Password period evaluation method and device based on SH structure

Abstract

The invention discloses a password period evaluation method and device based on an SH structure. The method comprises the steps of obtaining a to-be-evaluated cryptographic algorithm; converting the input of the cryptographic algorithm into a plaintext mode and constructing a structural model of the cryptographic algorithm; inputting the plaintext mode into a structure model of the cryptographic algorithm, and performing round function iteration operation to obtain the periodic function round number, independent variables, parameters and output variables of the cryptographic algorithm; constructing a periodic function, verifying the correctness of the constructed periodic function, judging whether the round number of the periodic function is greater than one half of the whole round of the to-be-evaluated cryptographic algorithm under the correct condition, and if yes, determining that the evaluation result of the to-be-evaluated cryptographic algorithm is safe under the quantum model; and if not, determining that the evaluation result of the cryptographic algorithm to be evaluated is unsafe under the quantum model. The design method is simple and easy to realize on software and hardware platforms, and has the advantage of high efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computer encryption technology, and in particular to a password cycle evaluation method and device based on SH (Source-Heavy) structure. BACKGROUND

[0002] Password evaluation technology verifies and analyzes encryption algorithms, key management mechanisms, password security protocols, etc., to ensure the confidentiality, integrity and non-repudiation of sensitive data in transmission and storage, and is the core means to ensure the security and reliability of password systems.

[0003] Existing symmetric password security analysis and evaluation technology is based on a classical computing model, with differential path search, linear path search, integral path search, etc. However, with the rapid development of quantum computing, the implementation and evaluation technology of traditional password algorithms have poor compatibility and insufficient security under the quantum computing model. The cryptographic research institutes of various countries, led by the United States NIST, have begun to actively promote the deployment of post-quantum cryptography, and the design and analysis of quantum-resistant password algorithms has become a focus of global cryptographers. In terms of symmetric password security analysis and evaluation, the research on quantum distinguisher test methods based on periodic functions is a key issue. SH structure is a classical generalized Feistel structure, and the compression functions of RC2, SPEED, SM4, MD5 and SHA-1 are designed based on SH structure. The present application provides a periodic function evaluation method for password algorithms of this type of structure, which helps to more accurately analyze the security of related password algorithms and provides more accurate security index references for the design and selection of post-quantum password algorithms. SUMMARY

[0004] Therefore, the present application provides a password cycle evaluation method and device based on SH structure, which can solve the above technical problems.

[0005] In order to solve the above technical problems, the present application is implemented as follows.

[0006] A password cycle evaluation method based on SH structure, comprising:

[0007] Step S1: obtaining a password algorithm E to be evaluated K,q (·), which is based on SH structure; wherein K represents the master key, and q represents the original iteration round number of the password algorithm; converting the input of the password algorithm into a plaintext mode and constructing a structure model of the password algorithm, wherein the structure model of the password algorithm includes a list of input and output bit patterns of a linear transformation L in the password algorithm;

[0008] Step S2: Input the plaintext pattern into the structural model of the cryptographic algorithm, perform round function iteration operation, and obtain the number of rounds, independent variables, parameters and output variables of the periodic function of the cryptographic algorithm;

[0009] Step S3: Construct a periodic function based on the independent variable, parameters, and output variable; determine the period t based on the output variable; verify the correctness of the constructed periodic function based on the period t; if correct, proceed to step S4.

[0010] Step S4: Determine whether the number of rounds of the periodic function is greater than half of the total number of rounds of the cryptographic algorithm to be tested. If it is satisfied, the evaluation result of the cryptographic algorithm to be tested is secure under the quantum model; if it is not satisfied, the evaluation result of the cryptographic algorithm to be tested is insecure under the quantum model.

[0011] Preferably, in step S1, converting the input of the cryptographic algorithm into plaintext includes:

[0012] The input to the cryptographic algorithm is divided into 4n plaintext blocks, and then these 4n plaintext blocks are further divided into four data blocks X′0, X′1, X′2, X′3, each containing n components. Let X′ be the input of the cryptographic algorithm. i =[m i0 ,m i1 ,…,m i(n-1) ], where X′ i Each component m ij For each byte, i = 0, 1, 2, 3; j = 0, ..., n-1; then each component m in X′0, X′1, X′2, X′3 is... ij Convert to bit components according to bit mode x ij ,Right now

[0013]

[0014] upcoming data block X′ i Converted into a bit pattern comprising n bit components [x] i0 ,x i1 ,…,x i(n-1) ],

[0015] The transformed X′0, X′1, X′2, X′3 are denoted as X0, X1, X2, X3 respectively. The combination of X0, X1, X2, X3 forms the plaintext pattern.

