Method and system for evaluating the security of a cipher based on variable partitioning of a quadratic boolean equation

Abstract

The application discloses a password security evaluation method and system based on quadratic Boolean equation variable segmentation, and belongs to the technical field of password security evaluation. The method comprises the following steps: constructing a quadratic Boolean equation set about a password algorithm to be evaluated; constructing a mixed integer linear programming model of the quadratic Boolean equation set; solving the mixed integer linear programming model based on a set target function, to obtain an optimal segmentation result of x variables in the quadratic Boolean equation set; performing quadratic Boolean equation set solving based on the segmentation result of the x variables, to obtain a plurality of groups of candidate solutions; and decrypting the ciphertext according to the candidate solutions, to obtain a security evaluation result of the password algorithm to be evaluated. The application can provide security evaluation efficiency of the password algorithm.

Description

Technical Field

[0001] This invention relates to the field of cryptographic security assessment technology, specifically to a cryptographic security assessment method and system based on variable segmentation of a quadratic Boolean equation. Background Technology

[0002] Cryptography is a core technology and fundamental support for ensuring network and information security; therefore, the security assessment of cryptographic algorithms is particularly important. Constructing a system of equations about the key bits based on the structure of the cryptographic algorithm, and then evaluating the algorithm by solving this system of equations, is a common method for cryptographic security assessment. Specifically, based on the characteristics of the cryptographic algorithm's structure, a system of quadratic Boolean equations about the key bits can be constructed, and then solved using appropriate algorithms. The following is an existing algorithm for solving quadratic Boolean equations (Crossbred algorithm).

[0003] For a given set of n variables The quadratic Boolean system of equations E(x) = f1(x) = f2(x) = ... = f m When solving (x) = 0 using the Crossbred algorithm, the n Boolean variables are first divided into two parts. Then each equation in the system of equations can be written as... l i Let y(x) be a linear expression of y, and q(y) be a quadratic expression of y. Thus, the system of equations E(x) can be written in the following form: A·(z1z2,z1z3,…,z…) u-1 z u z1, z2, ..., z u ) T =B, A is The matrix, front The elements of column A are either 0 or 1, and the elements of column u are linear expressions of y; B is a vector containing m elements, each element being a quadratic expression of y. The augmented matrix A|B is simplified to a decreasing row echelon matrix, based on the matrix's... Okay, we can get a system of linear equations A′·(z1, z2, ..., z) for z. u ) T =B′, A′ is A matrix, where each element is a linear expression of y; B′ is a matrix containing... A vector of n elements, where each element is a quadratic expression of y. Traverse... Calculate the values ​​of the expressions for y in A′ and B′. In each traversal, use Gaussian elimination to solve the linear equations about z to obtain candidate solutions, and then substitute the candidate solutions back into the original equations for verification.

[0004] It can be seen that this algorithm involves variable partitioning during the solution process. The original algorithm for solving quadratic Boolean equations partitions variables arbitrarily without considering their relationships within the equations, resulting in suboptimal solution complexity. This leads to low efficiency in cryptographic security assessment. Summary of the Invention

[0005] This invention provides a cryptographic security assessment method and system based on variable segmentation of quadratic Boolean equations. It segments variables by the relationship between them in the equation, effectively reducing the complexity of the Crossbred algorithm for solving quadratic Boolean equations, thereby improving the efficiency of cryptographic security assessment.

[0006] To achieve the above objectives, the technical solution of the present invention includes the following contents.

[0007] A cryptographic security assessment method based on variable partitioning of a quadratic Boolean equation, the method comprising:

[0008] Construct a quadratic Boolean system of equations for the cryptographic algorithm to be evaluated; wherein the number m of equations in the quadratic Boolean system is determined based on the bit length of the ciphertext generated by the cryptographic algorithm to be evaluated, and the number n of x variables in the quadratic Boolean system is determined based on the key bit length of the cryptographic algorithm to be evaluated.

[0009] Construct a mixed-integer linear programming model for the quadratic Boolean equation system; wherein, the mixed-integer linear programming model is used to replace the x variable in the quadratic Boolean equation system with y and z variables;

[0010] The mixed-integer linear programming model is solved based on the set objective function to obtain the optimal partitioning result of the x variable in the quadratic Boolean equation system.

[0011] Based on the segmentation results of the x variable, a system of quadratic Boolean equations is solved to obtain several candidate solutions;

[0012] The ciphertext is decrypted using the candidate solution as a key, and the security evaluation result of the cryptographic algorithm to be evaluated is obtained.

