) from the input mask , and then apply the structure type 2-sharing mask to obtain the output mask: and the extended output mask: The final output is recorded as m = (m L , m R ), and the direct 2-sharing mask is adopted for the sub-component S4. Finally, all the sub-components are combined according to the structure of Bridge 3,4,5 S-box to realize the 2-sharing mask of Bridge 3,4,5 S-box;

[0008] Step 3: according to the mask scheme, use the hardware description language to write the final RTL level code, design the sub-module corresponding to the sub-component, the function of the sub-module is to realize the 2-sharing mask of the sub-component, and finally obtain the hardware implementation of the 2-sharing mask of the S-box.

[0009] Further, in the step 1, the low-latency sub-component search algorithm specifically includes the following steps:

[0010] Step 1.1, determine the construction form of the single coordinate function of the sub-component S3, S4 and S5, construct a Boolean function with {AND, XOR, NOT} as the implementation base, and fix the AND operand of the Boolean function as 1, that is, wherein a, b and c are one-time expressions, and a, b and c are collectively referred to as terms, and all the one-time terms constructed are saved to a set M;

[0011] Step 1.2, sequentially traversing the elements in M as terms a, b, c and composing a Boolean function y=a· Step 1.3 is returned to; wherein the selection of terms a, b in the constructor y is not repeated, and term c can be empty; after the traversal is ended, step 1.4 is returned to;

[0012] Step 1.3, for an n-bit input Boolean function, traverse all inputs and count the number of times the output is 0, if the number of times is 2 n-1 , then y is a balanced function, otherwise it is not a balanced function, if y is not a balanced function, then step 1.2 is returned to to construct the next Boolean function; if y is a balanced function, then the function is taken as a coordinate function y0 of the pre-generated n*n function P, and the index i of each input variable x i in the coordinate function y0 is sequentially incremented to generate y1, y2, …, y n-1 When n=4, a lookup table L is directly generated according to the coordinate function Y={y0, y1, …, y n-1}, the coordinate function Y is saved to the set K as a candidate sub-component coordinate function, and then step 1.2 is jumped to to construct the next Boolean function. When n≠4, a lookup table L is generated according to the coordinate function Y={y0, y1, …, y n-1}, and it is judged whether it is a permutation; if it is a permutation, the coordinate function Y is saved to the set K as a candidate sub-component coordinate function, and then step 1.2 is returned to to construct the next Boolean function, if it is not a permutation, then step 1.2 is directly returned to to construct the next Boolean function;

[0013] Step 1.4, the differential uniformity and linearity of all candidate sub-components in K are calculated, based on the construction characteristics of the structure type S-box, the candidate sub-component with better differential uniformity and linearity is selected as the final sub-component.

[0014] Further, the mask sharing number is 2.

[0015] The beneficial effects of the present application are:

[0016] The present application provides a 2 shared mask scheme of a structure type S-box Bridge 3,4,5 , realizes the first order security, and meets the uniformity that the traditional 2 shared mask scheme cannot realize, and the method has the advantages of uniformity search free, low hardware overhead and full affine class coverage.

[0017] The core idea of the present application is to search for low latency small bit sub-components of the structure type S-box Bridge 3,4,5 by using the designed structure type mask and low latency small bit S-box search algorithm, and to apply the structure type mask to these sub-components to meet the incompleteness, correctness, uniformity and first order detection security of the 2 shared mask scheme. While reducing the search difficulty, the Bridge3,4,5 Compact 2-share mask implementation of the structure.

[0018] The application will be described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 is a flow chart of the application for implementing 2-share mask of S-box.

[0020] Figure 2 is a structure diagram of the structure type 2-share mask.

[0021] Figure 3 is a structure diagram of the unbalanced structure type S-box Bridge 3,4,5 .

[0022] Figure 4 is a structure diagram of the unbalanced structure type S-box Bridge 3,4,5 2-share mask implementation structure in the embodiment of the application.

[0023] Figure 5 is a 2-share mask hardware implementation RTL view of the unbalanced structure type S-box Bridge 3,4,5 in the embodiment of the application. DETAILED DESCRIPTION

[0024] The principles and features of the application are described below in combination with the drawings, and the examples are only used to explain the application and not to limit the scope of the application.

