Security analysis method and system for virtual shuffling aiming at misuse of bit slices
By combining statistical linear decoding analysis (SLDA) with trace filtering and probabilistic key hypothesis evaluation, the security problem of virtual shuffling due to bit slice misuse was solved, enabling efficient identification and assessment of the security risks of virtual shuffling, and improving the security and analysis efficiency of virtual shuffling.
Patent Information
- Application Number
- CN202511097512.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-06
- Publication Date
- 2025-12-12
AI Technical Summary
In existing technologies, virtual shuffling due to bit slice misuse poses security risks in practical applications, especially when implemented using IF-ELSE discriminative methods, which significantly reduces the security of virtual shuffling and lacks effective assessment methods to identify and mitigate these vulnerabilities.
By employing Statistical Linear Decoding Analysis (SLDA) combined with trace filtering and probabilistic critical hypothesis evaluation, and through the screening of counter arrays and trace groups, the risk of misuse of bit slice virtual shuffling in IF-ELSE implementation is efficiently identified. The counter array records the number of key recommendations, and the correct key is identified through LDA operations and counter array traversal.
Effectively identify and assess the risk of virtual shuffling due to bit slice misuse, reduce computational complexity, improve the efficiency of security analysis, and significantly enhance the security of virtual shuffling.
Smart Images
Figure CN121125164A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application belongs to the technical field of security evaluation of encryption algorithm, and particularly relates to a security analysis method and system for virtual shuffling against bit-slicing misuse. BACKGROUND
[0002] The statements in this section merely provide background information related to the present application and do not necessarily constitute the prior art.
[0003] White-box cryptography aims to protect the security of keys implemented in an environment exposed to potential attackers. Early white-box designs were broken by automated attacks such as differential computation analysis (DCA), which exploits the correlation between intermediate variables and predicted values of sensitive variables. This prompted the adoption of masking schemes that employ side-channel analysis techniques, particularly the Ishai-Sahai-Wagner (ISW) masking scheme, to eliminate these correlations. Although initially resilient, linear algebraic attacks such as linear decoding analysis (LDA) have shown that pure linear masking remains vulnerable in a white-box environment.
[0004] To address these limitations, non-linear masking schemes have emerged. The BU masking scheme introduces a quadratic decoding function, and the SEL scheme combines linear and non-linear sharing, both of which aim to resist DCA and LDA by increasing algebraic complexity.
[0005] Nevertheless, advanced attacks such as high-order differential computation attacks (HODCA), high-order decoding analysis (HDDA), and methods based on noisy learning parity (LPN) have revealed that improving security parameters often leads to an exponential increase in computational cost.
[0006] Virtual shuffling, proposed at Eurocrypt 2021, is widely considered one of the most secure white-box implementations. This technique inserts redundant computation slots and randomizes their execution order, and by combining virtual operations with pseudo-random permutations, virtual shuffling has been proven to resist d-degree algebraic attacks.
[0007] Both virtual shuffling and masking techniques are implemented at the Boolean gate level, and although these countermeasures can effectively prevent various attacks, they inevitably increase performance overhead, resulting in increased encryption latency.
[0008] In 2022, Rivain and Udovenko released wboxkit, an open-source toolkit for cryptographic design and analysis, which includes a secure bit-slicing virtual shuffling variant.
[0009] Due to factors such as confidentiality and ownership, many practitioners may choose not to use this publicly available tool, but instead directly extend the bit-slice technique to virtual shuffling, using IF-ELSE statements for main slot selection, resulting in non-random selection, although this constitutes misuse, but in practice it is widely used. Therefore, in the process of reproducing the work, users may inadvertently introduce security-compromising errors, which raises key questions about the broader applicability of bit-slice virtual shuffling and highlights the need to evaluate its design principles and implementation constraints to mitigate potential vulnerabilities in practical scenarios. SUMMARY
[0010] To solve the technical problems existing in the background art, the present application provides a security analysis method and system for misuse of virtual shuffling of bit slices, which combines trace filtering and probability key hypothesis evaluation to maximize information extraction from scarce data, and can efficiently identify the risk of misuse of bit-slice virtual shuffling in IF-ELSE implementation.
