Data processing method and device for Keccak algorithm and computer equipment

Abstract

The invention relates to a data processing method and device for a Keccak algorithm and computer equipment. The method comprises the following steps: acquiring plaintext data and basic mask data of a Keccak algorithm, and performing bitwise XOR processing on the plaintext data based on the basic mask data to obtain first target data; performing transformation processing on the first target data by using a Keccak algorithm to obtain second target data; wherein in at least one target step of each round of the Keccak algorithm, the temporary mask data is used for calculation of the target step, and the basic mask data is updated based on the temporary mask data; and performing bitwise XOR processing on the second target data based on the processed basic mask data to obtain third target data, so that the third target data is the same as a result of performing transformation processing on the plaintext data by using a Keccak algorithm. By adopting the method, the security of the Keccak algorithm can be improved.

Description

Technical Field

[0001] This application relates to the field of data processing, and in particular to a data processing method, apparatus, and computer device for the Keccak algorithm. Background Technology

[0002] Side-channel attacks exploit the physical information leaked during the operation of cryptographic devices to obtain sensitive information such as keys. They are a major threat to secure components and commonly include electromagnetic attacks, timing attacks, and power consumption attacks. Side-channel attacks can lead to the theft of keys stored in secure components. Once the keys are compromised, attackers can forge identities, decrypt encrypted data, or tamper with information, causing serious damage to the entire system.

[0003] The TUAK authentication algorithm was developed by the European Telecommunications Standards Institute (ETSI). Its technical basis is the Keccak-f

[1600] sponge function (i.e., the SHA-3 standard algorithm). Its core purpose is to generate message authentication code (MAC), user response (RES) and encryption key (CK, IK) in the authentication and key negotiation (AKA) process of 3G, 4G and 5G mobile networks.

[0004] The lack of effective protection measures for the intermediate calculation results of the Keccak algorithm in related technologies allows attackers to potentially deduce these results through side-channel attacks, thereby reconstructing sensitive data in the TUAK authentication algorithm. In other words, the current TUAK authentication algorithm suffers from insufficient security in its use of the Keccak algorithm. Summary of the Invention

[0005] Therefore, it is necessary to provide a data processing method, apparatus, and computer device for the Keccak algorithm to address the aforementioned technical problems.

[0006] Firstly, this application provides a data processing method for the Keccak algorithm. The method includes:

[0007] Obtain the plaintext data and basic mask data of the Keccak algorithm, and perform bitwise XOR processing on the plaintext data based on the basic mask data to obtain the first target data;

[0008] The first target data is transformed using the Keccak algorithm to obtain the second target data; wherein, in at least one target step of each round of the Keccak algorithm, temporary mask data is used to calculate the target step, and the base mask data is updated based on the temporary mask data;

[0009] Based on the processed base mask data, the second target data is subjected to bitwise XOR processing to obtain the third target data, which is the same as the result of transforming the plaintext data using the Keccak algorithm.

[0010] In one embodiment, the calculation of the target step using temporary mask data and the updating of the base mask data based on the temporary mask data include:

[0011] A bitwise XOR operation with the temporary mask data is added during the calculation of the target step;

[0012] The temporary mask data can be used to perform a bitwise XOR operation on the base mask data to obtain the updated base mask data, or the temporary mask data can be used as the updated base mask data.

[0013] In one embodiment, the method further includes:

[0014] The basic mask data is not updated, and after the target step is completed, the output data of the target step and the temporary mask data are XORed to remove the temporary mask data from the output data.

[0015] In one embodiment, when the target step is the Theta step, the addition of a bitwise XOR operation with the temporary mask data during the calculation of the target step includes:

[0016] In the step of calculating the parity sum of each column of the input data for the Theta step, a bitwise XOR operation with the temporary mask data is added.

[0017] In one embodiment, when the target step is a Rho step, the addition of a bitwise XOR operation with the temporary mask data during the calculation of the target step includes:

[0018] After shifting each element of the input data in the Rho step, the shifted elements are XORed with the temporary mask data.

[0019] In one embodiment, when the target step is step Pi, the addition of a bitwise XOR operation with the temporary mask data during the operation of the target step includes:

[0020] From the input data of step Pi, determine any pair of first target elements and second target elements that need to be replaced;

[0021] The second target element, the mask element corresponding to the second target element in the basic mask data, the mask element corresponding to the first target element in the basic mask data, and the temporary mask data are subjected to bitwise XOR processing to obtain the first processing result;

[0022] The first target element, the mask element corresponding to the first target element in the basic mask data, the mask element corresponding to the second target element in the basic mask data, and the temporary mask data are subjected to bitwise XOR processing to obtain the second processing result.

[0023] The first processing result is used as the first target element, and the second processing result is used as the second target element.

[0024] In one embodiment, when the target step is the Chi step, the addition of a bitwise XOR operation with the temporary mask data during the calculation of the target step includes:

[0025] From the input data of the Chi step, determine any third target element that needs to undergo nonlinear transformation;

[0026] Perform a bitwise XOR operation on the first element to the right of the third target element and the basic mask data element corresponding to the first element to the right to obtain the fourth target element; and perform a bitwise XOR operation on the second element to the right of the third target element and the basic mask data element corresponding to the second element to the right to obtain the fifth target element.

[0027] The fourth target element is inverted, and the inverted fourth target element and the fifth target element are ANDed. The result of the AND operation and the temporary mask data are XORed to obtain the sixth target element.