[0016] Preferably, the structural model expression of the cryptographic algorithm is as follows:

[0017]

[0018] Among them, T num Let X represent the function T constructed in round num. num-1 Xnum X num+1 X num+2 These are the input patterns for the num-th round, X num+3 For the output mode of the num-th round, This is an XOR operation.

[0019] Preferably, the structural model of the cryptographic algorithm performs r rounds of round function operations on X0, X1, X2, X3, and the round function iteration operation is performed with X0, X1, X2, X3 as the input of the first round;

[0020] The round function operations of the num-th round, where 1 ≤ num ≤ r, include:

[0021] Step S11: Obtain the input of the num-th round, and denote the input of the num-th round as Temp0, Temp1, Temp2, Temp3; where, when num equals 1, the input is the transformed X0, X1, X2, X3; when num is not equal to 1, the input is the output of the (num-1)-th round;

[0022] Step S12: Construct the T function; the T function consists of an S-box transformation and a linear L-box transformation. The S-box transformation performs a lookup table replacement on bytes. Three symbols are set in the S-box transformation: △, *, and ?. The lookup table rules are formatted as: S(0) = 0, S(1) = △. S(*) = *; And k is any non-zero sign among 0, 1, Δ, *, ?; the linear L-level transformation is based on the output pattern list calculated from the coefficient matrix of transformation L for Temp. i A linear transformation performed on the n components;

[0023] Input Temp1, Temp2, and Temp3 into function T. For each component of the XOR sum of Temp1, Temp2, and Temp3, query the S-box. When all n components have been queried, the output vector [y] is obtained. 10 ,y 11 ,…,y 1(n-1) ];in, For x 1j Query the results of the S-box;

[0024] Step S13: For the output vector [y 10 ,y 11 ,…,y 1(n-1) Perform a linear L-level transformation, and use the result of the linear L-level transformation as the output of the T function. The output of the T function is [z]. 10 ,z 11 ,…,z1(n-1) ] = L([y 10 ,y 11 ,…,y 1(n-1) ]);

[0025] Step S14: Output the result of the T function [z 10 ,z 11 ,…,z 1(n-1) XORing with Temp0 yields Temp4.

[0026] Temp1, Temp2, Temp3, and Temp4 are used as the output of the num-th round.

[0027] Preferably, step S2 involves inputting the plaintext pattern into the structural model of the cryptographic algorithm, performing round function iteration operations, and obtaining the number of rounds, independent variables, parameters, and output variables of the periodic function of the cryptographic algorithm, including:

[0028] Step S21: Input the plaintext patterns X0, X1, X2, and X3 into the structure model of the cryptographic algorithm, and perform l-3 rounds of iteration to obtain the result X. l-3 X l-2 X l-1 X l , l>3;

[0029] Where 1≤wheel≤l-3, the iteration process of the wheel-th round includes:

[0030] Step S211: Let X be the input of the wheel. wheel-1 X wheel X wheel+1 X wheel+2 ;

[0031] Step S212: Calculate the intermediate variable S wheel+3 Y wheel+3 Z wheel+3 and X wheel+3 :

[0032]

[0033] Y wheel+3 =[S(s) (wheel+3)0 ), S(s (wheel+3)1 ),...,S(s (wheel+3)(n-1) )]

[0034] =[y (wheel+3)0 y (wheel+3)1 , ..., y (wheel+3)(n-1) ]

[0035] Z wheel+3 =L([y(wheel+3)0 , y (wheel+3)1 ,..., y (wheel+3)(n-1) )

[0036] = [z (wheel+3)0 , z (wheel+3)1 , …, z (wheel+3)(n-1)

[0037]

[0038] Step S213: Obtain the n components x wheel+3 of X (wheel+3)j ; Let test be equal to wheel + 3;

[0039] Step S22: Determine whether x testj is *;

[0040] Step S23: If so, let test be equal to test + 1, perform the (test - 2)-th iteration process, determine x test based on the obtained X test(j+1) , let j be equal to j + 1, and enter Step S22; if not, enter Step S24;

