Message leakage detection method for SHA-3 hash algorithm

Abstract

The invention relates to a message leakage detection method for an SHA-3 hash algorithm, and the method comprises the steps: firstly, randomly generating a message to be processed, taking the message as the input of the SHA-3 algorithm, employing an 8-bit random fault model, importing a random 8-bit fault in the last but one round, and outputting error output. An intermediate state value at a matching position and an intermediate state value at a fault import position are reversely deduced by enumerating 8 bits in a message, the range of an internal state is narrowed through the matching relation of the intermediate state values calculated by the two parts, and the fault import and analysis process is repeated for multiple times, so that a complete intermediate state value is restored; and then obtaining an originally input message. The method provided by the invention is easy to implement, high in speed and high in accuracy, and an important analysis basis is provided for the security research of the SHA-3 hash algorithm.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, in particular to a message leakage detection method for SHA-3 hash algorithm. BACKGROUND

[0002] With the increasing complexity of software systems, memory safety issues such as buffer overflow and post-use release become increasingly serious. These problems are often exploited by attackers, leading to data leakage and system crashes. Therefore, it is particularly important to develop encryption techniques that can effectively protect against these attacks. The development of SHA-3 algorithm began in 2007, initiated by the National Institute of Standards and Technology of the United States, aiming to find a new hash algorithm to replace the SHA-2 series. NIST invited cryptographers around the world to submit their algorithm designs through a global public competition. After several rounds of screening and evaluation, in 2012, the KECCAK algorithm was selected as the SHA-3 standard. SHA-3 hash algorithm contains four variants: SHA3-224, SHA3-256, SHA3-384 and SHA3-512, corresponding to 224-bit, 256-bit, 384-bit and 512-bit output respectively, and their message packet sizes are 1152 bits, 1088 bits, 832 bits and 576 bits respectively. All variants support 512-bit data blocks, and the difference between variants is only the output length, so in this paper we mainly study SHA3-512.

[0003] Intermediate meet statistics fault analysis is a cryptographic analysis technique that uses intentionally introduced faults (such as hardware faults) during the execution of a cryptographic algorithm to analyze and attack the algorithm. This analysis method does not require the attacker to have internal information about the algorithm, but rather observes the behavior of the algorithm when a fault occurs to infer the weaknesses of the algorithm. Intermediate meet uses the matching relationship between forward calculation and backward calculation to reduce the complexity of fault analysis. There is currently no related report evaluating the ability of SHA-3 algorithm to resist intermediate meet statistical fault attacks, which leaves a security risk for products that are using SHA-3 algorithm encapsulation. SUMMARY

[0004] The technical problem to be solved by the present application is to provide a message leakage detection method for SHA-3 hash algorithm, which can evaluate the ability of SHA-3 hash algorithm to resist intermediate meet statistical fault attacks.

[0005] The technical solution adopted by the present application to solve its technical problem is: providing a message leakage detection method for SHA-3 hash algorithm, comprising the following steps: Step S1, randomly generating a message to be processed; Step S2, using SHA3-512 algorithm to map the message, and importing random 8-bit fault in the second-to-last round of the absorption stage of the sponge structure, collecting the fault outputs affected by the fault; Step S3, according to the position of the random 8-bit fault injection, combining the fault outputs affected by the fault, and deducing the intermediate state value at the matching place by enumerating the 8 bits in the message; Step S4, according to the position of the random 8-bit fault injection, combining the fault outputs affected by the fault, and deducing the intermediate state value at the fault injection place by enumerating the 8 bits in the message; Step S5, matching the intermediate state value at the matching place and the intermediate state value at the fault injection place, calculating the Hamming weight of the intermediate state value at the fault injection place that matches successfully, and calculating the Hamming distance between the Hamming weight of the intermediate state value at the fault injection place that matches successfully and the theoretical value, selecting the intermediate state value at the fault injection place corresponding to the smallest Hamming distance value as the 8 bits of the input value under the second-to-last round of fault; Step S6, repeating steps S2-S5, and making the introduction position of each fault different to obtain the input value under the second-to-last round of fault; Step S7, restoring the message according to the input value under the second-to-last round of fault.

[0006] Between the step S2 and the step S3, further comprising: determining whether the number of the fault outputs affected by the fault reaches a preset number; If the number of the fault outputs affected by the fault does not reach the preset number, returning to step S1; If the number of the fault outputs affected by the fault reaches the preset number, entering step S3.