[0028] Perform a bitwise XOR operation on the third target element and the sixth target element.

[0029] In one embodiment, when the target step is an Iota step, the addition of a bitwise XOR operation with the temporary mask data during the calculation of the target step includes:

[0030] Obtain the central channel from the input data of the Iota step, and obtain the wheel constant corresponding to the Iota step;

[0031] Perform a bitwise XOR operation on the central channel, the wheel constant, and the temporary mask data.

[0032] Secondly, this application also provides a data processing apparatus for the Keccak algorithm. The apparatus includes:

[0033] The masking module is used to obtain the plaintext data and basic mask data of the Keccak algorithm, and to perform bitwise XOR processing on the plaintext data based on the basic mask data to obtain the first target data.

[0034] A transformation module is used to transform the first target data using the Keccak algorithm to obtain the second target data; wherein, in at least one target step in each round of the Keccak algorithm, temporary mask data is used to calculate the target step, and the base mask data is updated based on the temporary mask data;

[0035] The first restoration module is used to perform bitwise XOR processing on the second target data based on the processed basic mask data to obtain the third target data, which is the same as the result of transforming the plaintext data using the Keccak algorithm.

[0036] In one embodiment, the transformation module is further configured to:

[0037] A bitwise XOR operation with the temporary mask data is added during the calculation of the target step;

[0038] The temporary mask data can be used to perform a bitwise XOR operation on the base mask data to obtain the updated base mask data, or the temporary mask data can be used as the updated base mask data.

[0039] In one embodiment, the apparatus further includes:

[0040] The second restoration module is used to not update the basic mask data, and after the target step is completed, to perform a bitwise XOR operation on the output data of the target step and the temporary mask data to remove the temporary mask data from the output data.

[0041] In one embodiment, the transformation module is further configured to:

[0042] In the step of calculating the parity sum of each column of the input data for the Theta step, a bitwise XOR operation with the temporary mask data is added.

[0043] In one embodiment, the transformation module is further configured to:

[0044] After shifting each element of the input data in the Rho step, the shifted elements are XORed with the temporary mask data.

[0045] In one embodiment, the transformation module is further configured to:

[0046] From the input data of step Pi, determine any pair of first target elements and second target elements that need to be replaced;

[0047] The second target element, the mask element corresponding to the second target element in the basic mask data, the mask element corresponding to the first target element in the basic mask data, and the temporary mask data are subjected to bitwise XOR processing to obtain the first processing result;

[0048] The first target element, the mask element corresponding to the first target element in the basic mask data, the mask element corresponding to the second target element in the basic mask data, and the temporary mask data are subjected to bitwise XOR processing to obtain the second processing result.

[0049] The first processing result is used as the first target element, and the second processing result is used as the second target element.

[0050] In one embodiment, the transformation module is further configured to:

[0051] From the input data of the Chi step, determine any third target element that needs to undergo nonlinear transformation;

[0052] Perform a bitwise XOR operation on the first element to the right of the third target element and the basic mask data element corresponding to the first element to the right to obtain the fourth target element; and perform a bitwise XOR operation on the second element to the right of the third target element and the basic mask data element corresponding to the second element to the right to obtain the fifth target element.

[0053] The fourth target element is inverted, and the inverted fourth target element and the fifth target element are ANDed. The result of the AND operation and the temporary mask data are XORed to obtain the sixth target element.

[0054] Perform a bitwise XOR operation on the third target element and the sixth target element.

[0055] In one embodiment, the transformation module is further configured to:

[0056] Obtain the central channel from the input data of the Iota step, and obtain the wheel constant corresponding to the Iota step;

[0057] Perform a bitwise XOR operation on the central channel, the wheel constant, and the temporary mask data.

[0058] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement any of the methods described above.

[0059] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements any of the above methods.

[0060] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements any of the above methods.

[0061] The aforementioned data processing method, apparatus, and computer equipment for the Keccak algorithm use basic mask data to mask plaintext data. In at least one step of each round of the Keccak algorithm, new temporary mask data is generated to protect the calculation of that step, and the basic mask data is updated synchronously using the temporary mask data. Because the basic mask data is constantly changing, it is difficult for attackers to deduce the specific value of the basic mask data using side information, thereby reducing the risk of attackers recovering plaintext data by cracking the basic mask data and improving the security of the Keccak algorithm. Attached Figure Description

[0062] Figure 1 This is a flowchart illustrating a data processing method for the Keccak algorithm in one embodiment;

[0063] Figure 2 This is a structural block diagram of a data processing device for the Keccak algorithm in one embodiment;

[0064] Figure 3 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0066] In one embodiment, such as Figure 1 As shown, a data processing method for the Keccak algorithm is provided. This embodiment illustrates the method applied to a server; however, it is understood that the method can also be applied to a terminal, or to a system including both a terminal and a server, and implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0067] Step 102: Obtain the plaintext data and basic mask data of the Keccak algorithm, and perform bitwise XOR processing on the plaintext data based on the basic mask data to obtain the first target data.

[0068] In this embodiment, the plaintext data is any data that needs to be processed using the Keccak algorithm in the TUAK authentication algorithm, and the base mask data is a data segment with the same length as the plaintext data. The base mask data can be randomly generated using a true random number generator to improve its security.