[0013] Furthermore, a system of quadratic Boolean equations is constructed based on the cipher to be evaluated, including:

[0014] Obtain the plaintext and the ciphertext obtained by encrypting the plaintext using the cryptographic algorithm to be evaluated;

[0015] Using the plaintext, construct m nonlinear polynomials containing variables x;

[0016] Based on the structure of the cryptographic algorithm to be evaluated, each nonlinear polynomial is transformed to obtain the final set of nonlinear polynomials.

[0017] Set the final set of nonlinear polynomials to the ciphertext to obtain a set of quadratic Boolean equations.

[0018] Furthermore, a mixed-integer linear programming model for this quadratic Boolean equation system is constructed, including:

[0019] Define the variables in the mixed-integer linear programming model based on the quadratic Boolean equations;

[0020] Add constraints between variables;

[0021] By combining the variables and constraints between variables in the mixed-integer linear programming model, a combined-integer linear programming model is generated.

[0022] Furthermore, based on the quadratic Boolean equations, the variables in the mixed-integer linear programming model are defined as follows:

[0023] Define an integer variable u to represent the number of variables z;

[0024] Define a binary variable d[j] to represent whether the j-th x-th variable in each quadratic Boolean equation is a y-th variable or a z-th variable;

[0025] Define a binary variable n_f[i] to indicate whether the i-th quadratic Boolean equation is a linear equation with respect to the z variable;

[0026] Define a binary variable l[i, j, k] to represent the quadratic term x in the i-th equation. j x k Is it a quadratic term with respect to the variable z?

[0027] Define a binary variable q_y[i] to represent whether there is a quadratic term in the i-th equation with respect to the variable y;

[0028] Define an integer variable z_y[i] to represent the number of quadratic terms in the product of z and y in the i-th equation;

[0029] Define an integer variable g_e to represent the complexity of solving a system of linear equations with respect to the z variable using Gaussian elimination.

[0030] Furthermore, constraints are added between variables, including:

[0031] Add constraint S1 between variables n_f[i] and l[i,j,k], wherein constraint S1 includes: requiring variable n_f[i] = 1 if and only if for any two variables n_f[i] = 1. If variable l[i, j, k] = 1, then variable n_f[i] = 0;

[0032] Add constraint S2 between variable u and variable n_f[i], wherein constraint S2 includes: the value of variable u is less than the number of equations in which variable n_f[i] = 1;

[0033] Add constraint S3 between variables d[j] and l[i,j,k], wherein constraint S3 includes:

[0034] For j, k∈{1,2,…,n}, if d[j]=d[k]=0, then the variable l[i,j,k]=0;

[0035] For j,k∈{1,2,…,n}, if d[j]≠d[k], then the variable l[i,j,k]=1;

[0036] For j, k∈{1,2,…,n}, if d[j]=d[k]=1, then the variable l[i,j,k]=1;

[0037] Add constraint S4 between variable d[j] and variable q_y[i], wherein constraint S4 includes:

[0038] right If d[j] = d[k] = 0, then the variable q_y[i] = 0;

[0039] right If d[j]≠d[k], then the variable q_y[i]=0;

[0040] like If d[j] = d[k] = 1, then the variable q_y[i] = 1;

[0041] Add constraint S5 between variable d[j] and variable z_y[i], wherein constraint S5 includes: requiring the value of variable z_y[i] of the i-th equation to be equal to the number of quadratic terms of variable y multiplied by variable z;

[0042] Add constraint S6 between variables g_e, n_f[i], and u, wherein constraint S6 includes: variables m represents the number of quadratic Boolean equations;

[0043] Add constraint S7 between variable d[j] and variable u, wherein constraint S7 includes: variable

[0044] Furthermore, the process of generating the objective function includes:

[0045] In the quadratic Boolean equations with variable n_f[i] = 1, count the number of equations with variable q_y[i] = 1, qy_num.

[0046] Count the number of equations where the variable q_y[i] = 0 in the quadratic Boolean equations where the variable n_f[i] = 1;

[0047] In the quadratic Boolean equation with variable n_f[i] = 1, count the number of quadratic terms ly_num of the product of variable z and variable y;

[0048] The minimum time complexity of the Crossbred algorithm for solving quadratic Boolean equations is MIN(2). n-u ·((nu)·qy_num+ly_num+zy_num+g_e)) is used as the objective function.

[0049] Furthermore, based on the segmentation results of the x variable, a system of quadratic Boolean equations is solved to obtain several candidate solutions, including:

[0050] Traverse the value space of variable y so that the quadratic Boolean equation of variable n_f[i] = 1 forms a system of linear equations about variable z;

[0051] Gaussian elimination is used to solve the system of linear equations involving the z variable to obtain the values ​​of the x variable involved in the system of linear equations.

[0052] The values ​​of the x variables involved in the linear equation system and the values ​​of the x variables involved in traversing the y variables are brought back to the quadratic Boolean equation system for verification. After successful verification, a set of candidate solutions is obtained.

