Differential divider based on neural network and password recovery decoding method thereof
By designing a low-deep residual module and a neural divisor with a multi-scale fully connected layer, the problem of feature extraction information loss in the prior art is solved, the accuracy and feature extraction efficiency of high-round cryptographic analysis are improved, and the false positive and false negative rates are reduced.
Patent Information
- Application Number
- CN202510691498.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-27
- Publication Date
- 2025-08-08
AI Technical Summary
The existing neural differentiators have information loss problems during feature extraction, especially when the depth of the convolution layer increases, resulting in a decrease in the discrimination ability and the accuracy of high-round cryptographic analysis is low, which limits its use in practical applications.
A residual module with lower depth was designed, and a Gelu activation function and a multi-scale fully connected layer were used, combined with softmax function and sparse classification cross entropy, and an RND differentiator was constructed for feature extraction and classification.
The feature extraction efficiency and classification accuracy of the model are improved, the false positive and false negative rates are reduced, and the accuracy is shown in high-round cryptographic analysis.
Smart Images
Figure CN120454978A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of cryptanalysis, and in particular relates to a differential distinguisher based on a neural network and a cryptanalysis method thereof. Background Art
[0002] Traditional cryptanalysis methods primarily employ methods such as multi-integer linear programming (MILP) and Boolean satisfiability problems (SAT). These methods suffer from high complexity, low automation, and low success rates when analyzing high-round symmetric cryptanalysis. Deep learning-based cryptanalysis methods offer advantages in terms of discrimination accuracy and data complexity, demonstrating broad application prospects and worthy of further research and exploration. Currently, deep learning-based differential cryptanalysis has been initially applied to various lightweight symmetric encryption algorithms in experiments, achieving significant results and demonstrating its general applicability. However, this approach still has some challenges. For example, the ability of the constructed neural network differential discriminator to distinguish ciphertext pairs still needs improvement, and the number of cipher rounds it can attack remains low, severely limiting its practical application. Neural discriminators are used to distinguish encrypted data from random data, and their performance directly impacts the accuracy of cryptanalysis. Existing neural discriminators suffer from information loss during feature extraction, especially as the depth of the convolutional layer increases, as the input of each layer depends solely on the output of the previous layer, potentially leading to a gradual loss of features from the original input. Summary of the Invention
[0003] To address the shortcomings of the existing technology, the present invention provides a neural network-based differential discriminator and its password recovery and decryption method. The present invention designs a neural differential discriminator (RND) with higher accuracy. By designing a low-depth residual module to avoid gradient vanishing and gradient explosion, the present invention uses the Gelu function to avoid the "neuron death" problem that may be caused by the Relu function. The softmax function and sparse categorical cross entropy are used to obtain a highly accurate binary output, and a multi-scale fully connected layer is used to achieve more accurate feature segmentation.
[0004] To achieve the above object, the present invention adopts the following technical solutions:
[0005] In the first aspect, the present invention provides a neural network-based differential discriminator for cryptanalysis, comprising: an input model, an initial convolution model, a convolution model, a prediction head model and an output model; the input model is used to receive a ciphertext matrix; the initial convolution model uses a single-layer convolution operation to extract the features of the ciphertext matrix in the input model; the convolution model uses multiple residual structures to deeply extract the features extracted by the initial convolution model; the prediction head model uses a multi-scale fully connected layer for prediction output, and outputs a floating-point number between 0 and 1 as the input of the output model; the output model uses a softmax function and sparse classification cross entropy for binary output, which is used to determine whether the ciphertext pair is a random ciphertext pair or a real ciphertext pair.
[0006] Optionally, the input model consists of 64 units and receives a 4×16 ciphertext matrix.
[0007] Optionally, the initial convolution model uses a single convolution layer with a convolution kernel size of 1 to extract features of the ciphertext matrix in the input model, and adds a BN layer and a Gelu activation function after the convolution layer.
[0008] Optionally, the convolution model includes multiple convolution modules connected in sequence, each convolution module is a residual structure, including 2 two-dimensional convolution layers with a convolution kernel size of 3, and a BN layer and a Gelu activation function are added after the two-dimensional convolution layer.
[0009] Optionally, the number of the convolution modules is 5, and the output F(x) of the convolution module is:
[0010]
[0011] In the formula, x represents the input of the convolution module, GELU represents the Gelu activation function, and BN γ,β Represents the bath normalization function, and Conv represents the convolution operation with a convolution kernel size of 3×3.