[0025] The core of the design idea and method of the application is to search for small bit sub-components of the unbalanced structure type S-box by using the designed structure type mask and low latency small bit S-box search algorithm, to apply the structure type mask to these sub-components, to meet the incompleteness, correctness, uniformity and first-order detection security of the 2-share mask scheme, to reduce the search difficulty and implementation consumption, and to complete the implementation of the compact 2-share mask of the Bridge 3,4,5 structure.

[0026] As shown in Figure 1 , the method for implementing 2-share mask of the unbalanced structure type S-box of the application includes the following steps:

[0027] Step 1: For the structure type S-box Bridge 3,4,5 (S-box structure diagram, see attached Figure 3), here the overall S-box is required to have the cryptographic properties of differential uniformity ≤ 16 and linear degree ≤ 64, which are the best properties that can be achieved by the structure currently guessed. In order to reduce the search space and reduce the search difficulty, the cryptographic property requirements of the sub-components are (the differential uniformity of S3 is ≤ 2, the linear degree is ≤ 8; the differential uniformity of S3 is ≤ 4, the linear degree is ≤ 8; the differential uniformity of S5 is ≤ 4, the linear degree is ≤ 16), and the sub-components S3, S4 and S5 satisfying the cryptographic property are searched by using the low-latency sub-component search algorithm proposed in the application. The construction form of the single coordinate function of the sub-component is determined; based on the structure characteristics (the uniformity of the sub-component S4 does not affect the uniformity of the overall S-box) of Bridge 3,4,5 , for S3 and S5, the affine equivalence class to which the coordinate function of the searched sub-component belongs is determined according to the algebraic normal form ANF of the coordinate function, the affine matrix, and the 2 shared mask of the sub-component is obtained according to the affine equivalence class and the affine matrix; for S4, the 2 shared mask scheme is directly analogized from the DOM mask;

[0028] The 2 shared mask scheme of the quadratic 3, 5-bit permutation is given:

[0029] There are three types of affine equivalence classes of the quadratic 5-bit Boolean function, which are The affine equivalence classes of the quadratic 5-bit Boolean function are given: The 2 shared mask of the representative element is:

[0030] Let represent the input mask of the input variable f j represents the shared function.

[0031] The representative element is y=x0, and 2 shared functions f0~f1 are used. For each shared function f j , the calculation result is stored in the intermediate register z i in turn. y 0 , y 1 represent the output mask corresponding to the output variable y, and the 2 shared mask scheme is as follows:

[0032]

[0033] The representative element is z=x0+x1x2, and 4 shared functions f0~f3 are used. For each shared function f j , the calculation result is stored in the intermediate register z i in turn. z 0 , z 1 represent the output mask corresponding to the output variable z, and the 2 shared mask scheme is as follows:

[0034]

[0035] The representative element is t=x0+x1x2+x3x4, and 6 sharing functions f0~f5 are used. For each sharing function f j , the intermediate register t i is used to store its calculation result. t 0 , t 1 denote the output mask corresponding to the output variable t, and the 2-sharing mask scheme is as follows:

[0036]

[0037] There are two classes of affine equivalence classes of quadratic 3-bit Boolean functions, which are The affine equivalence class of quadratic 3-bit Boolean functions is given The 2-sharing mask of the representative element is:

[0038] Let denote the input mask of the input variable , and f j denote the sharing function.

[0039] The representative element is y=x0, and 2 sharing functions f0~f1 are used. For each sharing function f j , the intermediate register z i is used to store its calculation result. y 0 , y 1 denote the output mask corresponding to the output variable y, and the 2-sharing mask scheme is as follows:

[0040]

[0041] The representative element is z=x0+x1x2, and 4 sharing functions f0~f3 are used. For each sharing function f j , the intermediate register z i is used to store its calculation result. z 0 , z 1 denote the output mask corresponding to the output variable z, and the 2-sharing mask scheme is as follows:

[0042]

[0043]

[0044] For the 2-sharing mask of the structure type of each affine equivalence representative element given above, it is easy to verify that the XOR sum of its output mask is equal to the original function, so the correctness is satisfied. By observing the form of the sharing function of each representative element 2-sharing mask, it is found that each sharing function fj only receive input signal x k any one of the shared mask Therefore, the integrity is satisfied.