[0011] To achieve the above-mentioned purpose, the present application adopts the following technical solutions: The first aspect of the present application provides a security analysis method for misuse of virtual shuffling of bit slices, which comprises: Creating a counter array containing a plurality of elements, and the index of each element corresponds to the value of a candidate key; For virtual shuffling, a plurality of trace groups are collected, and for each trace group, valid traces are filtered out, and if the number of valid traces is less than a threshold value, the trace group is discarded; For the retained trace group, LDA operation is performed to obtain a recommended key set, and for each candidate key in the recommended key set, the value of the corresponding index position of the counter array is incremented by one; After all the trace groups are processed, the counter array is traversed to find the key with the highest count as the correct key, the count of the correct key is counted, and the actual recommended number of times of the correct key is obtained.
[0012] Further, when the target mask scheme is linear, the number of valid traces is equal to the total number of traces.
[0013] Further, when the target mask scheme is a nonlinear mask scheme, and its decoding function is a high-order polynomial, the number of valid traces is .
[0014] Further, if the number of valid traces of a trace group is , the trace group is discarded, wherein W is the number of consecutive nodes contained in the window corresponding to each trace.
[0015] The second aspect of the present application provides a security analysis system for virtual shuffle misuse of bit slices, which comprises: an initialization module configured to create a counter array, the counter array comprising a plurality of elements, and the index of each element corresponding to the value of a candidate key; a trajectory group screening module configured to, for virtual shuffle, collect a plurality of trajectory groups, for each trajectory group, screen out valid trajectories, and if the number of valid trajectories is less than a threshold value, discard the trajectory group; a key recommendation module configured to, for the retained trajectory group, perform LDA operation to obtain a recommended key set, and for each candidate key in the recommended key set, add one to the value of the corresponding index position of the counter array; a security analysis module configured to, after all trajectory groups are processed, traverse the counter array, find the key with the highest count as the correct key, and count the count of the correct key to obtain the actual recommendation times of the correct key.
[0016] Further, when the target masking scheme is linear, the number of valid trajectories is equal to the total number of trajectories.
[0017] Further, when the target masking scheme is a nonlinear masking scheme, and the decoding function thereof is a high-order polynomial , the number of valid trajectories is .
[0018] Further, if the number of valid trajectories of a certain trajectory group is , the trajectory group is discarded, wherein W is the number of consecutive nodes contained in the window corresponding to each trajectory.
[0019] The third aspect of the present application provides a computer readable storage medium having a computer program stored thereon, the program being executed by a processor to implement the steps of the security analysis method for virtual shuffle misuse of bit slices as described above.
[0020] The fourth aspect of the present application provides a computer device comprising a computer readable storage medium, a processor and a computer program stored on the computer readable storage medium and executable on the processor, the processor executing the program to implement the steps of the security analysis method for virtual shuffle misuse of bit slices as described above.
[0021] Compared with the prior art, the present application has the following beneficial effects: The present application combines trace filtering and probability key hypothesis evaluation to maximize the extraction of information from scarce data, and can efficiently identify the risk of misuse of bit slice virtual shuffle in IF-ELSE implementation. BRIEF DESCRIPTION OF DRAWINGS
[0022] The accompanying drawings, which form a part of this specification, are included to provide a further understanding of the application and are incorporated herein by reference. The embodiments illustrated in the drawings are intended to explain the aspects of the present application and are not intended to limit the present application.
[0023] Figure 1 is a flow chart of a security analysis method for virtual shuffling of bit slice misuse according to an embodiment of the present application; Figure 2 is a schematic diagram of virtual shuffling of misuse bit slice implementation according to an embodiment of the present application; Figure 3 is a schematic diagram of security vulnerability overview of virtual shuffling of bit slice misuse according to an embodiment of the present application; Figure 4 is a counting diagram of results of virtual shuffling of misuse bit slice using linear mask by SLDA according to an embodiment of the present application; Figure 5 is a counting diagram of results of virtual shuffling of correct bit slice using linear mask by SLDA according to an embodiment of the present application; Figure 6 is a counting diagram of results of virtual shuffling of misuse bit slice using non-linear mask by SFLDA according to an embodiment of the present application; Figure 7 is a counting diagram of results of virtual shuffling of correct bit slice using non-linear mask by SFLDA according to an embodiment of the present application; Figure 8 is a schematic diagram of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION
[0024] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application.