[0069] Before processing the plaintext data using the Keccak algorithm, a bitwise XOR operation is performed on the base mask data and the plaintext data to obtain the plaintext data protected by the base mask data (i.e., the first target data). The formulaic expression for this step is shown in Equation (I):

[0070] S_masked = S⊕keccak_dynamic_masks Formula (1)

[0071] Where S_masked is the plaintext data (i.e. the first target data) protected by the basic mask data, S is the plaintext data, ⊕ represents bitwise XOR, and keccak_dynamic_masks is the basic mask data (for convenience, keccak_dynamic_masks will be abbreviated as masks in the following text).

[0072] It should be noted that the bitwise XOR operation is performed on the basic mask data and the plaintext data here because the bitwise XOR operation satisfies the commutative and associative laws, and the result of bitwise XORing a number with itself is always 0. Therefore, after applying the Keccak algorithm to the first target data and performing necessary transformations on the basic mask data in some steps of the Keccak algorithm, performing a bitwise XOR operation on the basic mask data and the data output by the Keccak algorithm (i.e., the second target data) yields the same result as applying the Keccak algorithm to the plaintext data, which conveniently removes the basic mask data from the second target data.

[0073] Step 104: The first target data is transformed using the Keccak algorithm to obtain the second target data; wherein, in at least one target step in each round of the Keccak algorithm, temporary mask data is used to calculate the target step, and the basic mask data is updated based on the temporary mask data.

[0074] In the embodiments of the present application, the Keccak algorithm is used to process the first target data on a 32-bit processor. In the Keccak algorithm, the input data is converted into an array of 5×5×w (denoted as S, and an element in the array is denoted as S[x,y,z], where x is called the row, y is called the column, and z is called the lane). For each lane in the Keccak-f

[1600] array, it includes 64 bits (w = 64). When processing data on a 64-bit processor, each 64-bit data can be divided into data composed of the high 32 bits and data composed of the low 32 bits. The specific detailed processing flow will be described below and will not be elaborated here for the time.

[0075] The Keccak algorithm has a total of 24 rounds of transformation. In each round of transformation, five steps need to be sequentially executed, which are:

[0076] (1) The Theta (θ) step, which is used to perform column confusion on the array. The input array of the step is denoted as S, and the output array is denoted as S’. The process is as follows:

[0077] ① Calculate the parity check value of each column: that is, for all pairs (x,z) that satisfy 0≤x<5 and 0≤z<w, calculate C[x,z]=S[x,0,z]⊕S[x,1,z]⊕S[x,2,z]⊕S[x,3,z]⊕S[x,4,z];

[0078] ② Calculate the parity check value of the left column of each column and the bitwise exclusive OR result of the 1-bit left circular shift of the parity check value of the right column of each column: that is, for all pairs (x,z) that satisfy 0≤x<5 and 0≤z<w, calculate D[x,z]=C[(x - 1) mod 5,z]⊕C[(x + 1) mod 5,(z - 1) mod w];

[0079] ③ Perform a bitwise exclusive OR on each element and the D[x,z] of its corresponding column to obtain the output array of the Theta step: that is, for all triples (x,y,z) that satisfy 0≤x<5, 0≤y<5, and 0≤z<w, let: S’[x,y,z]=S[x,y,z]⊕D[x,z].

[0080] (2) The Rho (ρ) step, which is used to perform a circular shift on each element in the output array of the Theta step. The input array of the step is denoted as S, and the output array is denoted as S’. The process is as follows:

[0081] ① Fix the central lane, that is, for all z that satisfy 0≤z<w, let S’[0,0,z]=S[0,0,z];

[0082] ②Start processing from the channel at coordinate (1, 0): Initialize (x, y) = (1, 0), and for t from 0 to 23 (a total of 24 non-fixed channels are processed):

[0083] a. Cyclically shift the bits within the channel according to the shift number of bits: That is, for all z satisfying 0 ≤ z < w, let S’[x, y, z] = S[x, y, (z - (t + 1)(t + 2) / 2) mod w];

[0084] b. Determine the next coordinate to be processed: Let (x, y) = (y, (2x + 3y) mod 5);

[0085] Repeat step ② until all t have been traversed.

[0086] (3)Pi (π) step, used to rearrange the columns in the output array of the Rho step. The input array of the step is denoted as S, and the output array is denoted as S’. The process is as follows:

[0087] ① Swap the elements in the array pairwise: For all triples (x, y, z) satisfying 0 ≤ x < 5, 0 ≤ y < 5, 0 ≤ z < w, let: S’[x, y, z] = S[(x + 3y) mod 5, x, z].[[]]

[0088] (4)Chi (χ) step, used to perform row confusion on the output array of the Pi step. The input array of the step is denoted as S, and the output array is denoted as S’. The process is as follows:

[0089] ① For any element in the array, take the complement of the first element on the right side of the same row as this element, perform an AND operation on the result after taking the complement and the second element on the right side of the same row as this element, and perform an exclusive OR operation on the result of the AND operation and this element: That is, for all triples (x, y, z) satisfying 0 ≤ x < 5, 0 ≤ y < 5, 0 ≤ z < w, let: S’[x, y, z] = S[x, y, z] ⊕ ((S[(x + 1) mod 5, y, z] ⊕ 1) · S[(x + 2) mod 5, y, z]). Here, “·” represents integer multiplication, which is equivalent to the Boolean “AND” operation; “⊕1” represents taking the complement of this bit.