[0012] Optionally, the prediction head model includes multiple prediction modules connected in sequence, each prediction module adopts an MLP multi-layer perceptron, which is a fully connected layer, a BN layer and a Gelu activation function in sequence; wherein the number of neurons in the fully connected layer of the prediction modules connected in sequence decreases in sequence.
[0013] Optionally, the number of the prediction modules is 14, and the numbers of neurons thereof are 512, 448, 384, 320, 256, 192, 128, 96, 64, 48, 32, 16, 8 and 4 respectively.
[0014] Optionally, the output model is composed of a fully connected layer with 2 neurons and a softmax function in sequence.
[0015] In a second aspect, the present invention provides a password recovery and decryption method, which uses the neural network-based differential distinguisher described in the first aspect, and includes the following steps:
[0016] S1: After obtaining the N-1 round ciphertext, use the differential distinguisher to interpret it and expand it to the N round ciphertext;
[0017] S2: Set the number of recovery attacks. Each recovery attack generates multiple N rounds of ciphertexts. The ciphertext structure is obtained by flipping the neutral bit of a single ciphertext pair.
[0018] S3: Search for N rounds of ciphertext structures, set the maximum number of iterations, and use the UCB algorithm to select a ciphertext structure with the highest current priority in each iteration;
[0019] S4: Decrypt the selected ciphertext structure using the Bayesian optimization algorithm. In each Bayesian optimization iteration, multiple candidate keys are used to decrypt all ciphertext pairs in the ciphertext structure. The decrypted ciphertext is scored using a differential distinguisher as the score of the corresponding key. The key used in the last iteration and the corresponding score are output.
[0020] S5: The first key with a score exceeding the set threshold is used as the key for round N; steps S4 to S5 are repeated to process the N-1 round ciphertext structure, and the first key with a score exceeding the set threshold is used as the key for round N-1; the two keys for round N and round N-1 are output as guessed keys;
[0021] S6: Calculate the bit difference between the guessed key and the real key to determine whether the key recovery is successful.
[0022] Optionally, in step S4, for the next Bayesian optimization iteration, the Euclidean distance of each candidate key whose difference with the key used in the current iteration is within a set range is calculated, and multiple keys with the smallest distance are selected as the keys used in the next iteration.
[0023] The beneficial effects of the present invention are:
[0024] (1) The present invention designs a residual module with a relatively low depth, which effectively avoids the problem of vanishing gradient and exploding gradient that may occur in an overly deep residual network, and uses the Gule function instead of the Relu function to overcome the "neuron death" problem that may be caused by Relu.
[0025] (2) This paper designs a new prediction head model using the cross entropy loss function and the Softmax function, which effectively avoids the gradient vanishing instability problem caused by the mean square error loss function and the Sigmoid function.
[0026] (3) The present invention uses a multi-scale fully connected layer to replace the fixed-scale fully connected layer to obtain the best nonlinear fitting, thereby dividing features more accurately.
[0027] In summary, the present invention can improve the efficiency of feature extraction and the classification accuracy of the model, and has a higher accuracy and lower false positive and false negative rates when using both single ciphertext pairs and multiple ciphertext pairs. BRIEF DESCRIPTION OF THE DRAWINGS
[0028] Figure 1 This is a network structure diagram of the differential discriminator based on neural network.
[0029] Figure 2 It is the network structure diagram of the prediction head model and output model.
[0030] Figure 3 This is the logic diagram of the Speck encryption algorithm. DETAILED DESCRIPTION
[0031] The present invention will now be described in further detail with reference to the accompanying drawings.
[0032] Example 1
[0033] This embodiment proposes a differential classifier based on a neural network, whose network structure is as follows: Figure 1 As shown in the figure, it includes the input model, initial convolution model, convolution model, prediction head model, and output model. The initial convolution model, convolution model, and prediction head model all use the Gelu function, which can solve the monotonically increasing problem of the Relu activation function and improve the expressive power of the neural network.