[0053] A cryptographic security assessment system based on variable partitioning of quadratic Boolean equations, the system comprising:

[0054] The equation system construction module is used to construct a quadratic Boolean equation system about the cryptographic algorithm to be evaluated; wherein the number m of the equation system is determined based on the bit length of the ciphertext generated by the cryptographic algorithm to be evaluated, and the number n of the x variables in the quadratic Boolean equation system is determined based on the key bit length of the cryptographic algorithm to be evaluated.

[0055] The model building module is used to construct a mixed-integer linear programming model for this quadratic Boolean equation system; wherein, the mixed-integer linear programming model is used to replace the x variable in the quadratic Boolean equation system with y and z variables;

[0056] The variable segmentation module is used to solve the mixed-integer linear programming model based on the set objective function, and obtain the optimal segmentation result of the x variable in the quadratic Boolean equation system.

[0057] The equation solving module is used to solve a system of quadratic Boolean equations based on the segmentation results of the x variable, and obtain several candidate solutions.

[0058] The cryptographic evaluation module is used to decrypt the ciphertext using the candidate solution as a key, and obtain the security evaluation result of the cryptographic algorithm to be evaluated.

[0059] An electronic device, characterized in that the electronic device comprises: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the cryptographic security assessment method based on variable segmentation of quadratic Boolean equations as described above.

[0060] A computer-readable storage medium, characterized in that the computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the cryptographic security assessment method based on variable segmentation of a quadratic Boolean equation as described above.

[0061] Compared with the prior art, the present invention has at least the following beneficial effects.

[0062] 1) This invention describes the flow of the original algorithm through variables and constraints, which can clearly model the Crossbred algorithm for solving quadratic Boolean equations, making it convenient to search for the optimal parameters later.

[0063] 2) This invention uses mixed-integer linear programming for modeling and automated analysis, which can save the cost of manual analysis and avoid the errors that occur in the manual analysis process and the risk of not finding the optimal solution.

[0064] 3) This invention improves the security assessment efficiency of cryptographic algorithms by efficiently solving the quadratic Boolean equation system. Attached Figure Description

[0065] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0066] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, and to make the objectives, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0067] The cryptographic security assessment method based on variable segmentation of quadratic Boolean equations of the present invention mainly consists of five parts: construction of a system of quadratic Boolean equations, construction of a mixed integer linear programming model, solving the mixed integer linear programming model, solving the system of quadratic Boolean equations, and evaluation of cryptographic algorithms.

[0068] Specifically, the cryptographic security assessment method based on variable partitioning of a quadratic Boolean equation in this invention, such as... Figure 1 As shown, it mainly includes the following steps.

[0069] Step 1: Construct a system of quadratic Boolean equations for the cryptographic algorithm to be evaluated.

[0070] In constructing a quadratic Boolean equation system for an algorithm to be evaluated, this invention first obtains plaintext and ciphertext obtained by encrypting the plaintext using the algorithm to be evaluated. Then, it uses the plaintext to construct m nonlinear polynomials containing x variables. Based on the structure of the algorithm to be evaluated, each nonlinear polynomial is transformed to obtain the final nonlinear polynomial system. Finally, the final nonlinear polynomial system is set equal to the ciphertext to obtain the quadratic Boolean equation system.

[0071] In one embodiment, this invention represents each unknown variable in the equation as a bit of the key. Taking a block cipher with an r-round SP structure and a block length of m bits as an example, the plaintext and the whitened key are first XORed. Each round includes an S-box (S), a linear transformation (P), and round key addition (AK), where the S-box is a nonlinear transformation. Each bit of the key is considered an unknown variable. Given the plaintext and ciphertext, the m-bit output of each round can be represented as m nonlinear polynomials containing these unknown variables. These polynomials can be calculated using the specific structure of the S-box and the linear transformation, and then used as input for the next round. This process is iterated until the final round, where m polynomials containing these unknown variables are calculated, each corresponding to a one-bit output. Simultaneously, each bit of the final round's output is equal to a bit of the known ciphertext, thus obtaining a system of nonlinear equations. This invention can reduce the algebraic degree of these nonlinear high-order equations to quadratic through methods such as linearizing the S-box.