[0090] (5)Iota (ι) step, used to perform an exclusive OR operation on a round constant that is different in each round and the central channel in the output array of the Chi step. The input array of the step is denoted as S, and the output array is denoted as S’. The process is as follows:

[0091] ① Generate the round constant, and the round constant in each round is different, denoted as RC[r].[[]]

[0092] ②XOR the central channel and the round constants: That is, for all \(z\) such that \(0\leq z < w\), let \(S’[0,0,z]=S[0,0,z]\oplus RC[z]\).

[0093] After performing the above steps for 24 rounds, the output data of the Keccak algorithm is obtained. The output data can then be used for subsequent calculation operations of the TUAK algorithm.

[0094] In the embodiments of the present application, although the plaintext data is protected by the base mask data, if the base mask data does not change during the operation of the Keccak algorithm, the attacker may still be able to infer the specific value of the base mask data from the side-channel information, and then perform a bitwise XOR operation on the base mask data and the second target data output by the Keccak algorithm (i.e., the output data protected by the base mask data) to obtain the plaintext of the output data. Therefore, to increase the difficulty of inferring the base mask data, during the process of using the Keccak algorithm to process the first target data, a random temporary mask data can be used to protect the calculation of at least one step in each round, and the temporary mask data is used to update the base mask data. Accordingly, it can be ensured that the side information of the intermediate results of each round of operation is different, reducing the correlation between the intermediate results and the side information, and increasing the difficulty for the attacker to infer the base mask data and the plaintext data based on side-channel attacks.

[0095] Protecting the step calculation with random temporary mask data means adding a step of performing a preset operation with the temporary mask data during the calculation of the step. The temporary mask data can be different in each step of each round to improve the security of the temporary mask data. The preset operation needs to satisfy the following property: If a certain operation is performed on the base mask data and the temporary mask data to update the base mask data, then when performing a bitwise XOR operation on the result of the step and the updated base mask data, the data not protected by the base mask data can be restored.

[0096] The simplest preset operation that satisfies the above property is the bitwise XOR operation. In one example, using the temporary mask data to perform the calculation of the target step and updating the base mask data based on the temporary mask data includes:

[0097] Adding a bitwise XOR operation with the temporary mask data during the operation of the target step;

[0098] Performing a bitwise XOR operation on the base mask data with the temporary mask data to obtain the updated base mask data, or using the temporary mask data as the updated base mask data.

[0099] This application does not limit which operation of the bitwise XOR operation with the temporary mask data is added in the target step. It should be noted that the length of the temporary mask data should be equal to the length of other data involved in this operation to ensure that the bitwise XOR operation can be performed correctly.

[0100] In one embodiment, temporary mask data can also be used to protect the computation of steps that do not require updating the base mask data. In this case, the output data of the target step and the temporary mask data can be XORed after the target step is completed to remove the temporary mask data from the output data.

[0101] The following sections describe how to implement temporary mask data protection during the computation when the target steps are Theta, Rho, Pi, Chi, and Iota.

[0102] (1) In the Theta step, a bitwise XOR operation with the temporary mask data can be added at any point in the process described above. The temporary mask data used in the Theta step will be denoted as theta_masks.

[0103] First, since calculating the parity sum with a mask will lead to incorrect parity calculation, a bitwise XOR operation is needed to remove the basic mask data from the input data when calculating the parity sum in step ①. To avoid plaintext exposure, a bitwise XOR operation with the temporary mask data can be added simultaneously in step ①. The formula is expressed as in formula (II):

[0104] C[x,z]=(S_masked[x,0,z]⊕theta_masks[x]⊕masks[x,0])⊕(S_masked[x,1,z]⊕theta_masks[x]⊕masks[x,1])⊕(S_masked[x,2,z]⊕t heta_masks[x]⊕masks[x,2])⊕(S_masked[x,3,z]⊕theta_masks[x]⊕masks[x,3])⊕(S_masked[x,4,z]⊕theta_masks[x]⊕masks[x,4]) Formula (2)

[0105] Here, masks[x,0] refers to the data located in the i-th row and 0-th column after the basic mask data has been transformed into a 5×5 array identical to the input data. theta_masks[x] refers to the data in theta_masks corresponding to the x-th column.

[0106] If you choose to add temporary mask data in steps ② and ③, then simply perform a bitwise XOR operation with the temporary mask data in steps ② and ③. See formulas (III) and (IV):

[0107] D[x,z]=C[(x-1) mod 5,z]⊕C[(x+1) mod 5,(z-1) mod w]⊕theta_masks[x] Formula (III)

[0108] S_masked' [x,y,z] = S_masked[x,y,z]⊕D[x,z]⊕theta_masks[x] Formula (4)

[0109] At this point, the base mask data has been removed in step ①, and the plaintext data is protected by the temporary mask data. Therefore, if it is necessary to update the base mask data in this step, the temporary mask data can be used as the updated base mask data. If it is not necessary to update the base mask data in this step, the output data of this step, the temporary mask data, and the base mask data can be XORed bitwise to restore the plaintext data to the state protected by the base mask data.

[0110] (2) In the Rho step, a bitwise XOR operation with the temporary mask data can be added in step ② of the process described above. The temporary mask data used in the Rho step will be denoted as rho_masks.

