A fault attack method against RIPEMD-160 hash algorithm

Abstract

The present application relates to a kind of fault attack methods for RIPEMD-160 hash algorithm, first randomly generates to be handled message, and to be handled message is as the input of RIPEMD-160 algorithm, using random single byte fault model, in the fifth round of import random 8 bits fault, obtains error output.Based on error output, deduce intermediate state value, then using statistical method, calculate the hamming weight of intermediate state value, according to the minimum value of hamming weight, the correct value of corresponding message is obtained.Repeat the process of importing fault and analysis, finally the complete message to be handled can be deduced.The method provided by the present application is easy to implement, fast and high accuracy, and provides important analysis basis for the security research of RIPEMD-160 hash algorithm.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a fault attack method targeting the RIPEMD-160 hash algorithm. Background Technology

[0002] With the continuous advancement of computer networks and digital communication technologies, e-commerce, online payments, and blockchain applications have become deeply integrated into people's daily lives, greatly improving the efficiency and convenience of information exchange. However, this also places higher demands on data integrity and identity authentication. In these application scenarios, effectively preventing message tampering and resisting collision attacks have become key issues in ensuring information security. RIPEMD-160 is a cryptographic hash algorithm designed by a European research team. As part of the RIPE project, it aims to provide stronger security than earlier algorithms such as MD5 and has been widely used in decentralized systems such as digital signatures and public key infrastructures in its subsequent development. RIPEMD-160 adopts a dual-threaded parallel Merkle-Damgård structure to generate a fixed-length 160-bit hash value. It achieves good avalanche effect and collision resistance through multiple rounds of nonlinear transformations. Each message block undergoes 5 rounds of computation, with 16 steps per round, for a total of 80 steps. Its core operations include nonlinear functions, modular addition, and cyclic shifting, exhibiting high computational efficiency and strong security, making it particularly suitable for environments with high requirements for hash output length and security. Currently, there is no research, either domestically or internationally, on how to mitigate statistical failures in the intermediate encounter mechanism of the RIPEMD-160 hash algorithm. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a fault attack method for the RIPEMD-160 hash algorithm, which can evaluate the ability of the RIPEMD-160 hash algorithm to resist intermediate encounter statistical fault attacks.

[0004] The technical solution adopted by this invention to solve its technical problem is: to provide a fault attack method for the RIPEMD-160 hash algorithm, including the following steps:

[0005] Step S1: Randomly generate messages to be processed;

[0006] Step S2: The message to be processed is mapped using the RIPEMD-160 algorithm, and a random 8-bit fault is introduced at the beginning of the fifth-to-last round of the left channel operation process to collect the error output affected by the fault; wherein, the message to be processed is divided into 16 message blocks when the RIPEMD-160 algorithm is used for operation.

[0007] Step S3: Combine the structural design of the RIPEMD-160 algorithm to obtain the backward formula for intermediate state values. Based on the error output, multiple intermediate state values ​​are derived by enumeration.

[0008] Step S4: Using statistical methods, calculate the Hamming weight of each intermediate state value, and select the enumerated message block corresponding to the minimum Hamming weight as the correct message part.

[0009] Step S5: Repeat steps S2-S4, making the import position of the fault different each time, to obtain all the bits of the message block.

[0010] Between steps S2 and S3, the following is also included:

[0011] Determine whether the number of erroneous outputs collected after the fault has reached the preset number;

[0012] If the number of erroneous outputs after the fault does not reach the preset number, return to step S1;

[0013] If the number of erroneous outputs affected by the fault reaches a preset number, proceed to step S3.

[0014] The formula for calculating the intermediate state value is as follows: ;in, These are the first, second, third, fourth, and fifth 32-bit portions of the intermediate state register for round 75, respectively. This is an error output. This is the result of adding the right channel output value to the modulus of the initial vector. This is the cyclic shift amount in step 75. This is a constant for the 4th round. This is the message scheduling index for step 75 of the left channel. The message blocks are the data segments into which the messages to be processed are divided during the computation process. This is the nonlinear function for the 4th round; For model Subtraction operation, This is a circular right shift operation.

[0015] When deriving multiple intermediate state values ​​through enumeration, values ​​are directly taken from the mapping matrix. The mapping matrix is ​​constructed as follows: pre-calculate the result of adding the right channel output value to the initial vector and the output result of the fifth 32-bit part of the intermediate state register in the 75th round; match the result of adding the right channel output value to the initial vector and the fifth 32-bit part of the intermediate state register in the 75th round with the output result to obtain the mapping matrix.

[0016] In step S2, a random 8-bit fault is introduced by means of software simulation or by means of laser, electromagnetic and voltage interference.

[0017] The fault attack method against the RIPEMD-160 hash algorithm further includes: based on all the bits of the obtained message block, importing the fault location into a deeper round, and repeating steps S1-S5 to obtain other message blocks of the message to be processed.