[0072] For example, m = 15, the key has 8 bits, n = 8, and this invention uses unknown variables x1, x2, ..., x8 to represent the 15 polynomials containing unknown variables obtained in the last round of calculation:

[0073] x1x2+x1x4+x2x3+x3x4+x1+x2+x3

[0074] x2x4+x1+x2+x3

[0075] x1x2+x2x3+x3x4+x3+x4

[0076] x2x3+x2x5+x3x4+x4x5+x2+x3+x4

[0077] x3x5+x2+x3+x4

[0078] x2x3+x3x4+x4+x5

[0079] x3x4+x3x6+x4x5+x5x6+x3+x4+x5

[0080] x4x6+x3+x4+x5

[0081] x3x4+x4x5+x5+x6

[0082] x4x5+x5x6+x6x7+x4+x5+x6

[0083] x5x7+x4+x5+x6

[0084] x4x5+x5x6+x6+x7

[0085] x5x6+x5x8+x6x7+x7x8+x5+x6+x7

[0086] x6x8+x5+x6+x7

[0087] x5x6+x6x7+x7+x8

[0088] Design secret literature 000000000000000,How far can I get to Nanamoto's book?

[0089] x1x2+x1x4+x2x3+x3x4+x1+x2+x3=0

[0090] x²x⁴+x¹+x²+x³=0

[0091] x1x2+x2x3+x3x4+x3+x4=0

[0092] x2x3+x2x5+x3x4+x4x5+x2+x3+x4=0

[0093] x3x5+x2+x3+x4=0

[0094] x²x³ + x³x⁴ + x⁴ + x⁵ = 0

[0095] x3x4+x3x6+x4x5+x5x6+x3+x4+x5=0

[0096] x4x6+x3+x4+x5=0

[0097] x3x4+x4x5+x5+x6=0

[0098] x4x5+x5x6+x6x7+x4+x5+x6=0

[0099] x5x7+x4+x5+x6=0

[0100] x4x5+x5x6+x6+x7=0

[0101] x5x6+x5x8+x6x7+x7x8+x5+x6+x7=0

[0102] x6x8+x5+x6+x7=0

[0103] x5x6 + x6x7 + x7 + x8 = 0

[0104] Step 2: Construct a mixed-integer linear programming model for this quadratic Boolean equation system.

[0105] The mixed-integer linear programming model of this invention mainly uses y and z variables to replace the x variable in the quadratic Boolean equation system. The construction process of this mixed-integer linear programming model can be divided into two parts: defining the variables in the mixed-integer linear programming model and adding the constraint relationships between the variables.

[0106] Step 2.1: Define the variables in the mixed-integer linear programming model.

[0107] The variables in the mixed-integer linear programming model defined here mainly include the flag variables introduced for each variable in the system of equations, the flag variables introduced for each equation, and the variables introduced for each quadratic term in the system of equations.

[0108] In one embodiment, defining variables in a mixed-integer linear programming model includes steps 211 to 217.

[0109] Step 211, define variable u to represent the number of z variables;

[0110] Step 212: Define a flag variable d[j], i∈{1,…,n}, for each variable in the system of equations to mark whether the j-th variable is a y variable or a z variable;

[0111] Step 213: Define a flag variable n_f[i] for each equation in the system of equations, i∈{1,…,m}, to mark whether the i-th equation is a linear equation with respect to the z variable;

[0112] Step 214: Introduce a flag variable l[i,j,k], i∈{i,…,m}, j,k∈{1,…,n}, to the quadratic terms in the system of equations, to label the quadratic term x in the i-th equation. j x k Is it a quadratic term with respect to the variable z?

[0113] Step 215: Introduce the variable q_y[i], i∈{1,…,m}, for each equation in the system of equations to indicate whether there is a quadratic term with respect to the variable y in the i-th equation;

[0114] Step 216: Introduce a variable z_y[i], i∈{1,…,m}, for each equation in the system of equations to mark the number of quadratic terms in the product of z and y in the i-th equation;

[0115] Step 217: Define the variable g_e, which represents the complexity of solving the linear equation system with respect to the z variable using Gaussian elimination.

[0116] Taking the quadratic Boolean equation system constructed in step 1 as an example, the following process is used to define the variables in the mixed-integer linear programming model.

[0117] a) Define an integer variable u to represent the number of variables z.

[0118] b) Define a binary variable d[1,2,…,8] for each variable (x1, x2,…, x8) in the quadratic Boolean equation to mark whether the j-th variable is a y variable or a z variable. When the j-th variable is a y variable, d[j] = 1, otherwise d[j] = 0. If x4 is a y variable, then d[4] = 1.

[0119] c) Define a binary variable n_f[1,2,…,15] to mark whether the i-th equation is a linear equation about the z-variable. When n_f[i]=1, it means that the i-th equation is a linear equation about the z-variable; otherwise, n_x[i]=0. If the 5th equation x3x5+x2+x3+x4=0 is a linear equation about the z-variable, then n_f[5]=1.