[0111] Since left circular shift with a mask can lead to incorrect calculations, a bitwise XOR operation is needed to remove the base mask data from the input data before performing the left circular shift. To avoid plaintext exposure, a bitwise XOR operation with the temporary mask data is also required. The formula is expressed as in Formula (V):

[0112] S_masked'[x,y,z]=S_masked[x,y,(z-(t+1)(t+2) / 2) mod w]⊕rho_masks[x,y,z] Formula (5)

[0113] Similar to the Theta step, the base mask data has already been removed during the calculation, and the plaintext data is protected by temporary mask data. Therefore, if it is necessary to update the base mask data in this step, the temporary mask data can be used as the updated base mask data. If it is not necessary to update the base mask data in this step, the output data of this step, the temporary mask data, and the base mask data can be XORed bitwise to restore the plaintext data to the state protected by the base mask data.

[0114] When processing on a 64-bit processor, since shifting the number of bits r in a circular shift results in the same result as shifting the high 32 bits to the low 32 bits in a left circular shift of r bits and shifting the high 32 bits to the low 32 bits in a right circular shift of r-32 bits, the actual operation in the computer system is as follows to simplify the calculation:

[0115] First, calculate the temporary parameter k, which is the remainder of the shift number r and 32. That is, when r is less than 32, k equals r, and when r is greater than 32, k equals r-32.

[0116] Then, temporary states t[0] and t[1] are defined. t[0] represents the high 32 bits of the 64-bit data after left circular shift by k bits, and t[1] represents the low 32 bits of the 64-bit data after left circular shift by k bits. t[0] can be calculated using the bitwise OR result of left shifting the high 32 bits by k bits and right shifting the low 32 bits by 32-k bits, i.e., t[0] = (s[i+1][j] <<k)|(s[i][j]> >(32-k)). t[1] can be calculated using the bitwise OR result of shifting the lower 32 bits left by k bits and the higher 32 bits right by 32-k bits, i.e., t[1]=(s[i][j]<<k)|(s[i+1][j]> >(32-k)). Here, s[i][j] represents the address of the lower 32 bits of the 64-bit data after removing the basic mask data, and s[i+1][j] represents the address of the higher 32 bits of the 64-bit data after removing the basic mask data. Note that "<<" here represents bit shifting, not circular shifting.

[0117] While calculating t[0] and t[1], temporary mask data is used to protect t[0] and t[1] respectively, so that the plaintext of t[0] and t[1] will not appear in the calculation process. Here, t[0] and t[1] require two different temporary mask data, denoted as rho_masks_0 and rho_masks_1 respectively. Therefore, the calculation formula used in the application is actually as shown in formulas (vi) and (vii):

[0118] t[0]=((S_masked[i+1][j]⊕masks[i+1][j])<<k)|(S_masked[i][j]⊕masks[i][j]> >(32-k))⊕rho_masks_0[i][j] Formula (VI)

[0119] t[1]=((S_masked[i][j]⊕masks[i][j])<<k)|(S_masked[i+1][j]⊕masks[i+1][j]> >(32-k))⊕rho_masks_1[i][j] Formula (VII)

[0120] Where S_masked[i][j] is the address of the lower 32 bits of the 64-bit data, and S_masked[i+1][j] is the address of the higher 32 bits of the 64-bit data. It should be noted that in formulas (vi) and (vii), << and >> represent shifting. In other formulas of this application, unless otherwise stated, << and >> should be regarded as circular shifting.

[0121] Then, depending on whether r is greater than 32, it is determined whether to swap the high 32 bits and the low 32 bits. That is, if r is less than (or equal to) 32, the high 32 bits t[0], which represents the 64-bit data after left circular shift by k bits, are assigned to S_masked[i+1][j], which originally represents the high 32 bits, and the low 32 bits t[1], which represents the 64-bit data after left circular shift by k bits, are assigned to S_masked[i][j]. If r is greater than 32, the high and low bits are swapped, t[0] is assigned to S_masked[i][j], and t[1] is assigned to S_masked[i+1][j].

[0122] If the base mask data needs to be updated in this step, it should be noted that if the high and low bits are swapped, masked[i][j] should be updated to the temporary mask data rho_masks_0[i][j] used when calculating t[0], and masked[i+1][j] should be updated to the temporary mask data rho_masks_1[i][j] used when calculating t[1]. If the high and low bits are not swapped, masked[i][j] is updated to rho_masks_1[i][j] of t[1], and masked[i+1][j] is updated to rho_masks_0[i][j] of t[0].

[0123] (3) Since the Pi step only involves the rearrangement of elements and does not involve exposing the plaintext of elements due to the need to remove the basic mask data for calculation, it is usually not necessary to add additional temporary mask data in the Pi step. However, in special cases where elements need to be rearranged without rearranging the basic mask data, and thus the basic mask data needs to be removed, temporary mask data can be added in the step of removing the basic mask data for protection. The temporary mask data used in the Pi step will be denoted as pi_masks. The specific steps include:

[0124] From the input data of step Pi, determine any pair of first and second target elements that need to be replaced;

[0125] Perform a bitwise XOR operation on the second target element, the mask element corresponding to the second target element in the basic mask data, the mask element corresponding to the first target element in the basic mask data, and the temporary mask data to obtain the first processing result;

[0126] Perform a bitwise XOR operation on the first target element, the mask element corresponding to the first target element in the basic mask data, the mask element corresponding to the second target element in the basic mask data, and the temporary mask data to obtain the second processing result;

[0127] The first processing result is used as the first target element, and the second processing result is used as the second target element.