[0041] Step S24: Perform an L test transformation on X -1 to obtain

[0042] X′ test = L -1 ([x test0 , x test1 , …, x test(n-1) ) = [x′ test0 , x′ test1 , …, x′ test(n-1)

[0043] If there exists an x′ testj that is *, then the number of rounds of the periodic function of this cryptographic algorithm is l;

[0044] Otherwise, the number of rounds of the periodic function of this cryptographic algorithm is l - 1;

[0045] Step S25: Randomly select a master key K, and generate each round sub-key RK k-1 , where 0 < k < q; The position of the independent variable x of the cryptographic algorithm E K，q (·) is the non-zero bit position of the pattern corresponding to L -1 (X0); The position of the parameter α of the cryptographic algorithm E K，q (·) is the non-zero bit position of the pattern corresponding to X1, X2, X3; The output variable is the data value Data(x′ lj ) or Data(x​​lj ), defined as OUT r .

[0046] Preferably, in step S3, constructing a periodic function based on the independent variable, parameters, and output variable; determining the period t based on the output variable; and verifying the correctness of the constructed periodic function based on the period t include:

[0047] Step S31: The periodic function constructed based on the independent variable, parameters, and output variable is as follows:

[0048]

[0049] cycle

[0050] Where α0 and α1 are the variable parameters, and h(x,α0) is the OUT value corresponding to the plaintext input (x,α0) after encryption. r h(x,α1) is the OUT value corresponding to the plaintext input (x,α1) after encryption. r RK0[1] is the first byte of the first round subkey generated by the master key K;

[0051] Step S32: Randomly select a master key K and input E. K,q (·) corresponds to two different sets of plaintext blocks, and each set of plaintext blocks corresponds to a plaintext pattern;

[0052] Each plaintext block is encrypted for r rounds, and the output is denoted as OUT. r and OUT' r ;

[0053] If the calculated OUT r and OUT' r If they are equal, the constructed periodic function is correct; otherwise, the constructed periodic function is incorrect.

[0054] Preferably, in step S4, the encryption algorithm E K,q (·) The whole wheel is equal to q.

[0055] This invention provides a cryptographic periodicity evaluation device based on the SH structure, comprising:

[0056] Initialization module: Configured to obtain the cryptographic algorithm E to be evaluated. K,q (·), the cryptographic algorithm is based on the SH structure; where K represents the master key and q represents the original iteration round number of the cryptographic algorithm; the input of the cryptographic algorithm is converted into plaintext mode and the structural model of the cryptographic algorithm is constructed, the structural model of the cryptographic algorithm includes a list of input and output bit modes of the linear transformation L in the cryptographic algorithm;

[0057] Intermediate quantity acquisition module: configured to input plaintext mode into the structure model of cryptographic algorithm, perform round function iteration operation, and obtain the number of rounds, independent variables, parameters and output variables of the periodic function of cryptographic algorithm;

[0058] Verification module: Configured to construct a periodic function based on independent variables, parameters, and output variables; determine the period t based on the output variable; verify the correctness of the constructed periodic function based on the period t; and trigger the judgment module if it is correct.

[0059] Judgment module: Configured to determine whether the number of rounds of the periodic function is greater than half of the total number of rounds of the cryptographic algorithm to be evaluated. If it is satisfied, the evaluation result of the cryptographic algorithm to be evaluated is secure under the quantum model; if it is not satisfied, the evaluation result of the cryptographic algorithm to be evaluated is insecure under the quantum model.

[0060] The present invention provides a computer-readable storage medium storing a plurality of instructions; the plurality of instructions are used by a processor to load and execute the method as described above.

[0061] The present invention provides an electronic device, characterized in that the electronic device comprises:

[0062] A processor is used to execute multiple instructions;

[0063] Memory, used to store multiple instructions;

[0064] The plurality of instructions are to be stored in the memory and loaded and executed by the processor as described above.

[0065] Beneficial effects:

[0066] (1) The periodic function of the present invention is designed based on the characteristics of the linear layer L in the SH structure and the round function. The design method is simple, easy to implement on software and hardware platforms, and has the advantage of high efficiency.

[0067] (2) This invention is applicable to the fields of cryptographic evaluation and cryptographic security analysis. It is used to evaluate the quantum distinguisher and quantum security of SH-structure symmetric cryptography in quantum cryptosystems after evaluation, and provides security for data storage and transmission.