[0007] The calculation formula of the intermediate state value at the matching place in the step S3 is: Wherein, is the value after the second-to-last round of bit permutation operation, is the inverse operation of the second-to-last round of nonlinear operation; is the inverse operation of the second-to-last round of round constant addition; is the input under the second-to-last round of fault, which is obtained by exclusive OR operation of the fault output of the second-to-last round and the message, is the message, is the exclusive OR operation.

[0008] The calculation formula of the intermediate state value at the fault injection place in the step S4 is: Wherein, is the intermediate state value at the fault injection place, inverse operation of the second-to-last round of the nonlinear operation, inverse operation of the second-to-last round of the cyclic shift operation, inverse operation of the second-to-last round of the transposition operation, inverse operation of the second-to-last round of the nonlinear operation; inverse operation of the second-to-last round of the nonlinear operation, input under the second-to-last round of the fault, message, exclusive or operation.

[0009] When the intermediate state value at the matching position and the intermediate state value at the fault introduction position are matched in step 5, the matching relationship established is: ; wherein, represents the state of the first x row of the first y column of the high, z byte at the position, inverse operation of the second-to-last round of the nonlinear operation, represents the 0th bit, the 1st bit, the 2nd bit, the 3rd bit, the 4th bit, the 5th bit, the 6th bit and the 7th bit of the output of the second-to-last round under the fault, represents the 0th bit, the 1st bit, the 2nd bit, the 3rd bit, the 4th bit, the 5th bit, the 6th bit and the 7th bit of the input of the second-to-last round under the fault, represents the negation of the current state, is the second-to-last round of the parity operation, represents the second-to-last round of the transposition operation, represents the second-to-last round of the cyclic shift operation, exclusive or operation, bitwise and operation.

[0010] The step S7 is specifically: performing exclusive or operation on the input value under the second-to-last round of the fault and the first 576 bits of the fault output value of the second-to-last round to obtain the message.

[0011] In step S2, the random 8-bit fault is introduced by the method of software simulation, or laser, electromagnetic and voltage interference means.

[0012] Advantages Compared with the prior art, the present application has the following advantages and positive effects: the present application firstly generates a message to be processed at random, and imports the message as an input of the SHA-3 algorithm, introduces a random 8-bit fault, obtains a corresponding error output according to the position of each fault, reversely deduces the intermediate state value at the matching position and the intermediate state value at the fault introduction position by enumerating the 8 bits in the message, narrows the range of the internal state through the matching relationship of the intermediate state values calculated by two parts, repeatedly introduces the fault and analyzes the process multiple times, and then restores the complete intermediate state value, and then obtains the originally input message. The method provided by the present application is easy to implement, fast and high in accuracy, and provides an important analysis basis for the security research of the SHA-3 hash algorithm. BRIEF DESCRIPTION OF DRAWINGS

[0013] Figure 1 A flow chart of steps for detecting whether the hash algorithm SHA-3 resists the intermediate meeting statistical fault attack; Figure 2 A fault propagation diagram for the SHA-3 hash algorithm resisting the intermediate meeting statistical fault attack; Figure 3 An algorithm structure diagram of the SHA-3 hash algorithm; Figure 4 A schematic diagram of an experimental environment of the present application. DETAILED DESCRIPTION

[0014] The present application will be further described below in combination with specific embodiments. It should be understood that these embodiments are only used to illustrate the present application and not used to limit the scope of the present application. In addition, it should be understood that after reading the content taught by the present application, those skilled in the art can make various modifications or changes to the present application, and these equivalent forms also fall within the scope defined by the appended claims of the present application.

[0015] Basic symbol explanation: : message, ; : fault output, ; : intermediate state, ; : assume is the current state, represents bitwise NOT; : parity operation; : cyclic shift operation; : transposition operation; : nonlinear operation; : inverse of a round constant addition; : inverse of a parity operation; : inverse of a cyclic shift operation; : inverse of a transposition operation; : inverse of a nonlinear operation; : inverse of a round constant addition; : exclusive OR operation; : bitwise AND operation; ||: concatenation.

[0016] Figure 1 A flow chart of a method for detecting that a SHA-3 hash algorithm resists a statistical fault attack of a middle meeting according to an embodiment of the present application is provided. When a same message is processed using a SHA-3 hash algorithm, an attacker can obtain an error output by introducing a random 8-bit fault using a software simulation method or a laser, electromagnetic and voltage interference means, and deduce key information according to the error output. The attacker can induce a random fault in the execution process of the SHA-3 algorithm, but the specific position of the fault introduction is not clear. Therefore, it is particularly important to obtain the position of the fault introduction. The present application adopts an 8-bit random fault model, and the fault position is the penultimate round. The method specifically includes the following steps: Step 1: randomly generating a message to be processed M .