[0128] The first and second target elements are the pairs of elements that need to be swapped, calculated according to the new position calculation formula mentioned earlier. Let's denote the first target element as S_masked[x,y,z] and the second target element as S_masked[(x+3y) mod 5,x,z]. The above process is equivalent to removing the basic mask data from the second target element, reusing the basic mask data and temporary mask data corresponding to the first target element to protect the second target element, and then moving the protected second target element to the position of the first target element. A similar operation is performed on the first target element, so that when the second and first target elements are swapped, the basic mask data does not need to be swapped simultaneously.

[0129] The formulas are shown in formulas (8) and (9):

[0130] S_masked[x,y,z]=(S_masked[(x+3y) mod 5,x,z]⊕masks[(x+3y) mod 5,x,z])⊕masks[x,y,z]⊕pi_masks[x,y,z] Formula (8)

[0131] S_masked[(x+3y) mod 5,x,z]=(S_masked[x,y,z]⊕masks[x,y,z])⊕masks[(x+3y) mod 5,x,z]⊕pi_masks[(x+3y) mod 5,x,z] Formula (9)

[0132] At this point, the plaintext data is protected by both the base mask data and the temporary mask data. If it is necessary to update the base mask data in this step, the bitwise XOR result of the temporary mask data and the base mask data can be used as the updated base mask data. If it is not necessary to update the base mask data in this step, the bitwise XOR result of the output data of this step and the temporary mask data can be used to restore the plaintext data to the state protected by the base mask data.

[0133] In one embodiment, since it can be seen from the above formulas (viii) and (ix) that the plaintext of the first target element and the second target element will not be exposed even if the temporary mask data is not added, the temporary mask data can be left unadded in the Pi step if the basic mask data does not need to be updated in the Pi step.

[0134] (4) In the Chi step, a bitwise XOR operation with the temporary mask data can be added at any point in the aforementioned process. The temporary mask data used in the Chi step will be denoted as chi_masks.

[0135] First, since calculating the mask in step ① would result in an incorrect result, a bitwise XOR operation is needed in step ① to remove the basic mask data from the input data. When adding temporary mask data in this step, the steps are as follows:

[0136] From the input data of the Chi step, determine any third target element that needs to undergo nonlinear transformation;

[0137] Perform a bitwise XOR operation on the first element to the right of the third target element and the corresponding basic mask data element to obtain the fourth target element. Then, perform a bitwise XOR operation on the second element to the right of the third target element and the corresponding basic mask data element to obtain the fifth target element.

[0138] Invert the fourth target element, perform an AND operation on the inverted fourth target element and the fifth target element, and perform a bitwise XOR operation on the result of the AND operation and the temporary mask data to obtain the sixth target element.

[0139] Perform a bitwise XOR operation on the third and sixth target elements.

[0140] The definitions of the first and second elements on the right can be found in the previous text and will not be repeated here. To avoid plaintext exposure, in practical applications, the aforementioned calculation of the fourth, fifth, and sixth target elements is completed in one step. A temporary state formula t[0] is defined to store the sixth target element, and the formula is expressed as formula (x):

[0141] t[0]=¬(S[(x+1) mod 5,y,z]⊕masks[(x+1) mod 5,y,z])∧(S_masked[(x+2)mod 5,y,z]⊕masks[(x+2) mod 5,y,z])⊕chi_masks[(x+2) mod 5,y,z] Formula (10)

[0142] Since ¬(A⊕B) ≡ (¬A)⊕B holds true for any binary numbers A and B, and the AND operation satisfies the distributive law, the above formula (x) is expanded into formula (xi) for calculation in practical applications:

[0143] t[0]=(¬S_masked[(x+1) mod 5,y,z]⊕masks[(x+1) mod 5,y,z])∧(S_masked[(x+2) mod 5,y,z]⊕masks[(x+2) mod 5,y,z])⊕chi_masks[x,y,z]

[0144] =(¬S_masked[(x+1) mod 5,y,z]∧S_masked[(x+2) mod 5,y,z])⊕(¬S_masked[(x+1) mod 5,y,z]∧masks[(x+2) mod 5,y,z])⊕(masks[(x+1) mod 5,y,z]∧S_maskeds[(x+2) mod 5,y,z])⊕(masks[(x+1) mod 5,y,z]∧masks[(x+2) mod 5,y,z])⊕chi_masks[x,y,z] Formula (11)

[0145] If you choose to add temporary mask data in step ②, then you can add an additional bitwise XOR operation with the temporary mask data in step ②. See formula (12):

[0146] S_masked'[x,y,z]=S_masked[x,y,z]⊕t[0]⊕chi_masks[x,y,z] formula (12)

[0147] Then, a bitwise XOR operation is performed between the sixth target element and the third target element. At this point, the third target element is protected by both the base mask data and the temporary mask data. If it is necessary to update the base mask data in this step, the bitwise XOR result of the temporary mask data and the base mask data can be used as the updated base mask data. If it is not necessary to update the base mask data in this step, a bitwise XOR operation can be performed between the output data of this step and the temporary mask data to restore the plaintext data to the state protected by the base mask data.