[0120] d) Define binary variables l[[1,2,…,15],[1,2,…,8],[1,2,…,8]] to label the quadratic term x in the i-th equation. j x k Is it a quadratic term with respect to the variable z, when the i-th equation contains a quadratic term x? j x k And x j x k When both are z variables, l[i,j,k] = 0; otherwise, l[i,j,k] = 1. For example, in the second equation, there exists a quadratic term x2x4. If x2 and x4 are both z variables, then l[2,2,4] = 0.

[0121] e) Define binary q_y[1,2,…,15] to mark whether there is a quadratic term in the i-th equation with respect to the variable y. For example, in the 10th equation x4x5+x5x6+x6x7+x4+x5+x6=0, if x5 and x6 are both variables of y, then q_y

[10] =1.

[0122] f) Introduce an integer variable z_y[1,2,…,15] for each equation in the system of equations to represent the number of quadratic terms of z variable multiplied by y variable in the i-th equation. For example, in the 10th equation x4x5+x5x6+x6x7+x4+x5+x6=0, if x5 and x6 are y variables and the rest are z variables, then z_y

[10] =1.

[0123] g) Add an integer variable g_e to represent the complexity of solving the linear equations about the z variable using Gaussian elimination.

[0124] Step 2.2: Add constraints between variables.

[0125] In one embodiment, adding constraints between variables includes the following steps 221-226.

[0126] Step 221, add constraints to variables n_f[i] and l[i, j, k], requiring n_f[i] = 1 if and only if for all variables n_f[i] and l[i, j, k], the following conditions must be met: If l[i, j, k] = 1, then n_f[i] = 0.

[0127] Step 222: Add constraints to variables u and n_f[i], requiring u to be less than or equal to ∑n_f[i].

[0128] Step 223, for the quadratic term x in the i-th equation j x k Add constraints to the corresponding flag variables d[j], d[k] and l[i,j,k], requiring l[i,j,k] = 0 if and only if d[j] and d[k] are both 0;

[0129] Step 224, for the quadratic term x in the i-th equation j x k Add constraints to the corresponding flag variables d[j], d[k] and q_y[i], requiring q_y[i] = 1 if and only if d[j] and d[k] are both 1;

[0130] Step 225, for the quadratic term x in the i-th equation j x k Add constraints to the corresponding flag variables d[j], d[k] and z_y[i], requiring that the value of z_y[i] is equal to the sum of the number of quadratic terms where d[j] = 1 and d[k] = 0 or d[j] = 0 and d[k] = 1;

[0131] Step 226: Add constraints to the variable g_e to represent the complexity of solving the linear equation system of the z variable.

[0132] Step 227, add constraints to variables d[j] and u. This indicates the number of z variables.

[0133] Taking the quadratic Boolean equation system constructed in step 1 as an example, adding constraints between variables involves the following process.

[0134] a) Add constraints to variables n_f[1,2,…,15] and l[[1,2,…,15],[1,2,…,8],[1,2,…,8]], requiring n_f[i] = 1 for the i-th equation if and only if for the i-th equation... If l[i,j,k]=1, then n_f[i]=0. For example, the 6th equation x2x3+x3x4+x4+x5=0 contains quadratic terms x2x3 and x3x4. When x2, x3, and x4 are all z variables, i.e., l[6,2,3] and l[6,3,4] are both 1, then n_f[6]=1. The constraint relationship between n_f[1,2,…,15] and l[[1,2,…,15],[1,2,…,8],[1,2,…,8]] is as follows, where i∈{1,…,15}:

[0135]

[0136] b) For variables u and n_f[1,2,…,15], the number of z variables must be less than the number of equations where n_f[i] = 1. The constraint relationship between variables u and n_f[1,2,…,15] is as follows:

[0137] c) For variables d[1,2,…,8] and l[[1,2,…,15],[1,2,…,8],[1,2,…,8]], it is required that l[i,j,k]=0 if and only if the quadratic term x in the i-th equation is 0. j x k The corresponding d[j] and d[k] are both 0, that is, d[j], d[k] and l[i,j,k] satisfy the following relationship:

[0138] For j,k∈{1,2,…,8}, if d[j]=d[k]=0, then l[i,j,k]=0.

[0139] For j,k∈{1,2,…,8}, if d[j]≠d[k], then l[i,j,k]=1.

[0140] For j,k∈{1,2,…,8}, if d[j]=d[k]=1, then l[i,j,k]=1.

[0141] For example, the second equation x2x4+x1+x2+x3=0 contains the quadratic term x2x3. When x2 and x4 are both z variables, i.e. d[2]=d[4]=0, l[2,2,4]=0. Therefore, the constraint relationship between variables l[[1,2,…,15],[1,2,…,8],[1,2,…,8]] and d[1,2,…,8] is l[i,j,k]=d[j]+d[k]-d[j]·d[k], i∈{1,2,…,15}, j,k∈{1,2,…,8}.