[0017] Step 2: mapping the message using a SHA3-512 algorithm M , and introducing a random 8-bit fault in the absorption stage of the sponge structure to generate a fault output, wherein, in the process of mapping the message (see Figure 3 ), the length of the internal state of the SHA3-512 is 1600 bits, the group length is 576 bits, the KECCAK-f cipher permutation is used in the sponge structure, and a total of 24 rounds of iteration is required in the encryption process. In the present embodiment, the fault introduction position is the penultimate round.

[0018] Step 3: judging whether the number of fault outputs reaches a preset number, if not, repeating steps 1 to 2 until the preset number of fault outputs is obtained , the preset number of the present embodiment is 150, if yes, entering step 4.

[0019] The present application can select the experimental environment shown in Figure 4 , wherein a computer is used to generate the input message of SHA-3 , and process and analyze the output result after the input is processed by the SHA-3 algorithm; the device encapsulating the SHA-3 algorithm is used to process the input message and obtain the corresponding output result; the device for importing faults is used to perform the importing fault action, and the importing fault action is performed in the running process of the SHA-3 algorithm, so that the error output is obtained. The device for importing faults can be realized by software simulation method, or the real hardware can be processed by technical means such as laser, electromagnetic and voltage interference, so that the SHA-3 hash algorithm is disturbed, the SHA-3 is induced to produce faults in the running process, and the error output is obtained.

[0020] Step 4: Calculate the intermediate state. Assuming that the random fault injection position is as shown in Figure 2 , the intermediate state value at the matching position is reversely deduced by enumerating 8 bits in the message M . For the 640 bits affected by fault diffusion, 464 bits are not involved in the XOR operation with the message M , and the remaining 176 bits are diffused by 8-bit XOR operation. Only the values participating in the XOR operation, i.e. '0' and '1', need to be enumerated 8 times. The deducing process of the intermediate state value at the matching position is as follows: ; Thus, the intermediate state value at the matching position, i.e. the value after the last but one round of transposition operation , can be obtained, wherein is the input under the last but two rounds of faults (i.e. the intermediate state of the last but two rounds), which can be obtained by XOR operation between the fault output of the last but two rounds and the message, represents the inverse operation of the nonlinear layer of the last but two rounds, represents the inverse operation of the round constant addition of the last but two rounds.

[0021] Step 5: Calculate the value at the fault injection position. Assuming that the random fault injection position is as shown in Figure 2 , the intermediate state value at the fault injection position is reversely deduced by enumerating 8 bits in the message . For the 640 bits affected by fault diffusion, 464 bits are not involved in the XOR operation with the message, and the remaining 176 bits are diffused by 8-bit XOR operation. Only the values participating in the XOR operation, i.e. '0' and '1', need to be enumerated 8 times. The deducing process of the intermediate state value at the fault injection position is as follows: ; Thus, the intermediate state value at the fault injection position ,in, It's a message. This indicates the input under the last round of failure. This represents the value after the penultimate injection failure. This is the inverse operation of the penultimate parity check. This is the inverse operation of the penultimate round of cyclic shift. This is the inverse operation of the penultimate round of transposition. This is the inverse operation of the penultimate round of nonlinear operations; This is the inverse operation of adding the constant of the penultimate round.

[0022] Step 6: Match the intermediate state values ​​at the matching points with the intermediate state values ​​at the fault induction points. Using statistical methods, calculate the Hamming weight of the intermediate state value at the successfully matched fault induction point and its Hamming distance from the theoretical value. The Hamming weight represents the number of '1's in the binary form of the state value, and the Hamming distance is the difference in the number of '1's in the binary representation of the two values. Select the intermediate state value at the fault induction point corresponding to the value with the smallest Hamming distance as the 8 bits of the input value under the penultimate round of faults. The matching relationship is constructed as follows: ; in, , , In this implementation, the internal state is considered as The cube, Indicates the internal state of the first x Line number y Column height is z bytes at that location This represents the 0th, 1st, 2nd, 3rd, 4th, 5th, 6th, and 7th bits of the second-to-last round of input under fault conditions. This indicates the 0th, 1st, 2nd, 3rd, 4th, 5th, 6th, and 7th bits of the output in the penultimate round under fault conditions. This indicates that the current state is negated. It is the penultimate parity check operation. This indicates the penultimate round of transposition. This indicates the penultimate round of the cyclic shift operation. This is the inverse operation of adding the constant of the penultimate round.