[0068] (3) The feature design of the cryptographic round function module based on the SH structure in this invention can provide new ideas for the design of symmetric cryptography such as block ciphers, hash functions, and authentication encryption based on the generalized Feistel structure in the post-quantum era. Attached Figure Description

[0069] Figure 1 This is a schematic diagram of the cryptographic periodicity evaluation method based on the SH structure of the present invention;

[0070] Figures 2(a) and 2(b) are schematic diagrams of the encryption process mode of the typical SH structure cipher in this invention;

[0071] Figure 3 This is a schematic diagram of the cryptographic periodic evaluation process based on the SH structure in this invention. Detailed Implementation

[0072] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0073] like Figure 1 As shown, this invention proposes a cryptographic periodicity evaluation method based on the SH structure, the method comprising:

[0074] Step S1: Obtain the cryptographic algorithm E to be tested K,q (·), the cryptographic algorithm is based on the SH structure; where K represents the master key and q represents the original iteration round number of the cryptographic algorithm; the input of the cryptographic algorithm is converted into plaintext mode and the structural model of the cryptographic algorithm is constructed, the structural model of the cryptographic algorithm includes a list of input and output bit modes of the linear transformation L in the cryptographic algorithm;

[0075] Step S2: Input the plaintext pattern into the structural model of the cryptographic algorithm, perform round function iteration operation, and obtain the number of rounds, independent variables, parameters and output variables of the periodic function of the cryptographic algorithm;

[0076] Step S3: Construct a periodic function based on the independent variable, parameters, and output variable; determine the period t based on the output variable; verify the correctness of the constructed periodic function based on the period t; if correct, proceed to step S4.

[0077] Step S4: Determine whether the number of rounds of the periodic function is greater than half of the total number of rounds of the cryptographic algorithm to be tested. If it is satisfied, the evaluation result of the cryptographic algorithm to be tested is secure under the quantum model; if it is not satisfied, the evaluation result of the cryptographic algorithm to be tested is insecure under the quantum model.

[0078] In step S1, converting the input of the cryptographic algorithm into plaintext includes:

[0079] The input to the cryptographic algorithm is divided into 4n plaintext blocks, and then these 4n plaintext blocks are further divided into four data blocks X′0, X′1, X′2, X′3, each containing n components. Let X′ be the input of the cryptographic algorithm. i =[m i0 ,m i1 ,…,m i(n-1) ], where X′ i Each component m ij For each byte, i = 0, 1, 2, 3; j = 0, ..., n-1; then each component m in X′0, X′1, X′2, X′3 is... ijConvert to bit components according to bit mode x ij ,Right now

[0080]

[0081] upcoming data block X′ i Converted into a bit pattern comprising n bit components [x] i0 ,x i1 ,…,x i(n-1) ],

[0082] The transformed X′0, X′1, X′2, X′3 are denoted as X0, X1, X2, X3 respectively. The combination of X0, X1, X2, X3 forms the plaintext pattern.

[0083] As shown in Figure 2(a), the structural model expression of the cryptographic algorithm is:

[0084]

[0085] Among them, T num Let X represent the function T constructed in round num. num-1 X num X num+1 X num+2 These are the input patterns for the num-th round, X num+3 For the output mode of the num-th round, This is an XOR operation.

[0086] Furthermore, the structural model of the cryptographic algorithm performs r rounds of round function operations on X0, X1, X2, X3, and the round function iteration operation is performed with X0, X1, X2, X3 as the input of the first round;

[0087] The round function operations of the num-th round, where 1 ≤ num ≤ r, include:

[0088] Step S11: Obtain the input of the num-th round, and denote the input of the num-th round as Temp0, Temp1, Temp2, Temp3; where, when num equals 1, the input is the transformed X0, X1, X2, X3; when num is not equal to 1, the input is the output of the (num-1)-th round;

[0089] Step S12: Construct the T function; the T function consists of an S-box transformation and a linear L-box transformation. The S-box transformation performs a lookup table replacement on bytes. Three symbols are set in the S-box transformation: △, *, and ?. The lookup table rules are formatted as: S(0) = 0, S(1) = △. S(*) = *; And k is any non-zero sign among 0, 1, Δ, *, ?; the linear L-level transformation is based on the output pattern list calculated from the coefficient matrix of transformation L for Temp. i A linear transformation performed on the n components;