[0142] d) For variables d[1,2,…,8] and q_y[1,2,…,15], q_y[i] = 1 if and only if the i-th equation contains a quadratic term x. j x k The corresponding d[j] and d[k] are both 1, that is, d[j], d[k] and q_y[i] satisfy the following relationship:

[0143] right If d[j] = d[k] = 0, then q_y[i] = 0.

[0144] right If d[j]≠d[k], then q_y[i]=0.

[0145] like If d[j] = d[k] = 1, then q_y[i] = 1.

[0146] For example, the 12th equation x4x5+x5x6+x6+x7=0 contains quadratic terms x4x5 and x5x6. When x4 and x5 are both y variables or x5 and x6 are both y variables, that is, when d[4]=d[5]=1 or d[5]=d[6]=1, q_y

[13] =1. Eight Boolean variables can generate Therefore, the variables d[1,2,…,8] and q_y[1,2,…,15] satisfy the following constraint relationship:

[0147]

[0148] e) For variables d[1,2,…,8] and z_y[1,2,…,15], the value of z_y[i] in the i-th equation is required to be equal to the number of quadratic terms of y multiplied by z, that is, the quadratic term x is required to be equal to the number of quadratic terms. j x kThe corresponding variables d[j] = 1 and d[k] = 0 or d[j] = 0 and d[k] = 1, such as the 6th equation x2x3 + x3x4 + x4 + x5 = 0. When x3 is the z variable and x2 and x4 are the y variables, that is, when d[2] = 1, d[3] = 0, and d[4] = 1, z_y[6] = 2. Therefore, the constraint relationship satisfied by variables d[1,2,…,8] and z_y[1,2,…,15] is as follows:

[0149] f) Add constraints to variables g_e, n_f[1,2,…,15], and u. This represents the complexity of solving a system of linear equations with the z variable.

[0150] g) Add constraints to variables d[j] and u This indicates the number of z variables.

[0151] Step 3: Solve the mixed-integer linear programming model based on the set objective function to obtain the optimal partitioning result of the x variable in the quadratic Boolean equation system.

[0152] Step 3.1: Define the objective function based on the complexity of the algorithm.

[0153] This invention uses the complexity of the Crossbred algorithm for solving quadratic Boolean equations as the objective function. The complexity mainly includes the complexity of traversing the value space of the variable y, and the complexity of calculating the quadratic and linear expressions of y in each traversal, as well as the complexity of using Gaussian elimination to solve the linear equations of the variable z. Thus, obtaining the objective function includes the following steps 311 to 314.

[0154] Step 311: Count the number of equations where q_y[i] = 1 among the equations where n_f[i] = 1, and denote it as qy_num.

[0155] Step 312: Count the number of equations where q_y[i] = 0 among the equations where n_f[i] = 1, and denote it as ly_num.

[0156] Step 313: Count the number of quadratic terms of z multiplied by y in the equation n_f[i] = 1, denoted as zy_num.

[0157] Step 314: The objective function is to find the minimum complexity of the Crossbred algorithm for solving the quadratic Boolean equation system.

[0158] Taking the quadratic Boolean equation system constructed in step 1 as an example, the complexity of solving it mainly includes the complexity of traversing the value space of the variable y, which is 2. 8-uIn each iteration, the complexity of calculating the quadratic and linear expressions of the y variable is (8-u)·qy_num+ly_num+zy_num, and the complexity of solving the linear equation system of the z variable using Gaussian elimination is g_e. The minimum complexity MIN(2) of the Crossbred algorithm for solving quadratic Boolean equation systems will be found. 8-u ·((8-u)·qy_num+ly_num+zy_num+g_e)) is used as the objective function.

[0159] Step 3.2: Use the solver to solve the model and obtain the optimal splitting variable parameters.

[0160] This invention uses existing solvers to solve mixed-integer linear programming models and obtain optimal parameters. These existing solvers include Gurobi and CPLEX.

[0161] For example, the quadratic Boolean equation system constructed in step 1 can yield z variables: x1, x2, x3, x6, x7, x8 and y variables: x4, x5.

[0162] Step 4: Based on the segmentation results of the x variable, perform a system of quadratic Boolean equations to obtain several candidate solutions.