[0034] like Figure 1 and Figure 2As shown, the input model in the differential distinguisher is used to receive ciphertext data. In the initial single ciphertext pair mode, the input model consists of 64 units and receives a ciphertext matrix with a shape of 4×16 matrix. The matrix form conforms to the arrangement of the ciphertext structure in the Sepck encryption algorithm. The input model inputs the ciphertext structure into the initial convolution model. The initial convolution model uses a single-layer convolution operation with a convolution kernel size of 1 to extract the features of the ciphertext matrix in the input layer. The purpose is to imitate the XOR operation in the cryptographic operation. Because the XOR operation cannot be performed in the neural network, the convolution layer performs convolution learning on the four bits that are XORed with each other in the cryptographic operation to extract the features. The BN layer and Gelu activation function are added after the convolution layer. Next, a convolutional model was used to enhance the feature extraction capabilities of the overall neural network differential discriminator. This convolutional model uses 10 residual structures, leveraging the residual link properties of these structures to preserve and deeply extract the original features of the ciphertext structure. Each residual structure consists of two two-dimensional convolutional layers with a kernel size of 3, followed by a batch normalization layer and a Gelu activation function. The prediction head model uses an MLP multi-layer perceptron for prediction output, outputting a floating-point number between 0 and 1 as input to the output model. The output model then uses the softmax function and sparse categorical cross entropy to perform a binary classification output. If the value is less than 0.5, the ciphertext pair is considered random; otherwise, it is a true ciphertext pair.
[0035] This example uses the optuna intelligent parameter optimization tool to determine that the optimal discrimination effect is achieved when the number of residual structures is 5. Therefore, the convolution model consists of 5 convolution blocks F(x), the output of which can be obtained by formula (1):
[0036]
[0037] Where Conv(x) represents the convolution operation with a convolution kernel size of 3×3, BN γ,β () represents the bath normalization function defined by formula (2):
[0038]
[0039] Here, γ and β are parameters, and ∈ is infinitesimal. GELU() represents the activation function GELU defined by equation (3):
[0040] GELU(x)=x*P(X≤x)=x*Φ(x)(3)
[0041] where Φ(x) is the cumulative function of the Gaussian normal distribution of x.
[0042] The structures of the prediction head model and output model are as follows Figure 2As shown in the figure, in the prediction head model, multi-scale fully connected layers are used to achieve optimal nonlinear fitting, thereby more accurately dividing features. The MLP prediction network structure has 14 layers, with the number of neurons being 512, 448, 384, 320, 256, 192, 128, 96, 64, 48, 32, 16, 8, and 4, respectively. This is to enhance the prediction head model's ability to capture lost features from the convolutional model's output and increase its prediction accuracy.
[0043] Since each sample of the neural discriminator is either a differential ciphertext pair or a random ciphertext pair, this embodiment introduces a conversion layer to convert the input into two units in the output model. In addition, the Sigmod function uses the mean squared error (MSE), which causes the gradient to disappear in the deep network and is not suitable for single-label classification. The neural discriminator is used to classify a single label. To solve this problem, this embodiment replaces them with the Softmax function and sparse classification cross entropy (SCCE) in the output model.
[0044] To verify the effectiveness of this embodiment, experimental tests were conducted on different neural classifiers, and the accuracy of NDs was compared under 5-round, 6-round, and 7-round Speck 32 / 64 encryption algorithms.
[0045] 1. Experimental Setup
[0046] (1) The hyperparameters are as follows:
[0047] Number of training epochs: 200; batch size: 5000; optimization algorithm: Adam optimizer in Keras framework; loss function: mean squared error (MSE); learning rate: where α = 10 -4 , β=2·10 -3 , n=9.
[0048] (2) The data generation method is as follows:
[0049] The key, training dataset, and test dataset were generated using the Linux random number generator. The training set size was 10^7, and the test set size was 10^6. Half of the data came from encrypted plaintext pairs, with the input difference Δx = (0x0040, 0x0000), marked as 1; the other half came from encrypted random plaintext pairs, marked as 0.
[0050] 2. Experimental Results
[0051] Experiments show that the accuracy of the proposed neural discriminator RND is higher than that of the traditional discriminator, with an improvement range of 0.2% to 0.5%, which meets Gohr's evaluation criteria for neural discriminators.
[0052] In addition, the reduction of residual network depth, the optimization of activation function, and the introduction of multi-scale full connection effectively improved the efficiency of feature extraction, enabling RND to show better recognition accuracy in 5-round and 6-round Speck 32 / 64 encryption analysis. The overall computational efficiency and accuracy are still better than existing methods.
[0053] Experiments show that the new neural classifier designed in this embodiment has a high accuracy when using both single ciphertext pairs and multiple ciphertext pairs. Table 1 shows the accuracy comparison of different classifiers when using a single ciphertext pair.