[0090] Input Temp1, Temp2, and Temp3 into function T. For each component of the XOR sum of Temp1, Temp2, and Temp3, query the S-box. When all n components have been queried, the output vector [y] is obtained. 10 ,y 11 ,…,y 1(n-1) ];in, For x 1j Query the results of the S-box;

[0091] Step S13: For the output vector [y 10 ,y 11 ,…,y 1(n-1) Perform a linear L-level transformation, and use the result of the linear L-level transformation as the output of the T function. The output of the T function is [z]. 10 ,z 11 ,…,z 1(n-1) ] = L([y 10 ,y 11 ,…,y 1(n-1) ]);

[0092] Step S14: Output the result of the T function [z 10 ,z 11 ,…,z 1(n-1) XORing with Temp0 yields Temp4.

[0093] Temp1, Temp2, Temp3, and Temp4 are used as the output of the num-th round.

[0094] In this invention, the T function is shown in Figure 2(b). It is necessary to construct an output mode list based on the coefficient matrix of the transformation L. Taking the MDS coefficient matrix as an example, all output mode components corresponding to non-zero inputs are 1. If the coefficient matrix is ​​a non-singular n-order square matrix in a binary field, taking n=4 as an example, then the input is a 4-dimensional byte vector, and the corresponding output mode will have 0 components. For example, assuming the coefficient matrix of L is...

[0095]

[0096] The input-corresponding output mode list is as follows:

[0097] Input mode 0000 0001 0010 0011 0100 0101 0110 0111 Output mode 0000 0100 1000 1100 0011 0111 1011 1111 Input mode 1000 1001 1010 1011 1100 1101 1110 1111 Output mode 0010 0110 1010 1110 0011 0111 1011 1111

[0098] likeFigure 3 As shown, step S2 involves inputting the plaintext pattern into the structural model of the cryptographic algorithm and performing round function iteration to obtain the number of rounds, independent variables, parameters, and output variables of the periodic function of the cryptographic algorithm, including:

[0099] Step S21: Input the plaintext patterns X0, X1, X2, X3 into the structure model of the cryptographic algorithm, and perform l-3 rounds of iteration to obtain the result X. l-3 ,X l-2 ,X l-1 ,X l , l>3;

[0100] Where 1≤wheel≤l-3, the iteration process of the wheel-th round includes:

[0101] Step S211: Let X be the input of the wheel. wheel-1 ,X wheel ,X wheel+1 ,X wheel+2 ;

[0102] Step S212: Calculate the intermediate variable S wheel+3 Y wheel+3 Z wheel+3 and X wheel+3 :

[0103]

[0104] Y wheel+3 =[S(s) (wheel+3)0 ),S(s (wheel+3)1 ),…,S(s (wheel+3)(n-1) )]

[0105] =[y (wheel+3)0 ,y (wheel+3)1 ,…,y (wheel+3)(n-1) ]

[0106] Z wheel+3 =L([y (wheel+3)0 ,y (wheel+3)1 ,…,y (wheel+3)(n-1) ])

[0107] =[z (wheel+3)0 ,z (wheel+3)1 ,…,z (wheel+3)(n-1) ]

[0108]

[0109] Step S213: Obtain X wheel+3 n components x (wheel+3)j Let test equal wheel + 3;

[0110] Step S22: Determine x testj whether it is *;

[0111] Step S23: If so, let test equal test + 1, perform the (test - 2)-th iteration process, and based on the obtained X test determine x test(j+1) , let j equal j + 1, and enter Step S22; if not, enter Step S24;

[0112] Step S24: Perform an L test transform on X -1 to obtain

[0113] X′ test = L -1 ([x test0 , x test1 , …, x test(n-1) ) = [x′ test0 , x′ test1 , …, x′ test(n-1) [[ID=Z36]]]

[0114] If there exists an x′ testj that is *, then the number of rounds of the periodic function of this cryptographic algorithm is l;

[0115] Otherwise, the number of rounds of the periodic function of this cryptographic algorithm is l - 1;

[0116] Step S25: Randomly select a master key K, and generate each round sub-key RK k-1 , where 0 < k < q; the position of the independent variable x of the cryptographic algorithm E K,q (·) is the non-zero bit position corresponding to the pattern of L -1 (X0); the position of the parameter α of the cryptographic algorithm E K,q (·) is the non-zero bit position corresponding to the patterns of X1, X2, X3; the output variable is the data value Data(x′ lj ) or Data(x lj ), defined as OUT r .