[0163] After obtaining the z variables x1, x2, x3, x6, x7, x8 and the y variables x4, x5, iterate through the value space {0, 1} of the y variables x4, x5. 2 In each iteration, the equations with n_f[i] = 1 in the original system of equations become linear equations about the z variables x1, x2, x3, x6, x7, x8. All the equations with n_f[i] = 1 form a linear system of equations about the z variables x1, x2, x3, x6, x7, x8. Gaussian elimination is used to solve this system of equations to obtain the values ​​of x1, x2, x3, x6, x7, x8. The values ​​of x1, x2, x3, x6, x7, x8 and the values ​​of x4, x5 from the current iteration are then brought back into the original system of equations for verification. If the values ​​of x1, x2, x3, x4, x5, x6, x7, x8 are true for the entire original system of equations, then it is considered a solution; otherwise, the next iteration is performed, the values ​​of x4, x5 are updated, and the above process is repeated.

[0164] Step 5: Decrypt the ciphertext using the key formed by the candidate solution to obtain the security evaluation result of the cryptographic algorithm to be evaluated.

[0165] As mentioned earlier, each unknown variable in the system of equations represents one bit of the key. After solving the system of equations, candidate solutions are obtained, and each candidate solution corresponds to a candidate key. This invention uses the candidate key to decrypt the ciphertext to see if the corresponding plaintext can be obtained. If it can, the attack on the cryptographic algorithm is completed; otherwise, another candidate key is used for decryption.

[0166] In summary, Mixed Integer Linear Programming (MILP) is a mathematical optimization method that combines linear programming with integer constraints. In MILP problems, some decision variables are continuous (meaning they can take real values), while others are restricted to discrete values ​​(meaning they can only take integer values). Solving complex decision problems using MILP first requires modeling the problem, including defining the decision variables, adding appropriate constraints, and setting the objective function. Then, a solver is used to solve the model.

[0167] This invention combines mixed-integer linear programming with the Crossbred algorithm for solving quadratic Boolean equations, considering the relationships between the variables in the equation system. It utilizes mixed-integer linear programming to search for the parameters of the partitioning variables, thereby optimizing the implementation of the Crossbred algorithm. Existing technologies do not use mixed-integer linear programming for optimizing the Crossbred algorithm.

[0168] In the experiment described above, the time complexity of solving the system of equations using the method of this invention is 2. 9.85 Solving the system of equations using the original Crossbred algorithm has a time complexity of 2. 14.23 Therefore, this invention is superior to the original Crossbred algorithm for solving quadratic Boolean equations, effectively reducing the complexity of solving quadratic Boolean equations and enabling security assessment of cryptographic algorithms.

[0169] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail using examples, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A cryptographic security assessment method based on variable partitioning of a quadratic Boolean equation, characterized in that, The method includes: Construct a system of quadratic Boolean equations for the cryptographic algorithm to be evaluated; where the number of equations in this system is... The bit length of the ciphertext generated by the cryptographic algorithm to be evaluated is determined by the quadratic Boolean equations in this system. Number of variables The key bit length is determined based on the cryptographic algorithm to be evaluated; Construct a mixed-integer linear programming model for this quadratic Boolean equation system; wherein, this mixed-integer linear programming model is used to... variables and Replace variables in the quadratic Boolean equations variable; Solving this mixed-integer linear programming model based on the set objective function yields the quadratic Boolean equations. The optimal splitting result of the variables; based on The result of the variable partitioning is solved by a system of quadratic Boolean equations to obtain several candidate solutions; The ciphertext is decrypted using a key composed of the candidate solutions to obtain the security evaluation result of the cryptographic algorithm to be evaluated. The mixed-integer linear programming model for constructing this quadratic Boolean equation system includes: Define the variables in the mixed-integer linear programming model based on the quadratic Boolean equations; Add constraints between variables; By combining the variables and constraints between variables in the mixed-integer linear programming model, a combined-integer linear programming model can be generated. The variables in the mixed-integer linear programming model are defined according to the quadratic Boolean equations, including: Define integer variables , used to represent The number of variables; Define a binary variable d[j] to represent the i-th element in each quadratic Boolean equation. indivual The variable is Variable or variable; Define binary variables , used to represent the first Are quadratic Boolean equations about...? Linear equations of variables; Define binary variables , used to represent the first The quadratic term in the equation Is it about The quadratic term of the variable; Define binary variables , used to represent the first Does the equation contain a quadratic term with respect to the variable y? Define integer variables , used to represent the first In the equations The number of quadratic terms in the product of the variable and the variable y; Define an integer variable g_e to represent the solution of Gaussian elimination with respect to... The complexity of a system of linear equations with variables.

2. The method according to claim 1, characterized in that, Construct a system of quadratic Boolean equations based on the cryptography to be evaluated, including: Obtain the plaintext and the ciphertext obtained by encrypting the plaintext using the cryptographic algorithm to be evaluated; Construct using the plaintext Includes Nonlinear polynomials with variables; Based on the structure of the cryptographic algorithm to be evaluated, each nonlinear polynomial is transformed to obtain the final set of nonlinear polynomials. Set the final set of nonlinear polynomials to the ciphertext to obtain a set of quadratic Boolean equations.

