Construction device and method of GIFT-64 block cipher differential partition device based on deep learning

Abstract

The invention discloses a construction device and method of a GIFT-64 block cipher differential partition device based on deep learning. The device comprises a data set construction module, a neural network model module and a training optimization module. And the data set construction module performs one round of decryption on the ciphertext through a random key, extracts intermediate state differences of three links of S box replacement, bit permutation and round key addition, and combines the intermediate state differences into a KPSMOD data set. The neural network model module adopts an MLP Mixer-Net model, an initial convolution layer is embedded into an Inception module to capture multi-scale local features, and a feature extraction layer is combined with a residual convolution and MLP-Mixer module to realize global feature fusion. The training optimization module takes the cross entropy as a loss function and Adam as an optimizer, and carries out training in combination with an early stop strategy. According to the method, through collaborative innovation of the data set and the model, optimization balance of the accuracy of the difference divider and the parameter quantity is realized, flexible adjustment of hyper-parameters is supported, different application scenes are adapted, and the security evaluation efficiency for the SPN structure block cipher is improved.

Description

Technical Field

[0001] This invention relates to the fields of information security and cryptanalysis technology, specifically to a lightweight block cipher differential analysis technique based on deep learning, and particularly to a device and method for constructing a differential distinguisher for the GIFT-64 block cipher. Background Technology

[0002] The GIFT algorithm, proposed by Banik et al., is an upgraded version of the PRESENT algorithm. Through targeted optimization, it achieves significant improvements in computational efficiency, further enhanced structural simplicity, and effectively strengthened cryptographic security. For block cipher algorithms that have been designed, a comprehensive evaluation of their cryptographic properties is necessary. Typical cryptanalysis methods include differential analysis, linear analysis, and integral analysis. Differential cryptanalysis is one of the typical methods; in differential cryptanalysis, the differential discriminator is used to distinguish between cryptographic algorithms and random permutations, and thus between real ciphertext and random sequences. The performance of the differential discriminator directly determines the accuracy of the differential cryptanalysis results. Therefore, the construction of the differential discriminator is a core step in differential cryptanalysis. Automated differential discriminator search techniques based on MILP or SAT have significantly improved the search efficiency of differential discriminators. However, with the increase in the number of encryption rounds of cryptographic algorithms, the long time consumption of automated searches and the high resource consumption of model solving have become bottlenecks restricting the further application of these automated search techniques. To address the bottlenecks in the aforementioned automated search technologies, it is urgent to explore new technical approaches to improve the construction efficiency of differential discriminators; and the advantages of deep learning technology in feature processing provide a feasible solution to this problem.

[0003] In recent years, deep learning technology has been widely used in fields such as speech recognition, natural language processing, and biometric extraction. This technology has strong capabilities in the identification and extraction of fixed weak features. Based on this, we study a novel differential distinguisher for the GIFT cryptographic algorithm based on deep learning, which can improve the efficiency and accuracy of security assessment for SPN structure block ciphers and has important practical value for real-world applications.

[0004] At the 2019 US cipher conference, Gohr [1] first proposed a technical solution combining deep learning and differential analysis: by training a convolutional neural network, he distinguished between cryptographic algorithms with fixed input differences and random data, and launched an attack on the SPECK32 / 64 cryptographic algorithm, verifying the feasibility of applying deep learning technology in the field of block cipher analysis. Since then, related research has mainly focused on two core directions: one is the improvement of training data format, and the other is the optimization of deep learning models.

[0005] In terms of improving the training data format, Benamira et al. [2] deeply analyzed the internal mechanism of the differential neural network discriminator proposed by Gohr [1]. By simplifying the neural network model and combining pure cryptanalysis methods, they found that the discriminator not only relies on the differential distribution of ciphertext pairs, but also extracts the differential feature information of the penultimate round to the second round. Its essence is to approximately construct the differential distribution table of the cipher during the learning phase, which provides key theoretical support for improving the interpretability and optimization of the differential neural network discriminator. Chen et al. [3] proposed a new differential neural network discriminator. By analyzing the ciphertext pair set generated by multiple input differences, the performance of the neural network-assisted key recovery attack was improved, while reducing the data complexity of the attack. Liu et al. [4] proposed a two-dimensional input data generation method based on the output features of the penultimate round and applied it to the construction of differential neural network discriminators for the SPECK and SIMON series of ciphers. This not only significantly improved the accuracy of the discriminator, but also realized the construction of a differential neural network discriminator with longer rounds and higher accuracy.