[0148] (5) In the Iota step, a bitwise XOR operation with the temporary mask data can be added at any point in the aforementioned process. The temporary mask data used in the Iota step will be denoted as iota_masks.

[0149] Adding temporary mask data in step ① is equivalent to performing a bitwise XOR operation on the round constant and the temporary mask data, as shown in formula (xiii):

[0150] Formula (13): RC'[r] = RC[r]⊕iota_masks

[0151] Adding temporary mask data in step ② is equivalent to performing a bitwise XOR operation on the wheel constant, the center channel, and the temporary mask data. The specific steps are as follows:

[0152] Obtain the central channel from the input data of the Iota step, and obtain the corresponding round constants of the Iota step;

[0153] Perform a bitwise XOR operation on the central channel, wheel constants, and temporary mask data.

[0154] The formula form can be seen in formula (XIV):

[0155] S_masked'[0,0,0]=S_masked[0,0,0]⊕RC[r]⊕iota_masks formula (14)

[0156] At this point, the central channel is protected by both basic mask data and temporary mask data. If it is necessary to update the basic mask data in this step, the bitwise XOR result of the temporary mask data and the basic mask data can be used as the updated basic mask data. If it is not necessary to update the basic mask data in this step, the bitwise XOR result of the output data of this step and the temporary mask data can be used to restore the plaintext data to the state protected by the basic mask data.

[0157] Step 106: Perform bitwise XOR processing on the second target data based on the updated base mask data to obtain the third target data, so that the third target data is the same as the result of transforming the plaintext data using the Keccak algorithm.

[0158] In this embodiment, due to the characteristics of the XOR operation, after 24 rounds of transformation, the second target data output by the Keccak algorithm is bitwise XORed with the updated base mask data as described in the aforementioned embodiment. This yields a third target data equivalent to the result of transforming plaintext data using the Keccak algorithm. This achieves the goal of disrupting side information during the execution of the Keccak algorithm, improving its security, while simultaneously restoring the result of the Keccak algorithm's transformation of plaintext data.

[0159] The data processing method for the Keccak algorithm provided in this application uses basic mask data to mask plaintext data. In at least one step of each round of the Keccak algorithm, new temporary mask data is generated to protect the calculation of that step, and the basic mask data is updated synchronously using the temporary mask data. Because the basic mask data is constantly changing, it is difficult for attackers to deduce the specific value of the basic mask data using side information, thereby reducing the risk of attackers recovering plaintext data by cracking the basic mask data and improving the security of the Keccak algorithm.

[0160] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0161] Based on the same inventive concept, this application also provides a data processing apparatus for the Keccak algorithm to implement the aforementioned data processing method for the Keccak algorithm. The solution provided by this apparatus is similar to the implementation described in the above method. Therefore, the specific limitations in one or more embodiments of the data processing apparatus for the Keccak algorithm provided below can be found in the limitations of the data processing method for the Keccak algorithm described above, and will not be repeated here.

[0162] In one embodiment, such as Figure 2 As shown, a data processing device 200 for the Keccak algorithm is provided, including: a masking module 202, a transformation module 204, and a first restoration module 206, wherein:

[0163] The mask module 202 is used to obtain the plaintext data and basic mask data of the Keccak algorithm, and to perform bitwise XOR processing on the plaintext data based on the basic mask data to obtain the first target data;

[0164] The transformation module 204 is used to transform the first target data using the Keccak algorithm to obtain the second target data; wherein, in at least one target step in each round of the Keccak algorithm, temporary mask data is used to calculate the target step, and the base mask data is updated based on the temporary mask data;

[0165] The first restoration module 206 is used to perform bitwise XOR processing on the second target data based on the processed basic mask data to obtain the third target data, which is the same as the result of transforming the plaintext data using the Keccak algorithm.

[0166] In one embodiment, the transformation module 204 is further configured to:

[0167] A bitwise XOR operation with the temporary mask data is added during the calculation of the target step;

[0168] The temporary mask data can be used to perform a bitwise XOR operation on the base mask data to obtain the updated base mask data, or the temporary mask data can be used as the updated base mask data.

[0169] In one embodiment, the apparatus further includes:

[0170] The second restoration module is used to not update the basic mask data, and after the target step is completed, to perform a bitwise XOR operation on the output data of the target step and the temporary mask data to remove the temporary mask data from the output data.

[0171] In one embodiment, the transformation module 204 is further configured to:

[0172] In the step of calculating the parity sum of each column of the input data for the Theta step, a bitwise XOR operation with the temporary mask data is added.

[0173] In one embodiment, the transformation module 204 is further configured to:

[0174] After shifting each element of the input data in the Rho step, the shifted elements are XORed with the temporary mask data.

[0175] In one embodiment, the transformation module 204 is further configured to:

[0176] From the input data of step Pi, determine any pair of first target elements and second target elements that need to be replaced;

[0177] The second target element, the mask element corresponding to the second target element in the basic mask data, the mask element corresponding to the first target element in the basic mask data, and the temporary mask data are subjected to bitwise XOR processing to obtain the first processing result;

[0178] The first target element, the mask element corresponding to the first target element in the basic mask data, the mask element corresponding to the second target element in the basic mask data, and the temporary mask data are subjected to bitwise XOR processing to obtain the second processing result.

[0179] The first processing result is used as the first target element, and the second processing result is used as the second target element.