[0117] Furthermore, in the said Step S3, construct a periodic function based on the independent variable, parameter, and output variable; determine the period t based on the output variable, and verify the correctness of the constructed periodic function according to the period t, including:

[0118] Step S31: The periodic function constructed based on the independent variable, parameter, and output variable is:

[0119]

[0120] Period

[0121] Where α0 and α1 are the variable parameters, and g(x,α0) is the OUT value corresponding to the plaintext input (x,α0) after encryption. r g(x,α1) is the OUT value corresponding to the plaintext input (x,α1) after encryption. r RK0[1] is the first byte of the first round subkey generated by the master key K;

[0122] Step S32: Randomly select a master key K and input E. K,q (·) corresponds to two different sets of plaintext blocks, and each set of plaintext blocks corresponds to a plaintext pattern;

[0123] Each plaintext block is encrypted for r rounds, and the output is denoted as OUT. r and OUT' r ;

[0124] If the calculated OUT r and OUT' r If they are equal, the constructed periodic function is correct; otherwise, the constructed periodic function is incorrect.

[0125] In this invention, each group of plaintext blocks is encrypted in r rounds, for example:

[0126] X0=L[x,0,…,0]; X1=[α0,0,…,0]; X2=[α0,0,…,0]; X3=[v0,0,…,0];

[0127] X′1=[α1,0,…,0]; X′2=[α1,0,…,0]; X′3=[α1,0,…,0].

[0128] Furthermore, in step S4, the encryption algorithm E K,q (·) The total number of cycles equals q. Determine if the number of cycles r is greater than q. If the conditions are met, the cryptography to be tested is considered relatively secure under the quantum model; if the conditions are not met, the cryptography to be tested is considered insecure under the quantum model.

[0129] The present invention also provides a cryptographic periodicity evaluation device based on the SH structure, the device comprising:

[0130] Initialization module: Configured to obtain the cryptographic algorithm E to be evaluated. K,q (·), the cryptographic algorithm is based on the SH structure; where K represents the master key and q represents the original iteration round number of the cryptographic algorithm; the input of the cryptographic algorithm is converted into plaintext mode and the structural model of the cryptographic algorithm is constructed, the structural model of the cryptographic algorithm includes a list of input and output bit modes of the linear transformation L in the cryptographic algorithm;

[0131] Intermediate quantity acquisition module: configured to input plaintext mode into the structure model of cryptographic algorithm, perform round function iteration operation, and obtain the number of rounds, independent variables, parameters and output variables of the periodic function of cryptographic algorithm;

[0132] Verification module: Configured to construct a periodic function based on independent variables, parameters, and output variables; determine the period t based on the output variable; verify the correctness of the constructed periodic function based on the period t; and trigger the judgment module if it is correct.

[0133] Judgment module: Configured to determine whether the number of rounds of the periodic function is greater than half of the total number of rounds of the cryptographic algorithm to be evaluated. If it is satisfied, the evaluation result of the cryptographic algorithm to be evaluated is secure under the quantum model; if it is not satisfied, the evaluation result of the cryptographic algorithm to be evaluated is insecure under the quantum model.

[0134] The specific embodiments described above only illustrate the design principles of the present invention. The shapes and names of the components in this description may differ and are not limited. Therefore, those skilled in the art can modify or make equivalent substitutions to the technical solutions described in the foregoing embodiments; and these modifications and substitutions do not depart from the inventive spirit and technical solutions of the present invention, and should all fall within the protection scope of the present invention.

Claims

1. A method for measuring a password period based on SH structure, characterized in that, The method comprises the following steps: Step S1: obtaining a cryptographic algorithm E to be evaluated K,q (·), which is based on a SH structure; wherein K represents a master key, and q represents a primitive iteration round number of the cryptographic algorithm; converting an input of the cryptographic algorithm into a plaintext mode and constructing a structural model of the cryptographic algorithm, wherein the structural model of the cryptographic algorithm includes a list of input and output bit patterns of a linear transformation L in the cryptographic algorithm; Step S2: inputting the plaintext mode into the structural model of the cryptographic algorithm to perform a round function iteration operation, and obtaining the periodic function round number, independent variable, parameter and output variable of the cryptographic algorithm; Step S3: constructing a periodic function based on the independent variable, parameter and output variable; determining a period t based on the output variable, and verifying the correctness of the constructed periodic function according to the period t, and entering step S4 in the case of correctness; Step S4: judging whether the periodic function round number is greater than half of the total rounds of the cryptographic algorithm to be evaluated, and if yes, the evaluation result of the cryptographic algorithm to be evaluated is safe under the quantum model; and if no, the evaluation result of the cryptographic algorithm to be evaluated is unsafe under the quantum model.