[0023] Step 7: Repeat steps 2 through 6, making sure the import position for each fault is different, thus obtaining the input for the last round of faults. All bits; Step 8: Message recovery. The message is recovered by XORing the first 576 bits of the output of the penultimate round of failures with the input to the last round of failures M .​​

Claims

1. A method of message leakage detection against the SHA-3 hash algorithm, characterized in that, The method comprises the following steps: Step S1, randomly generating a message to be processed; Step S2, mapping the message using an SHA3-512 algorithm, and introducing a random 8-bit fault in the second-to-last round of the absorption stage of the sponge structure, and collecting the fault output affected by the fault; Step S3, according to the position of the random 8-bit fault injection, combining the fault output affected by the fault, and deducing the intermediate state value at the matching position by enumerating the 8 bits in the message; Step S4, according to the position of the random 8-bit fault injection, combining the fault output affected by the fault, and deducing the intermediate state value at the fault injection position by enumerating the 8 bits in the message; Step S5, matching the intermediate state value at the matching position and the intermediate state value at the fault injection position, calculating the Hamming weight of the intermediate state value at the fault injection position matched successfully, and calculating the Hamming distance between the Hamming weight of the intermediate state value at the fault injection position matched successfully and the theoretical value, and selecting the intermediate state value at the fault injection position corresponding to the smallest Hamming distance as the 8 bits of the input value in the second-to-last round of fault; Step S6, repeating steps S2-S5, and making the introduction position of each fault different to obtain the input value in the second-to-last round of fault; Step S7, restoring the message according to the input value in the second-to-last round of fault.

2. The method for message leak detection against SHA-3 hash algorithm according to claim 1, characterized in that, Between the step S2 and the step S3, further comprising: determining whether the number of collected fault outputs affected by the fault reaches a preset number; if the number of fault outputs affected by the fault does not reach the preset number, returning to step S1; if the number of fault outputs affected by the fault reaches the preset number, entering step S3.

3. The method for message leak detection against SHA-3 hash algorithm according to claim 1, characterized in that, The calculation formula of the intermediate state value at the matching in the step S3 is: wherein, is the value after the second last permutation operation, is the inverse operation of the second last nonlinear operation; is the inverse operation of the second last round constant addition; is the input under the second last round fault, which is obtained by performing XOR operation on the second last round fault output and the message, is the message, is the XOR operation.

4. The method for message leak detection against SHA-3 hash algorithm according to claim 1, characterized in that, The calculation formula of the intermediate state value at the fault introduction in the step S4 is: wherein, is the intermediate state value at the fault introduction, is the inverse operation of the penultimate round parity check operation, is the inverse operation of the penultimate round cyclic shift operation, is the inverse operation of the penultimate round transposition operation, is the inverse operation of the penultimate round nonlinear operation; is the inverse operation of the penultimate round round constant addition, is the input under the penultimate round fault, is the message, is the exclusive or operation.

5. The method for message leak detection against SHA-3 hash algorithm as claimed in claim 1, wherein, The matching relationship established when matching the intermediate state value at the matching position and the intermediate state value at the fault introduction position in step 5 is: ; wherein, represents the state of the x row of the y column is z bytes, is the inverse operation of the last round constant addition, represents the 0th bit, the 1st bit, the 2nd bit, the 3rd bit, the 4th bit, the 5th bit, the 6th bit and the 7th bit of the last round output under the fault, represents the 0th bit, the 1st bit, the 2nd bit, the 3rd bit, the 4th bit, the 5th bit, the 6th bit and the 7th bit of the last round input under the fault, represents the negation of the current state, is the last round parity check operation, represents the last round bit swapping operation, represents the last round cyclic shift operation, is the XOR operation, is the bitwise AND operation.

6. The method for message leak detection against SHA-3 hash algorithm as claimed in claim 1, wherein, The step S7 is specifically: XORing the input value in the second-to-last round of fault with the first 576 bits of the fault output value in the second-to-last round to obtain the message.

7. The method for message leak detection against SHA-3 hash algorithm as claimed in claim 1, wherein, The introduction of the random 8-bit fault in the step S2 is completed by a software simulation method, or laser, electromagnetic and voltage interference means.

Images