[0045] The traversal algorithm can be used to verify that the structure type 2 shared mask satisfies uniformity and first-order detection security:

[0046] For any n-bit input variable x, the corresponding mask x L ,x R There are 2 2n Encoding mode, traversing all inputs, applying structure type 2 shared mask to these inputs to get output mask and, and adding each output mask m L ,m R to the set C, and if the size of the set C is 2 2n after traversal, it means that the output mask also has 2 2n Encoding mode, and the mask scheme satisfies uniformity.

[0047] Similarly, traverse all mask inputs x, for each possible mask combination x L ,x R , calculate the output of the shared function to generate intermediate register variables (such as t0, t1 and z0, z1), and count the frequency of each intermediate register variable combination to generate the frequency spectrum P. For any input variable x, the frequency spectrum P of the intermediate register variable is a fixed value, which means that the frequency spectrum is independent of the input variable, and the mask satisfies the first-order detection security.

[0048] It is easy to prove that the correctness of the structure type 2 shared mask of the Boolean function is not changed under affine equivalence, and the uniformity is not changed, and the non-integrity of the 2 shared mask is not necessarily unchanged under affine equivalence. Since the affine transformation confuses the input variables before masking, it may destroy the independence between the input masks, so the present application considers adding a register level at the output of the affine transformation to ensure the independence between the input masks to ensure the non-integrity of the mask.

[0049] Using a low-latency small-bit S-box search algorithm, search for 3-bit sub-component S3 and 5-bit sub-component S5 that satisfy the cryptographic properties, the process is as follows:

[0050] Determine the single coordinate function construction form of the sub-component S3 and S5, construct a Boolean function with {AND, XOR, NOT} as the implementation base, and fix the AND operand (#AND) of the Boolean function to 1, that is Wherein, a, b, c are one expression (no AND logic gate, only XOR or NOT logic gate or no logic gate). Collect a, b, c as item. Save all one item to set M, select M element as item a, b, c and form Boolean function Wherein, the selection of a, b in the construction function y is not repeated (to ensure that the final subcomponent is quadratic, meet low latency requirements), and c can be empty.

[0051] For n-bit input Boolean function, traverse all inputs and count the number of times of output 0, if the number of times is 2 n -1 , then y is a balanced function, otherwise it is not a balanced function. If y is not a balanced function, construct the next Boolean function; if y is a balanced function, take the function as the coordinate function y0 of the pre-generated n*n function P, and generate y1, y2, …, y i by adding 1 to the subscript i of each input variable x n-1 in the coordinate function y0 in turn. When n=4, generate the lookup table L according to the coordinate function Y={y0, y1, …, y n-1}, and save the subcomponent to set K. When n≠4, generate the lookup table L according to the coordinate function Y={y0, y1, …, y n-1} and judge whether it is a permutation. If it meets the permutation, save the subcomponent to set K. Calculate the cryptographic properties of the subcomponents in K. Based on the construction characteristics of the structure type S-box, select appropriate subcomponents so that the finally completed S-box meets the differential uniformity ≤16 and the linearity ≤64.

[0052] Select the subcomponent combination that meets the requirements from K, and one example is given below: subcomponent S3, differential uniformity is 2, linearity is 8, coordinate function expression is y i =x i +(x i+1 +1)x i+2 ; subcomponent S4, differential uniformity is 4, linearity is 8, coordinate function expression is y i =x i+2 x i+3 ; subcomponent S5, differential uniformity is 4, linearity is 16, coordinate function is y i =x i +x i+1 +(x i+1 +x i+2 +x i+3 )x i+4 . (Wherein i is the S-box output bit index, and the modulo operation is taken)

[0053] The subcomponent lookup table is as follows:

[0054] S3=[0, 3, 6, 1, 5, 4, 2, 7]

[0055] S4=[0, 0, 0, 4, 0, 0, 8, 12, 0, 2, 0, 6, 1, 3, 9, 15]