2. The method of claim 1, wherein, In the step S1, the input of the cryptographic algorithm is converted into the plaintext mode, which comprises the following steps: The input of the cipher algorithm is divided into 4n blocks of plaintext, and the 4n blocks of plaintext are divided into a group of data blocks X'0, X'1, X'2, X'3 containing n components, denoted as X' i = [m i0 ,m i1 ,…,m i(n-1) ], wherein each component m i of X' ij is 1 byte, i = 0, 1, 2, 3; j = 0, …, n-1; and each component m ij in X'0, X'1, X'2, X'3 is converted into a bit component x ij according to a bit mode, i.e. X' = X + 1 i Transforming the data block X' into a bit pattern [x i0 ,x i1 ,…,x i(n-1) ] comprising n bit components, The converted X'0, X'1, X'2 and X'3 are denoted as X0, X1, X2 and X3 respectively, and X0, X1, X2 and X3 are combined to form the plaintext mode.

3. The method of any one of claims 1-2, wherein, The structural model expression of the cryptographic algorithm is as follows: where T num represents the T function constructed in the numth round, X num-1 , X num , X num+1 , X num+2 are the input patterns of the numth round, respectively, X num+3 is the output pattern of the numth round, is the XOR operation.

4. The method of claim 3, wherein, The structural model of the cryptographic algorithm performs r rounds of round function operations on X0, X1, X2 and X3, and the round function iteration operation is performed with X0, X1, X2 and X3 as the input of the first round; The round function operation of the num-th round, wherein 1≤num≤r, comprises the following steps: Step S11: obtaining the input of the num-th round, and denoting the input of the num-th round as Temp0, Temp1, Temp2 and Temp3; wherein when num is equal to 1, the input is the converted X0, X1, X2 and X3; and when num is not equal to 1, the input is the output of the (num-1)-th round; Step S12: constructing a T function; the T function is composed of an S-box layer transformation and a linear L layer transformation, wherein the S-box layer transformation is a table lookup replacement on bytes, and three symbols: Δ, *,? are set in the S-box layer transformation, and the table lookup rule is patterned as: And k is any one of non-zero symbols of 0, 1, Δ, *,?; the linear L layer transformation is a linear transformation on n components in Temp i based on the output mode list calculated by the coefficient matrix of the transformation L. Input Temp1, Temp2, and Temp3 into function T. For each component of the XOR sum of Temp1, Temp2, and Temp3, query the S-box. When all n components have been queried, the output vector [y] is obtained. 10 ,y 11 ,…,y 1(n-1) ];in, x 3j )for Query the results of the S-box; Step S13: Linear L-layer transformation is performed on the output vector [y 10 ,y 11 ,…,y 1(n-1) ], and the result of the linear L-layer transformation is taken as the output result of the T function, and the output result of the T function is [z 10 ,z 11 ,…,z 1(n-1) ] = L([y 10 ,y 11 ,…,y 1(n-1) ]). Step S14: XOR the output result [z 10 ,z 11 ,…,z 1(n-1) ] of the T function with Temp0 to obtain Temp4, Temp1, Temp2, Temp3 and Temp4 are taken as the output of the num-th round.