[0025] It should be noted that the following detailed description is exemplary and is intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs.
[0026] Embodiment One The present embodiment provides a security analysis method for virtual shuffling of bit slice misuse.
[0027] The embodiment provides a security analysis method for a bit slice misuse of virtual shuffle, and studies the security of applying bit slice technology to virtual shuffle. Specifically, a common misuse scenario is focused on: a user encrypts multiple groups of data in parallel, and realizes virtual shuffle by using a simple IF-ELSE discriminator. Although this constitutes a misuse, it is widely used in practice. Its popularity can be attributed to its natural derivation from bit slice implementation and consistency with standard virtual shuffle pseudocode. This misuse can cause the security of virtual shuffle to be significantly reduced.
[0028] The security analysis method for the virtual shuffle of the bit slice misuse provided by the embodiment introduces a new DCA-like attack, called statistical linear decoding analysis (SLDA), to recover the key, and the research result emphasizes the risk of the misuse of the bit slice virtual shuffle in the IF-ELSE implementation, and emphasizes the importance of independently selecting the main slot in actual deployment.
[0029] The security analysis method for the virtual shuffle of the bit slice misuse provided by the embodiment has the following specific contents: (1) Misuse model and non-randomness analysis. A common bit slice virtual shuffle misuse scenario is considered: bit slice technology is directly applied to virtual shuffle, and an IF-ELSE condition is used to determine the position of the main slot. Therefore, the analysis shows that this parallel encryption strategy will partially destroy the randomness required to select the main slot.
[0030] (2) Statistical (filtering) linear decoding analysis. In order to capture the described non-randomness, statistical linear decoding analysis (SLDA) is proposed, which is directed at the misuse pseudoshuffle implementation using linear masking. This attack is a specific application of LDA in this misuse case. In addition, as long as a suitable filtering step is introduced, the attack is still effective even under non-linear masking. For the misuse bit slice pseudoshuffle attack, the time complexity of SLDA is lower than that of HODCA and WBLPN.
[0031] As Figure 2 shown, the misuse virtual shuffle bit slice implementation includes: First, the slice transformation operation is performed.
[0032] In the encryption phase with a parallelism of , the input is processed by the slot function . The function integrates the core component with three pseudorandom functions: . In order to realize efficient parallelism and maintain function consistency (i.e. ), it is necessary to modify these components in a coordinated manner to expand the data range to the original times.
[0033] However, as described in the pseudo-wash design document, the designer uses the IF-ELSE discriminant function to determine the primary slot. Therefore, the slot index... The range remains unchanged. Main slot selection function Use input variables As the independent variable, generate the selected primary slot index. If the current slot The index equals If so, it indicates that the current slot is the primary slot. Abuse of the primary slot selection function can lead to the same group... The group encrypted data selected the same primary slot index.
[0034] A complete parallel implementation scheme, including All The path parallelization component has been implemented. Figure 2 The formal definition is as follows. Here, we continue to use the pseudocode given in the original virtual shuffling document, which includes IF-ELSE conditional statements. Therefore, this is a very natural way to implement bit-piece virtual shuffling.
[0035] Security analysis of virtual shuffling using misused bit slices: pseudo shuffling using misused bit slices can create a new security vulnerability, namely, a set of plaintexts encrypted in parallel uses the same master slot, which breaks the assumption that the master slot used to encrypt each plaintext in pseudo shuffling is independently selected.
[0036] like Figure 3 As shown, in the original non-bit-slice pseudo-shuffle, the probability of two traces sharing the same master slot index is extremely low, making it practically impossible to construct such a set of traces. However, regardless of whether a linear or non-linear masking scheme is used, bit-slice execution will create a scenario where the same master slot trace set can be exploited: (1) Linear masking: When using a linear masking scheme without obfuscation, if the sliding window size is significantly smaller than the group size, an LDA attack can directly recover the key. This condition is easily satisfied because: (a) LDA typically runs with a small window size; (b) Parallelizing encryption batches (e.g., 64 or 32 blocks) ensures that the maximum size of the trace group is 64 or 32, which is large enough for LDA attacks.