[0180] In one embodiment, the transformation module 204 is further configured to:

[0181] From the input data of the Chi step, determine any third target element that needs to undergo nonlinear transformation;

[0182] Perform a bitwise XOR operation on the first element to the right of the third target element and the basic mask data element corresponding to the first element to the right to obtain the fourth target element; and perform a bitwise XOR operation on the second element to the right of the third target element and the basic mask data element corresponding to the second element to the right to obtain the fifth target element.

[0183] The fourth target element is inverted, and the inverted fourth target element and the fifth target element are ANDed. The result of the AND operation and the temporary mask data are XORed to obtain the sixth target element.

[0184] Perform a bitwise XOR operation on the third target element and the sixth target element.

[0185] In one embodiment, the transformation module 204 is further configured to:

[0186] Obtain the central channel from the input data of the Iota step, and obtain the wheel constant corresponding to the Iota step;

[0187] Perform a bitwise XOR operation on the central channel, the wheel constant, and the temporary mask data.

[0188] Each module in the above-mentioned device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0189] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 3 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When executed by the processor, the computer program implements a data processing method based on the Keccak algorithm.

[0190] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0191] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0192] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0193] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0194] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0195] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0196] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0197] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A data processing method for the Keccak algorithm, characterized in that, The method includes: Obtain the plaintext data and basic mask data of the Keccak algorithm, and perform bitwise XOR processing on the plaintext data based on the basic mask data to obtain the first target data; The first target data is transformed using the Keccak algorithm to obtain the second target data; wherein, in at least one target step of each round of the Keccak algorithm, temporary mask data is used to calculate the target step, and the base mask data is updated based on the temporary mask data; Based on the processed base mask data, the second target data is subjected to bitwise XOR processing to obtain the third target data, which is the same as the result of transforming the plaintext data using the Keccak algorithm.

2. The method according to claim 1, characterized in that, The step of calculating the target step using temporary mask data and updating the base mask data based on the temporary mask data includes: A bitwise XOR operation with the temporary mask data is added during the calculation of the target step; The temporary mask data can be used to perform a bitwise XOR operation on the base mask data to obtain the updated base mask data, or the temporary mask data can be used as the updated base mask data.

3. The method according to claim 2, characterized in that, The method further includes: The basic mask data is not updated, and after the target step is completed, the output data of the target step and the temporary mask data are XORed to remove the temporary mask data from the output data.

4. The method according to claim 2, characterized in that, When the target step is the Theta step, the bitwise XOR operation with the temporary mask data is added during the calculation of the target step, including: In the step of calculating the parity sum of each column of the input data for the Theta step, a bitwise XOR operation with the temporary mask data is added.

5. The method according to claim 2, characterized in that, When the target step is a Rho step, the addition of a bitwise XOR operation with the temporary mask data during the calculation of the target step includes: After shifting each element of the input data in the Rho step, the shifted elements are XORed with the temporary mask data.

6. The method according to claim 2, characterized in that, When the target step is step Pi, the addition of a bitwise XOR operation with the temporary mask data during the calculation of the target step includes: From the input data of step Pi, determine any pair of first target elements and second target elements that need to be replaced; The second target element, the mask element corresponding to the second target element in the basic mask data, the mask element corresponding to the first target element in the basic mask data, and the temporary mask data are subjected to bitwise XOR processing to obtain the first processing result; The first target element, the mask element corresponding to the first target element in the basic mask data, the mask element corresponding to the second target element in the basic mask data, and the temporary mask data are subjected to bitwise XOR processing to obtain the second processing result. The first processing result is used as the first target element, and the second processing result is used as the second target element.

7. The method according to claim 2, characterized in that, When the target step is the Chi step, the addition of a bitwise XOR operation with the temporary mask data during the calculation of the target step includes: From the input data of the Chi step, determine any third target element that needs to undergo nonlinear transformation; Perform a bitwise XOR operation on the first element to the right of the third target element and the basic mask data element corresponding to the first element to the right to obtain the fourth target element; and perform a bitwise XOR operation on the second element to the right of the third target element and the basic mask data element corresponding to the second element to the right to obtain the fifth target element. The fourth target element is inverted, and the inverted fourth target element and the fifth target element are ANDed. The result of the AND operation and the temporary mask data are XORed to obtain the sixth target element. Perform a bitwise XOR operation on the third target element and the sixth target element.

8. The method according to claim 2, characterized in that, When the target step is an Iota step, the addition of a bitwise XOR operation with the temporary mask data during the calculation of the target step includes: Obtain the central channel from the input data of the Iota step, and obtain the wheel constant corresponding to the Iota step; Perform a bitwise XOR operation on the central channel, the wheel constant, and the temporary mask data.

9. A data processing device for the Keccak algorithm, characterized in that, The device includes: The masking module is used to obtain the plaintext data and basic mask data of the Keccak algorithm, and to perform bitwise XOR processing on the plaintext data based on the basic mask data to obtain the first target data. A transformation module is used to transform the first target data using the Keccak algorithm to obtain the second target data; wherein, in at least one target step in each round of the Keccak algorithm, temporary mask data is used to calculate the target step, and the base mask data is updated based on the temporary mask data; The first restoration module is used to perform bitwise XOR processing on the second target data based on the processed basic mask data to obtain the third target data, which is the same as the result of transforming the plaintext data using the Keccak algorithm.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

Images