[0054] Table 1 Comparison of the accuracy of different discriminators for single ciphertext pairing
[0055]
[0056] When using multiple ciphertext pairs, the accuracy of different distinguishers is shown in Table 2:
[0057] Table 2 Comparison of the accuracy of different distinguishers when aligning multiple ciphertexts
[0058]
[0059] The false negative and false positive data in the Gohr discriminator were distinguished using the discriminator RND proposed in this embodiment and the best known discriminator CSYY22. The results are shown in Table 3:
[0060] Table 3 Comparison of false negatives and false positives of different discriminators for different ciphertext pairs
[0061]
[0062] Table 3 shows that the RND distinguisher proposed in this embodiment can correctly identify the data that Gohr distinguished incorrectly.
[0063] From the above results, it can be seen that this embodiment has the following effects: (1) High accuracy: Due to the optimization of the network structure, activation function and loss function, the feature learning ability can be effectively improved; (2) Low false positive and false negative rates: It has lower false positive and false negative rates and can correctly identify the false negative and false positive data recognized by other discriminators.
[0064] Example 2
[0065] Based on the neural network-based differential distinguisher proposed in Example 1, this embodiment proposes a password recovery and decryption method. In a key recovery attack, the password distinguisher of rounds 6 and 7 is used to perform password recovery and decryption. The specific process is as follows:
[0066] (1) Set the two-round preset difference (0x211, 0xa04) → (0x40, 0), that is, select the plaintext pair with the difference (0x211, 0xa04), and obtain the high-probability difference (0x40, 0) after two rounds of encryption, with a probability of 2 -6 , extending 7 rounds to 9 rounds;
[0067] (2) After the modular addition operation is added to the key of Speck encryption, the difference change in the first round can be predicted, so that the property of extending one round without consumption can be achieved, so that the 9-round differential distinguisher can be extended to 10 rounds without consumption; the Speck encryption algorithm is as follows Figure 3 shown.
[0068] (3) In the key recovery attack, the key is required to decrypt N rounds of ciphertext pairs. Therefore, after obtaining N-1 rounds of ciphertext, the differential distinguisher is used for interpretation. Therefore, after 10 rounds, one more round can be extended to reach 11 rounds.
[0069] (4) Set the number of recovery attacks to 100. In each recovery attack, generate 100 11-round ciphertext structures. Each ciphertext structure is obtained by flipping the neutral bit of a single ciphertext pair. By flipping 6 bits in a single ciphertext pair, a ciphertext structure containing 64 ciphertext pairs can be obtained. 100 ciphertext structures are generated, and the 6 neutral bits are {20, 21, 22, 14, 15, 23}.
[0070] (5) Search the ciphertext structure of the current round. The maximum number of iterations is set to 500. In each iteration, the UCB algorithm is used to select a ciphertext structure with the highest current priority. The first ciphertext structure is selected for the first iteration.
[0071] (6) Decryption scores are performed on the selected ciphertext structure using the Bayesian optimization algorithm, iterating five times. In each Bayesian optimization iteration, all ciphertext pairs are decrypted using the selected 32 candidate keys, with the first key being randomly selected. Decryption is performed using the selected key, and the decrypted ciphertext is scored using the discriminator. The key score and the mean of the discriminator scores are calculated using formula (4).
[0072]
[0073] (7) Calculate the Euclidean distance scores of each candidate key with respect to the 32 keys (the difference value range is [0, 2^16]), and take the first 32 keys with the smallest distance as the keys to be used in the next iteration; in this way, for the last round of subkeys, each ciphertext structure only needs to try 160 candidate subkeys, and then output the used keys after scoring.
[0074] (8) For those who score more than C 11= 10 candidate keys to proceed to the next step, jump back to step (4), and proceed to the next round of processing. Use the Bayesian optimization algorithm again to recommend 160 10-round candidate keys and calculate the corresponding scores. If the score exceeds C 10 =10, then the two keys selected are considered to be the guessed keys.
[0075] (9) Calculate the bit difference between the guessed key and the real key to determine whether the key recovery is successful.
[0076] To verify the effectiveness of this embodiment, the neural network differential distinguisher was applied to the cipher cracking of 11 rounds of Speck encryption. A total of 100 key recovery attacks were performed, divided into 4 rounds, i.e., 25 key recovery attacks were performed each time. The recovery effect is shown in Table 4:
[0077] Table 4 Key recovery attack accuracy
[0078]
[0079]
[0080] As shown in the table, the discriminator used in this embodiment achieved a 59% success rate in actual key cracking, compared to the 52.1% success rate of the basic discriminator, demonstrating a significantly higher cracking accuracy. This embodiment effectively alleviates the low accuracy of current deep learning-based differential cryptanalysis schemes for reduced-round ciphers, which prevents high-accuracy key cracking in key recovery attacks.