5. The method of claim 4, wherein, In the step S2, the plaintext mode is input into the structural model of the cryptographic algorithm to perform a round function iteration operation, and the periodic function round number, independent variable, parameter and output variable of the cryptographic algorithm are obtained, which comprises the following steps: Step S21: input the plaintext pattern X0, X1, X2, X3 into the structural model of the cryptographic algorithm, and perform l-3 rounds of iteration, and the result obtained is X l-3 l-2 l-1 l , l>3;​​​ wherein 1≤wheel≤l-3, and the wheel-th iteration process comprises the following steps: Step S211: record the input of the wheel as X wheel-1 ,X wheel ,X wheel+1 ,X wheel+2 ; Step S212: Calculate intermediate variable S wheel+3 , Y wheel+3 , Z wheel+3 , and X wheel+3 : Y wheel+3 = [S(s (wheel+3)0 ), S(s (wheel+3)1 ),..., S(s (wheel+3)(n-1) )] = [y (wheel+3)0 ,y (wheel+3)1 ,…,y (wheel+3)(n-1) ] Z wheel+3 = L([y (wheel+3)0 ,y (wheel+3)1 ,…,y (wheel+3)(n-1) ]) = [z (wheel+3)0 ,z (wheel+3)1 ,…,z (wheel+3)(n-1) ] Step S213: obtain X wheel+3 n components x (wheel+3)j ; let test equal wheel + 3; Step S22: judging whether x testj is *; Step S23: If yes, let test be equal to test + 1, and perform the test - 2 iteration process based on the obtained X test determine x test(j+1) , let j be equal to j + 1, and go to step S22; if no, go to step S24; Step S24: X test L -1 transformation, obtaining X′ test = L -1 ([x test0 ,x test1 ,…,x test(n-1) ]) = [x′ test0 ,x′ test1 ,…,x′ test(n-1) ] If x' exists testj If l, the periodic function round of the cryptographic algorithm is l; otherwise, the periodic function round number of the cryptographic algorithm is l-1; Step S25: Randomly select a master key K, and generate each round sub-key RK by a key scheduling algorithm k-1 where 0 < k < q; the cryptographic algorithm E K,q (·) The position of the argument x is L -1 (X0) The position of the non-0 bit corresponding to the mode; the cryptographic algorithm E K,q (·) The position of the argument a is X1, X2, X3, the position of the non-0 bit corresponding to the mode; the output variable is the data value Data(x lj ) or Data(x lj ) corresponding to the position, defined as OUT r .

6. The method of claim 5, wherein, In the step S3, the periodic function is constructed based on the independent variable, parameter and output variable; determining a period t based on the output variable, and verifying the correctness of the constructed periodic function according to the period t, which comprises the following steps: In the step S31, the periodic function constructed based on the independent variable, parameter and output variable is as follows: period wherein a0, a1 are variable parameters in the parameters, g(x, a0) is the OUT corresponding to the encryption of the (x, a0) plaintext input r , h(x, a1) is the OUT corresponding to the encryption of the (x, a1) plaintext input r , and RK0[1] is the first byte of the first round sub-key generated from the master key K. Step S32: randomly select a master key K, input E K,q (·) two different sets of corresponding plaintext blocks, each set of plaintext blocks corresponding to a plaintext pattern; r rounds of encryption are performed on each set of plaintext blocks, and the resulting outputs are denoted as OUT r and OUT' r ; If the calculated OUT r and OUT' r are equal, the constructed periodic function is correct; otherwise, the constructed periodic function is incorrect.

7. The method of claim 6, wherein, In said step S4, the encryption algorithm E K,q (·) all wheels are equal to q.

8. A cipher period evaluation device based on SH structure, characterized by, The method comprises the following steps: An initialization module is configured to obtain a password algorithm E to be tested K,q (·), which is based on a SH structure; wherein K represents a master key, and q represents a primitive iteration round number of the password algorithm; the input of the password algorithm is converted into a plaintext mode and a structural model of the password algorithm is constructed, wherein the structural model of the password algorithm includes a list of input and output bit patterns of a linear transformation L in the password algorithm; The intermediate quantity acquisition module is configured to input the plaintext mode into the structural model of the cryptographic algorithm to perform a round function iteration operation, and obtain the periodic function round number, independent variable, parameter and output variable of the cryptographic algorithm; The verification module is configured to construct a periodic function based on the independent variable, parameter and output variable; determining a period t based on the output variable, and verifying the correctness of the constructed periodic function according to the period t, and triggering the judgment module in the case of correctness; The judgment module is configured to judge whether the periodic function round number is greater than half of the total rounds of the cryptographic algorithm to be evaluated, and if yes, the evaluation result of the cryptographic algorithm to be evaluated is safe under the quantum model; and if no, the evaluation result of the cryptographic algorithm to be evaluated is unsafe under the quantum model.

9. A computer-readable storage medium, characterized in that, The storage medium stores a plurality of instructions; the plurality of instructions are used for loading and execution by a processor to perform the method in any one of claims 1-7.

10. An electronic device, comprising: The electronic device comprises: a processor configured to execute a plurality of instructions; a memory configured to store the plurality of instructions; wherein the plurality of instructions are stored in the memory and loaded and executed by the processor to perform the method in any one of claims 1-7.

Images