[0018] Beneficial effects

[0019] By employing the above-mentioned technical solution, this invention has the following advantages and positive effects compared with existing technologies: First, this invention randomly generates a message to be processed and uses it as input to the RIPEMD-160 algorithm. A random single-byte fault model is adopted, introducing a random 8-bit fault at the fifth-to-last round, outputting an error. Then, the obtained error output is analyzed backwards using the algorithm's results, and statistical methods are employed for filtering. Combined with the encounter-in-the-middle method, specific bits of the message can be recovered through backwards analysis. This process is repeated multiple times with repeated fault imports and backwards analysis to reconstruct the complete message information. The method provided by this invention is easy to implement, fast, and highly accurate, providing a good analytical basis for detecting the RIPEMD-160 algorithm's ability to resist encounter-in-the-middle statistical fault attacks. Attached Figure Description

[0020] Figure 1 A flowchart illustrating the steps for detecting whether the RIPEMD-160 hash algorithm is resistant to encounter-in-the-middle statistical failure attacks;

[0021] Figure 2 A fault propagation diagram of a statistical fault attack on intermediate encounters during the encryption process of the RIPEMD-160 hash algorithm.

[0022] Figure 3 A detailed structural diagram of the RIPEMD-160 hash algorithm;

[0023] Figure 4 This is a schematic diagram of the experimental environment for this scheme. Detailed Implementation

[0024] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined by the appended claims.

[0025] Basic symbol explanation:

[0026] :information, Message P is divided into 16 message blocks during computation, denoted as... ,in ;

[0027] Error output, ;

[0028] The first 32 bits of the intermediate state register in the j-th round, similarly... These are the second, third, fourth, and fifth 32-bit portions. The complete initial intermediate state during the j-th round of computation can be denoted as: ,in And let the result of the last round of calculations be recorded as: ;

[0029] : The nonlinear function of the r-th round, where ;

[0030] : The constant of the r-th round, where ;

[0031] : The cyclic shift amount in step j, where ;

[0032] : The message scheduling index of step j in the left channel, used to control message blocks in each round. The order of participation, among which ;

[0033] : The message scheduling index of the j-th step in the right channel, used to control the message blocks in each round. The order of participation, among which ;

[0034] :mold Addition operation;

[0035] :mold Subtraction operation;

[0036] : Circular left shift;

[0037] :cascade.

[0038] Figure 1This is a flowchart illustrating a method for detecting RIPEMD-160 hash algorithm attacks to resist intermediate encounter statistical fault attacks, provided by an embodiment of the present invention. When processing messages using the RIPEMD-160 hash algorithm, by changing the experimental environment (normal conditions versus conditions affected by physical factors such as clock, voltage, humidity, radiation, pressure, light, and eddy currents), an attacker can obtain an erroneous output and deduce key information based on this erroneous output. An attacker can induce random faults during the execution of the RIPEMD-160 algorithm, but the specific location of the fault initiation is unknown. Therefore, obtaining the location of the fault initiation is crucial. This invention employs a random single-byte fault model, with the fault location being the fifth-to-last round. The method specifically includes the following steps:

[0039] Step 1: Randomly generate messages to be processed .

[0040] Step 2: Use the RIPEMD-160 algorithm to process the message. The mapping is performed, and a random 8-bit fault is introduced at the beginning of the fifth-to-last round of the left channel operation. The erroneous output affected by the fault is collected. .

[0041] Step 3: Repeat steps 1 to 2 until a sufficient number of error outputs are obtained. This invention uses 200 output values ​​as a threshold, that is, the collected erroneous outputs affected by the fault. If the quantity reaches 200, proceed to step 4; otherwise, return to step 1.

[0042] The present invention can be selected as follows: Figure 4 The experimental setup shown utilizes a computer to generate the input (i.e., the message to be processed) for the RIPEMD-160. ), and process and analyze the input messages to be processed. The output result after processing the RIPEMD-160 algorithm; the device encapsulating the RIPEMD-160 algorithm is used to process the input message and obtain the corresponding output result; the fault-introducing device is used to perform fault-introducing actions, which will be performed during the operation of the RIPEMD-160 algorithm, thereby obtaining erroneous output. The fault-introducing device can be implemented by software simulation or by processing the real hardware through techniques such as voltage interference, so that the RIPEMD-160 algorithm is interfered with, inducing a fault in the RIPEMD-160 algorithm during operation, thereby obtaining erroneous output.

[0043] Step 4: Calculate intermediate state values. Because the RIPEMD-160 algorithm uses a dual-threaded parallel structure (see...), Figure 3The system performs left and right channel operations on the same message, and finally adds the output values ​​of the left and right channels modulo the original register value to obtain the final output. In this embodiment, the fault injection position is the left channel, specifically before the fifth-to-last round of the left channel operation. The fault propagation path diagram needs to be derived based on different fault injection positions. Assuming the fault injection position and fault propagation path diagram are as follows... Figure 2 As shown, based on the structural design of the RIPEMD-160 algorithm, the formula for calculating the intermediate state values ​​is as follows:

[0044] ;

[0045] The result of adding the right channel output value to the initial vector is denoted as T, and and All of these are known quantities. Therefore, each time, we can enumerate the 8 bits of the result T obtained by adding the right channel output value to the initial vector, and the fifth 32-bit part of the intermediate state register in the 75th round. 8 bits 8 bits and Use the 8 bits to work backwards to deduce the first 32 bits of the intermediate state register for round 75. .