3. The method according to claim 1, characterized in that, Add constraints between variables, including: Add variables and variables Constraints between The constraint Includes: Required variables If and only if for There are variables Otherwise, variable ; Add variables and variables Constraints between The constraint Includes: variables The value is less than the variable The number of equations with a value of 1; Add variable d[j] and variable Constraints between The constraint include: right If d[j] = d[k] = 0, then the variable ; right If d[j] ≠ d[k], then the variable ; right If d[j] = d[k] = 1, then the variable ; Add variable d[j] and variable Constraints between The constraint include: right If d[j] = d[k] = 0, then the variable q_y[i] = 0; right If d[j]≠d[k], then the variable q_y[i]=0; like If d[j] = d[k] = 1, then the variable q_y[i] = 1; Add constraints between variables d[j] and z_y[i]. The constraint Including: Requirement No. The value of the variable z_y[i] in the equation is equal to the number of quadratic terms of the product of the variable y and the variable z; Add variable g_e, variable and variables Constraints between The constraint Includes: variables , Indicates the number of quadratic Boolean equations; Add variable d[j] and variable Constraints between The constraint Includes: variables .

4. The method according to claim 1, characterized in that, The process of generating the objective function includes: In variables Statistical variables in a quadratic Boolean equation Number of equations ; In variables Statistical variables in a quadratic Boolean equation Number of equations ; In variables Count the number of quadratic terms in the product of z and y in a quadratic Boolean equation. ; Minimize the complexity of the Crossbred algorithm for solving quadratic Boolean equations (MIN). As the objective function.

5. The method according to claim 1, characterized in that, based on The result of variable partitioning is solved using a system of quadratic Boolean equations, yielding several candidate solutions, including: Iterate through the possible values ​​of the variable y to make the variable... The quadratic Boolean equation with z = 1 forms a system of linear equations in the variable z. Using Gaussian elimination on... Solve the system of linear equations involving the variables to obtain the results. The value of the variable; The linear equations involved The value of the variable and the traversal of the y variable are involved The values ​​of the variables are brought back to the quadratic Boolean equations for verification, and after successful verification, a set of candidate solutions is obtained.

6. A cryptographic security evaluation system based on variable partitioning of a quadratic Boolean equation, characterized in that, The system includes: The equation system construction module is used to construct a quadratic Boolean equation system about the cryptographic algorithm to be evaluated; wherein, the number of equations in the quadratic Boolean equation system is... The bit length of the ciphertext generated by the cryptographic algorithm to be evaluated is determined by the quadratic Boolean equations in this system. Number of variables The key bit length is determined based on the cryptographic algorithm to be evaluated; The model building module is used to construct a mixed-integer linear programming model for this quadratic Boolean equation system; wherein, this mixed-integer linear programming model is used to... variables and Replace variables in the quadratic Boolean equations variable; The variable partitioning module is used to solve the mixed-integer linear programming model based on a set objective function, obtaining the quadratic Boolean equations. The optimal splitting result of the variables; The equation system solver module is used for solving equation systems based on... The result of the variable partitioning is solved by a system of quadratic Boolean equations to obtain several candidate solutions; The cryptographic evaluation module is used to decrypt the ciphertext using the candidate solution as a key, and obtain the security evaluation result of the cryptographic algorithm to be evaluated. The mixed-integer linear programming model for constructing this quadratic Boolean equation system includes: Define the variables in the mixed-integer linear programming model based on the quadratic Boolean equations; Add constraints between variables; By combining the variables and constraints between variables in the mixed-integer linear programming model, a combined-integer linear programming model can be generated. The variables in the mixed-integer linear programming model are defined according to the quadratic Boolean equations, including: Define integer variables , used to represent The number of variables; Define a binary variable d[j] to represent the i-th element in each quadratic Boolean equation. indivual The variable is Variable or variable; Define binary variables , used to represent the first Are quadratic Boolean equations about...? Linear equations of variables; Define binary variables , used to represent the first The quadratic term in the equation Is it about The quadratic term of the variable; Define binary variables , used to represent the first Does the equation contain a quadratic term with respect to the variable y? Define integer variables , used to represent the first In the equations The number of quadratic terms in the product of the variable and the variable y; Define an integer variable g_e to represent the solution of Gaussian elimination with respect to... The complexity of a system of linear equations with variables.

7. An electronic device, characterized in that, The electronic device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the cryptographic security assessment method based on variable segmentation of quadratic Boolean equations as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the cryptographic security assessment method based on variable segmentation of a quadratic Boolean equation as described in any one of claims 1-5.

Images