[0081] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions based on the principles of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should be considered within the scope of protection of the present invention.
Claims
1. A differential discriminator based on a neural network for cryptanalysis, characterized in that include: Input model, initial convolution model, convolution model, prediction head model and output model; the input model is used to receive the ciphertext matrix; The initial convolution model uses a single-layer convolution operation to extract features of the ciphertext matrix in the input model; the convolution model uses multiple residual structures to deeply extract the features extracted by the initial convolution model; The prediction head model uses a multi-scale fully connected layer for prediction output, outputting a floating-point number between 0 and 1 as the input of the output model; the output model uses a softmax function and sparse classification cross entropy for binary output, which is used to determine whether the ciphertext pair is a random ciphertext pair or a real ciphertext pair.
2. The neural network-based differential classifier according to claim 1, wherein: The input model consists of 64 units and receives a 4×16 ciphertext matrix.
3. The neural network-based differential classifier according to claim 1, wherein: The initial convolution model uses a single convolution layer with a convolution kernel size of 1 to extract the features of the ciphertext matrix in the input model, and adds a BN layer and a Gelu activation function after the convolution layer.
4. The neural network-based differential classifier according to claim 1, wherein: The convolution model includes multiple convolution modules connected in sequence, each of which is a residual structure, including two two-dimensional convolution layers with a convolution kernel size of 3, and a BN layer and a Gelu activation function are added after the two-dimensional convolution layer.
5. The neural network-based differential classifier according to claim 4, wherein: The number of convolution modules is 5, and the output of the convolution module ×(x) is: In the formula, x represents the input of the convolution module, GELU represents the Gelu activation function, and BN γ,β Represents the bath normalization function, and Conv represents the convolution operation with a convolution kernel size of 3×3.
6. The neural network-based differential classifier according to claim 1, wherein: The prediction head model includes multiple prediction modules connected in sequence, each prediction module adopts an MLP multi-layer perceptron, which is a fully connected layer, a BN layer and a Gelu activation function in sequence; wherein the number of neurons in the fully connected layers of the prediction modules connected in sequence decreases in sequence.
7. The neural network-based differential classifier according to claim 6, wherein: The number of the prediction modules is 14, and the numbers of neurons thereof are 512, 448, 384, 320, 256, 192, 128, 96, 64, 48, 32, 16, 8 and 4, respectively.
8. The neural network-based differential classifier according to claim 1, wherein: The output model is composed of a fully connected layer with 2 neurons and a softmax function in sequence.
9. A password recovery and decryption method, using the neural network-based differential distinguisher according to any one of claims 1 to 8, characterized in that: The steps include: S1: After obtaining the N-1 round ciphertext, use the differential distinguisher to interpret it and expand it to the N round ciphertext; S2: Set the number of recovery attacks. Each recovery attack generates multiple N rounds of ciphertexts. The ciphertext structure is obtained by flipping the neutral bit of a single ciphertext pair. S3: Search for N rounds of ciphertext structures, set the maximum number of iterations, and use the UCB algorithm to select a ciphertext structure with the highest current priority in each iteration; S4: Decrypt the selected ciphertext structure using the Bayesian optimization algorithm; In each Bayesian optimization iteration, multiple candidate keys are used to decrypt all ciphertext pairs in the ciphertext structure. The decrypted ciphertext is scored using a differential distinguisher as the score of the corresponding key. The key used in the last iteration and the corresponding score are output. S5: The first key with a score exceeding the set threshold is used as the key for round N; steps S4 to S5 are repeated to process the N-1 round ciphertext structure, and the first key with a score exceeding the set threshold is used as the key for round N-1; the two keys for round N and round N-1 are output as guessed keys; S6: Calculate the bit difference between the guessed key and the real key to determine whether the key recovery is successful.
10. A password recovery and decryption method according to claim 9, characterized in that: In step S4, for the next Bayesian optimization iteration, the Euclidean distance of each candidate key whose difference with the key used in the current iteration is within a set range is calculated, and the keys with the smallest distance are selected as the keys used in the next iteration.