[0056] S5=[0, 17, 3, 22, 6, 29, 13, 18, 12, 15, 27, 28, 26, 19, 5, 8, 24, 11, 30, 9, 23, 14, 25, 4, 21, 20, 7, 2, 10, 1, 16, 31]

[0057] Step 2: Apply the structure type 2 sharing mask provided by the present application to these sub-components, and finally complete the mask: perform structure type 2 sharing mask on sub-component S3, S5, and directly perform 2 sharing mask on sub-component S4:

[0058] The coordinate function of each sub-component S3 is (i is the coordinate index, modulo 3 operation), which is expressed as A i , B i are affine transformations, and B0~B2 are identity permutations.

[0059] By observing the form of the coordinate function, A i (equivalent to the matrix form) can be easily obtained.

[0060] Where A0~A2 are respectively:

[0061]

[0062] Since and the representation form of the coordinate function is consistent, A i is obtained. The 2 sharing mask of S3 can be obtained by substituting the mask into the 2 sharing mask of the previous .

[0063] The 2 sharing mask is as follows:

[0064]

[0065] The coordinate function of each sub-component S5 is (i is the coordinate index, modulo 5 operation), which is expressed as A i , B i are affine transformations, and B0~B4 are identity permutations.

[0066] By observing the form of the coordinate function, A i .

[0067] Where A0~A4 are respectively:

[0068]

[0069]

[0070] Since and the coordinate functions are consistent in representation, A i The corresponding mask is brought into the foregoing 2-share mask of S5 can be obtained by sharing the 2-share mask of S4.

[0071] The 2-share mask is as follows:

[0072]

[0073] The direct 2-share mask of S4 is selected as follows (i is the coordinate index, and the modulo 4 operation is performed):

[0074]

[0075] It can be easily proved that the mask scheme satisfies the correctness and incompleteness by observing the form of the above mask. Then, the uniformity verification algorithm proposed in the present application is applied to verify whether the output masks of sub-components S3 and S5 satisfy the uniformity, and the specific flow is as follows:

[0076] The input mask of the sub-component S5 is generated The output mask (y 0 ,y 1 ) is directly obtained by applying the above 2-share mask scheme, and the input mask Figure 2 is applied to the structure type 2-share mask (the structure diagram of the structure type 2-share mask is shown in the attached ), the output mask (y 0 ,y 1 ) and the extended input mask are taken as inputs, and the output mask and the extended output mask are obtained:

[0077] The output mask is:

[0078] The extended output mask is:

[0079] The input mask and the extended input mask (x l ,x R ) are generated by traversing all inputs of x, and the corresponding (m l ,m R ) is obtained and added to the set C. For S5, the input mask and the extended input mask (x L ,x R ) have 2 10A coding mode, if the mask output satisfies uniformity, the output mask and the extended output mask (m L , R ) should also have 2 10 coding mode, that is, the size of set C should be 2 10 , after checking, the size of set C is 2 10 , the mask scheme satisfies uniformity. Traverse the input x, count and generate the frequency spectrum P of the intermediate register variable combination, after checking, for any x, the frequency spectrum P is a fixed value, the mask scheme satisfies the first-order detection security. By applying the same steps, it can be verified that the structure type 2 shared mask of subcomponent S3 also satisfies uniformity and first-order detection security. In summary, the correctness, incompleteness, uniformity and first-order detection security of the mask are all satisfied. Combining the mask schemes of the subcomponents, the 2 shared mask scheme of the unbalanced structure type S-box Bridge 3,4,5 is obtained, and the implementation structure diagram of the structure type 2 shared mask is shown in Figure 4 . In this example, the differential uniformity of the S-box is required to be ≤ 16, and the linearity is ≤ 64, and finally the result of the S-box is that the differential uniformity is 16 and the linearity is 64.

[0080] Step 3: According to the mask scheme, the final RTL level code is written using a hardware description language, and submodules are designed according to the number of subcomponents, and the function of the submodules is to implement the 2 shared mask of the subcomponents, and finally the 2 shared mask hardware implementation of the S-box is obtained, and the RTL view is shown in Figure 5 . And compared with the mask implementation of the 8-bit unbalanced structure type S-box of the current known algorithm (Fantomas, an LS-Design cipher), the results are shown in Table 1.