[0046] Based on the above reverse reasoning process, it can be seen that a total of 32 bits of information needs to be enumerated. Therefore, a mapping matrix can be constructed by pre-calculating and storing some of the calculation results. During the reverse reasoning, values ​​can be directly retrieved from the mapping matrix, thus avoiding redundant calculations and reducing implementation costs. For example, a mapping matrix can be used to store 8 bits of the result T of calculating the modulo addition of each enumerated right channel output value with the initial vector, and the fifth 32-bit part of the intermediate state register of the 75th round. The 8-bit results under different combinations can reduce the complexity to [missing information]. .

[0047] Step 5: For the collected error output Using statistical methods, the intermediate state values ​​were determined. The Hamming weight. The Hamming weight represents the number of '1's contained in the binary form of the intermediate state. For example, when... The binary representation of 8 is 1000, then the intermediate state value The weight of Hamming is 1.

[0048] Step 6: Find the message block corresponding to the minimum Hamming weight. The enumerated values. Because faults are injected via bitwise AND operations, the distribution of intermediate state values ​​will be uneven, with fewer "1"s than "0". Therefore, the message block corresponding to the minimum Hamming weight. That is the correct message part.

[0049] Step 7: Repeat steps 2 through 6, ensuring that the import location for each fault is different, to obtain the message block. All bits, and can determine the result T of the right channel output value modulo the initial vector, and the fifth 32-bit part of the intermediate state register of the 75th round. and the nonlinear function of the fourth round The corresponding value.

[0050] Step 8: Based on the above information, the fault location can be imported into a deeper wheel, and the above analysis process can be repeated to gradually obtain information about other message blocks of the message to be processed.

[0051] Using the above analysis method, this invention simulated the import failure and RIPEMD-160 hash algorithm processing on a computer with an Intel(R) Core(TM) i7-14700F processor and 32GB of memory using the VS Code development tool, repeating the process 2000 times. The experimental results show that the detection method described above is accurate. The method provided by this invention is easy to implement, fast, and highly accurate, and is of great significance to the security research of the RIPEMD-160 hash algorithm.

Claims

1. A fault attack method targeting the RIPEMD-160 hash algorithm, characterized in that, Includes the following steps: Step S1: Randomly generate messages to be processed; Step S2: The message to be processed is mapped using the RIPEMD-160 algorithm, and a random 8-bit fault is introduced at the beginning of the fifth-to-last round of the left channel operation process to collect the error output affected by the fault; wherein, the message to be processed is divided into 16 message blocks when the RIPEMD-160 algorithm is used for operation. Step S3: Based on the structural design of the RIPEMD-160 algorithm, the backward formula for the intermediate state values ​​is obtained. Based on the error output, multiple intermediate state values ​​are derived by enumeration. The backward formula for the intermediate state values ​​is expressed as: ;in, These are the first, second, third, fourth, and fifth 32-bit portions of the intermediate state register for round 75, respectively. This is an error output. This is the result of adding the right channel output value to the modulus of the initial vector. This is the cyclic shift amount in step 75. This is a constant for the 4th round. This is the message scheduling index for step 75 of the left channel. The message blocks are the data segments into which the messages to be processed are divided during the computation process. This is the nonlinear function for the 4th round; For model Subtraction operation, This is a circular right shift operation; Step S4: Using statistical methods, calculate the Hamming weight of each intermediate state value, and select the enumerated message block corresponding to the minimum Hamming weight as the correct message part. Step S5: Repeat steps S2-S4, making the import position of the fault different each time, to obtain all the bits of the message block.

2. The fault attack method against the RIPEMD-160 hash algorithm according to claim 1, characterized in that, Between steps S2 and S3, the following is also included: Determine whether the number of erroneous outputs collected after the fault has reached the preset number; If the number of erroneous outputs after the fault does not reach the preset number, return to step S1; If the number of erroneous outputs affected by the fault reaches a preset number, proceed to step S3.

3. The fault attack method against the RIPEMD-160 hash algorithm according to claim 1, characterized in that, When deriving multiple intermediate state values ​​through enumeration, values ​​are directly taken from the mapping matrix. The mapping matrix is ​​constructed as follows: pre-calculate the result of adding the right channel output value to the initial vector and the output result of the fifth 32-bit part of the intermediate state register in the 75th round; match the result of adding the right channel output value to the initial vector and the fifth 32-bit part of the intermediate state register in the 75th round with the output result to obtain the mapping matrix.

4. The fault attack method against the RIPEMD-160 hash algorithm according to claim 1, characterized in that, Also includes: Based on all the bits of the obtained message block, the fault location is imported into a deeper wheel, and steps S1-S5 are repeated to obtain other message blocks of the message to be processed.

Images