[0037] (2) Nonlinear Masking: While traditional LDA attacks have been proven ineffective against nonlinear masking schemes, filtering attacks offer a viable solution by systematically eliminating nonlinear terms through trace filtering. However, this approach degrades data availability exponentially—the number of available traces is halved for each higher-order polynomial term removed, especially when there are... When there are 10 polynomial terms, the remaining trace is only about 1 / 3 of the original trace. .
[0038] A concrete example appears in a SEL mask with a single higher-order term: despite processing 64 blocks in parallel, the effective group size is reduced to 32. In this case, the success of the attack depends on whether each group has enough effective traces relative to the window size—which is often not met in practice.
[0039] To overcome these data limitations, an SLDA attack is proposed, an innovative framework that combines trace filtering with probabilistic key hypothesis evaluation to maximize the extraction of information from scarce data.
[0040] The trajectory used in each experiment was different, and the key with the most recommended frequency was correct. More precisely, after collecting... After grouping the trajectories, each group contains 3 trajectories, each trajectory corresponding to a 4-dimensional object containing 3 trajectories. A specific window of consecutive nodes.
[0041] This embodiment provides a security analysis method for virtual shuffling to address bit slice misuse, such as... Figure 1 As shown, it includes the following steps: Step 1: Create a counter array and set each element to 0. This counter array contains... Each element has an index corresponding to the number of times a candidate key has been recommended. For example, if the candidate keys are 0-255 (assuming an 8-bit key), the array would have 256 elements, with indices 0-255 corresponding to each candidate key and values recording the number of times it has been recommended.
[0042] Step 2: For each trajectory group, perform the following operations: (1) From all Valid trajectories are selected from the available trajectories.
[0043] When the target masking scheme is linear, the effective trace number equal to the total trace ; When the target is a nonlinear masking scheme, and its decoding function is When there are several higher-order polynomials, the effective trace is... Approximately (The exact number is uncertain).
[0044] (2) If If the condition is met, discard the trajectory group and proceed directly to the next trajectory group; otherwise, perform the following operations: use Perform LDA operations on the valid traces to obtain the recommended key set. ; For each candidate key in the recommended key set The corresponding index position value of the counter array Add 1.
[0045] Here, W represents the window size, and its value in the specific implementation depends on the white-box design scheme. In practice, the sharing of multiple sensitive variables is usually clustered within a narrow range of indices in the computational trajectory. This property allows the attack scope to be limited from the entire trajectory to a local sliding window. Therefore, the window selects a portion of the computational trajectory, which significantly reduces computational complexity while maintaining the effectiveness of the attack. Formally, for the trajectory... Attackers only need to do this at each sliding position Analyze a size of window ,in .
[0046] Step 3: After processing all trajectory groups, iterate through the counter array and find the key with the highest count among all windows (here, a window can be understood as a part of the calculated trajectory). Return the key with the highest count among all windows as the correct key. Essentially, each window has its own counter array, and the key corresponding to the maximum value in all counter arrays is considered the correct key and returned.
[0047] Step 4: Count the number of correct keys to obtain the actual number of times the correct key is recommended. The larger the difference between the number of times the correct key is recommended and the number of times the incorrect key is recommended, the worse the security of virtual shuffling due to bit slice misuse.
[0048] This embodiment provides a security analysis method for virtual shuffling (SLDA) to address bit slice misuse, specifically designed for scenarios where the number of valid tracks per group slightly exceeds the window size. In this case, correct keys are recommended, but incorrect keys cannot be completely filtered out. More precisely, the candidate key set, window size, and number of valid tracks per group are respectively represented as follows: The applicable conditions for this scenario can be expressed as follows: ; in, express Size.
[0049] Due to the limitations of bit-slicing parallelism, the number of trajectories in each group is insufficient, and it is estimated that approximately [number missing] will remain. An incorrect key.
[0050] Assuming a window contains all linear shares, virtual shuffling is implemented using... One slot; the correct key will be recommended in the following two cases: The slot where this window is located is selected as the primary slot. The probability of this happening is... Once this happens, the real key will be recommended; The slot for window positioning is not the main slot; the probability of this happening is... The recommended probability for the correct key is... .