[0081] Table 1 Comparison of 8-bit unbalanced structure type S-box mask consumption

[0082] S-box structure area (GE) Fantomas Misty 5,3,5 ]]> 758 configuration of the invention Bridge 3,4,5 ]]> 696

[0083] The above describes the best embodiment of the present application, wherein the parts not described in detail are all the common knowledge of ordinary skilled in the art. The protection scope of the present application is subject to the content of the claims, and any equivalent transformation based on the technical inspiration of the present application is also within the protection scope of the present application.

Claims

1. A 2-sharing mask method of a structured S-box, characterized in that, The method comprises the following steps: Step 1: to structure type S box , determine the overall S box cryptographic property requirements, further determine the sub-component S3, S4, S5 cryptographic property requirements, search for sub-component S3, S4 and S5 that meet the cryptographic properties, apply the low latency sub-component search algorithm proposed in the application, search for sub-component S3, S4 and S5 that meet the cryptographic properties; determine the construction form of the single coordinate function of the sub-component; based on The structural features of the structure: the uniformity of the sub-component S4 does not affect the overall uniformity of the S box, for S3 and S5, according to the algebraic normal form ANF of the coordinate function of the searched sub-component, determine the affine equivalence class to which the coordinate function belongs, the affine matrix, according to the affine equivalence class and the affine matrix, perform 2 shared mask on the sub-component, for S4, directly analog DOM mask, give 2 shared mask scheme; Step 2: Apply the input mask to sub-components S3, S5 , to get the output mask , then apply the structure type 2 shared mask to get the output mask: and the extended output mask: , the final output is denoted as , take the direct 2 shared mask for sub-component S4; finally, combine all sub-components according to the structure of the S-box to realize the 2 shared mask of the S-box; Step 3: writing final RTL level code according to a mask scheme using a hardware description language, designing a sub-module according to a sub-component, and the function of the sub-module is to realize 2 shared masks of the sub-component, and finally obtaining 2 shared mask hardware implementation of the S box.

2. The method of claim 1, A 2-share masking method of a structured S-box, characterized in that, In the step 1, the low-latency sub-component search algorithm specifically comprises the following steps: Step 1.1, determine the single coordinate function construction form of sub-components S3, S4, S5, construct the Boolean function with {AND, XOR, NOT} as the implementation base, fix the AND operand of the Boolean function as 1, that is . Wherein a, b, c are one expressions, a, b, c are collectively referred to as terms, and all one terms constructed are saved to a set ; Step 1.2, iterate through the elements in turn The middle element as the terms a, b, c and make up the Boolean function Go to step 1.3; wherein the selection of terms a, b is not repeatable when constructing the function y, and term c can be empty; after the end of the iteration, go to step 1.4; Step 1.3: For an n-bit input Boolean function, iterate through all inputs and count the number of times the output is 0. If the count is... ,but If y is a balanced function, then it is not a balanced function; otherwise, it is not. If y is not a balanced function, then proceed to step 1.2 to construct the next Boolean function. If it is a balance function, then use that function as a pre-generated function. coordinate function of function P coordinate function Each input variable subscript Generate by adding 1 in sequence When n=4, directly use the coordinate function. Generate lookup table coordinate function Save the coordinate functions of the candidate sub-components to a set Then jump to step 1.2 to construct the next Boolean function; when n≠4, according to the coordinate function Generate lookup table And determine whether it is a permutation; if it is a permutation, then change the coordinate function. Save the coordinate functions of the candidate sub-components to a set Then proceed to step 1.2 to construct the next Boolean function. If the permutation is not satisfied, proceed directly to step 1.2 to construct the next Boolean function. Step 1.4, calculation Among all the alternative subcomponents, the differential uniformity and linearity are calculated. Based on the construction characteristics of the structure-based S-box, the subcomponent that meets the requirements is selected as the final subcomponent.

3. The method of claim 1, A 2-share masking method of a structured S-box, characterized in that, The number of shared masks is 2.

Images