[0051] However, for incorrect keys, the recommended probability is always 1. Therefore, in carrying out After this experiment, the correct key will be recommended on average. The recommended probability for an incorrect key is... .
[0052] Therefore, the correct key is expected to be recommended more often than the incorrect key. The deviation between the correct and incorrect keys is: ; Furthermore, the required number of trace groups is: ; Therefore, the total number of traces required is .
[0053] The time complexity of SLDA is determined by the complexity of combinatorial LDA (or FLDA), and its complexity is similar to that of SLDA. The time complexity is linearly related to the original complexity. Therefore, the time complexities of SLDA and SFLDA are respectively... and It outperforms attacks such as WBLPN and HODCA, as shown in Table 1.
[0054] Table 1. Comparison of Time Complexity
[0055] For window size of A comparison of the time complexity of performing white-box attacks on each node. The matrix multiplication exponent. and These represent linear and nonlinear shared counting, respectively. This represents the WBLPN noise rate. For Mask, noise rate The calculation formula is: ;for Mask, noise rate The calculation formula is: .
[0056] To verify the theoretical framework of this embodiment, a comprehensive simulation experiment was conducted using a virtual shuffling implementation of the AES method. Specifically, parallel encryption across four time slots was simulated, and power consumption traces were captured during execution. These traces were then analyzed using SLDA to recover the first byte of the key.
[0057] Attacks on two different bit-pie virtual shuffling implementations were evaluated: (i) abusive bit-pie virtual shuffling and (ii) normal bit-pie virtual shuffling. Analysis was conducted under both linear and nonlinear masking conditions. As a sensitive variable for the target, random numbers are used to simulate non-sensitive intermediate variables to improve computational efficiency, and only the first 18% of the trajectories are used during the attack phase.
[0058] (1) SLDA based on virtual rearrangement of linear mask.
[0059] For linear masking scenarios, the ISW solution was adopted. .
[0060] Each experimental group contains The tracks share the same main slot, and the sliding window size is [size missing]. Since there are no higher-order polynomial terms in the linear mask, each group approximately yields... One valid trajectory. Processing. After grouping, the results are as follows Figure 4 and Figure 5 As shown, the horizontal axis represents the trajectory index of the starting point of the window, and the vertical axis represents the number of solutions in the current window.
[0061] Figure 4 A successful case study of key recovery in a misused bit slice implementation is presented, where the correct key (blue) has a significantly higher solution count in the critical window than the incorrect candidate key (grey). Conversely, Figure 5 The security of normal bit-chip pseudo-shuffling was confirmed, but the correct and incorrect keys were still difficult to distinguish.
[0062] (2) SFLDA analyzes virtual mixing using nonlinear masks.
[0063] The SEL scheme was implemented in nonlinear masking scenarios. .
[0064] Each group contains The bar has a trajectory that matches the main slot, and the window size remains unchanged. Filtering attacks effectively eliminate higher-order terms. Each group produces approximately One valid trajectory. The results after the group revealed a pattern similar to linear attacks, such as Figure 6 and Figure 7As shown.
[0065] like Figure 6 and Figure 7 As shown, the successful key recovery attack demonstrates that pseudo-shuffling implementations that abuse nonlinear masks remain vulnerable to SLDA attacks.
[0066] Example 2 This embodiment provides a security analysis system for virtual shuffling to address bit slice misuse, which specifically includes: The initialization module is configured to: create a counter array containing several elements, where the index of each element corresponds to the value of the candidate key; The trajectory group filtering module is configured to: collect several groups of trajectories for virtual shuffling; for each trajectory group, filter out valid trajectories; if the number of valid trajectories is less than a threshold, discard the trajectory group. The key recommendation module is configured to: perform LDA operation on the reserved trajectory group to obtain a recommended key set; and for each candidate key in the recommended key set, increment the value at the index position of the corresponding counter array by one. The security analysis module is configured to: after all trajectory groups have been processed, traverse the counter array, find the key with the highest count as the correct key, count the correct key, and obtain the actual number of times the correct key is recommended.
[0067] Furthermore, when the target masking scheme is linear, the number of effective traces equals the total number of traces.
[0068] Furthermore, when the target masking scheme is a nonlinear masking scheme, and its decoding function is When there are several higher-order polynomials, the effective trace number is .
[0069] Furthermore, if the number of valid traces in a certain trajectory group If W is not found, the trajectory group is discarded, where W is the number of consecutive nodes contained in a specific window corresponding to each trajectory.
[0070] It should be noted that each module in this embodiment corresponds one-to-one with each step in Embodiment 1, and their specific implementation processes are the same, so they will not be repeated here.
[0071] Example 3 This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in the security analysis method for virtual shuffling of bit slice misuse as described in Embodiment 1 above.
[0072] Example 4 This embodiment provides a computer device, such as... Figure 8As shown, the system includes a display device, an input device, a computer-readable storage medium (volatile memory and non-volatile storage medium), a processor, a communication interface (i.e., a network interface), and a computer program stored on the computer-readable storage medium and executable on the processor. The processor, communication interface, and computer-readable storage medium are connected via a bus or other means. The communication interface is used to receive and transmit data, and when the processor executes the program, it implements the steps in the security analysis method for virtual shuffling of bit slice misuse described in Embodiment 1 above.
[0073] Any references to memory, storage, database, or other media used in this application and embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual-rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.
[0074] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0075] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxesFigure 1 The function specified in one or more boxes.
[0076] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0077] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. A security analysis method for virtual shuffling of bit slices due to misuse, characterized in that, include: Create a counter array containing several elements, where the index of each element corresponds to the value of the candidate key; For virtual shuffling, several sets of trajectories are collected. For each set of trajectories, valid trajectories are filtered out. If the number of valid trajectories is less than the threshold, the set of trajectories is discarded. For the retained trajectory group, perform LDA operation to obtain the recommended key set. For each candidate key in the recommended key set, increment the value at the index position of the corresponding counter array by one. After processing all trajectory groups, iterate through the counter array, find the key with the highest count as the correct key, count the correct key, and obtain the actual number of times the correct key is recommended.
2. The security analysis method for virtual shuffling of bit slices as described in claim 1, characterized in that, When the target masking scheme is linear, the number of effective traces equals the total number of traces.
3. The security analysis method for virtual shuffling of bit slices as described in claim 1, characterized in that, When the target masking scheme is a nonlinear masking scheme, and its decoding function is When there are several higher-order polynomials, the effective trace number is .
4. The security analysis method for virtual shuffling of bit slices as described in claim 1, characterized in that, If the number of valid traces in a certain trajectory group If W is not found, the trajectory group is discarded, where W is the number of consecutive nodes contained in the window corresponding to each trajectory.
5. A security analysis system for virtual shuffling of bit slices due to misuse, characterized in that, include: The initialization module is configured to: create a counter array containing several elements, where the index of each element corresponds to the value of the candidate key; The trajectory group filtering module is configured to: collect several groups of trajectories for virtual shuffling; for each trajectory group, filter out valid trajectories; if the number of valid trajectories is less than a threshold, discard the trajectory group. The key recommendation module is configured to: perform LDA operation on the reserved trajectory group to obtain a recommended key set; and for each candidate key in the recommended key set, increment the value at the index position of the corresponding counter array by one. The security analysis module is configured to: after all trajectory groups have been processed, traverse the counter array, find the key with the highest count as the correct key, count the correct key, and obtain the actual number of times the correct key is recommended.
6. The security analysis system for virtual shuffling of bit slices as described in claim 5, characterized in that, When the target masking scheme is linear, the number of effective traces equals the total number of traces.
7. The security analysis system for virtual shuffling of bit slices as described in claim 5, characterized in that, When the target masking scheme is a nonlinear masking scheme, and its decoding function is When there are several higher-order polynomials, the effective trace number is .
8. The security analysis system for virtual shuffling of bit slices as described in claim 5, characterized in that, If the number of valid traces in a certain trajectory group If W is not found, the trajectory group is discarded, where W is the number of consecutive nodes contained in the window corresponding to each trajectory.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements the steps in the security analysis method for virtual shuffling of bit slice misuse as described in any one of claims 1-4.
10. A computer device comprising a computer-readable storage medium, a processor, and a computer program stored on the computer-readable storage medium and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the security analysis method for virtual shuffling of bit slice misuse as described in any one of claims 1-4.