[0006] In the direction of deep learning model optimization, Tian et al. [5] studied various residual network structures and applied them to the construction process of differential neural network discriminators for reduced-round versions of SPECK and SIMON. Bao et al. [6] developed a differential neural network discriminator suitable for 7 to 11 rounds of SIMON based on densely connected convolutional networks and squeezed excitation networks. BELLINI et al. [7] proposed the DBitNet network, which captures long-range dependencies between neurons through sparse convolutions without using the input reshaping and bit slicing techniques used in the Gohr method. Liu et al. [8] used depthwise separable convolutions to replace traditional convolutions to reduce training costs, which can reduce the number of training parameters by more than 50%.

[0007] References:

[0008] [1] Ghor A. Improving Attacks on Round-Reduced Speck32 / 64 Using DeepLearning[C] / / Proceedings of the 39th Annual International CryptologyConference. Heidelberg:Springer, 2019:150-179;

[0009] [2] Benamira A, Gerault D, Peyrin T, et al. A Deeper Look at MachineLearning-Based Cryptanalysis[C] / / Advances in Cryptology(EUROCRYPT 2021).Berlin: Springer, 2021:805-835;

[0010] [3] Chen Y, Shen Y T,Yu H B, et al. A New Neural DistinguisherConsidering Features Derived from Multiple Ciphertext Pairs[J]. The ComputerJournal, 2023, 66(6):1419-1433;

[0011] [4] Liu J, Ren J, Chen S and Li M M. Improved neural distinguisherswith multi-round and multi-splicing construction[J]. Journal of InformationSecurity and Applications.2023, 74: 103461;

[0012] [5]Tian W and Hu B. Deep learning assisted differential cryptanalysisfor the lightweight cipher SlMON[J]. KSII Transactions on Internet andInformation Systems.2021,15:600-16;

[0013] [6]Bao Z, Guo J, Liu M, et al. Enhancing Differential-NeuralCryptanalysis[C] / / Proceedings of the 28th International Conference on theTheory and Application of Cryptology and Information Security. Heidelberg: Springer, 2022:318-347;

[0014] [7] Bellini E, Gerault D, Hambitzer A, et al. A Cipher-Agnostic NeuralTraining Pipeline with Automated Finding of Good Input Differences[J]. IACRTransactions on Symmetric Cryptology, 2023, 2023(3): 184-212. Summary of the Invention

[0015] This invention aims to overcome the problems of insufficient accuracy and difficulty in balancing model complexity and performance in existing deep learning-based SPN structure block cipher differential distinguishers, and provides a GIFT-64 differential distinguisher construction scheme with high accuracy and strong adaptability.

[0016] To achieve the above objectives, the present invention adopts the following technical solution: On the one hand, a construction device for a deep learning-based GIFT-64 block cipher differential distinguisher is provided, including a dataset construction module, a neural network model module, and a training optimization module.

[0017] The dataset construction module is used to generate and process plaintext and ciphertext pairs, extract intermediate state difference features in the final round of decryption in the GIFT-64 algorithm, and construct a training dataset in KPSMOD format. First, it defines the expressions for each component of the GIFT-64 algorithm's round function, and defines the output state of the r-th round as... ,in The round function of the GIFT-64 algorithm consists of three parts: S-box substitution (SubCells), bit permutation (PermBits), and key addition (AddRoundKey). The specific expressions for these three parts are as follows:

[0018] S-box replacement (SubCells): Let the output state of the S-box in the r-th round be: ,in This represents the S-box replacement operation defined by the GIFT-64 algorithm;

[0019] Bit permutations (PermBits): The output state of the bit permutation in the r-th round is: ,in This represents the S-box replacement operation defined by the GIFT-64 algorithm;

[0020] Add Round Key: Let the round key be... Then the output state of the r-th round is defined as: ;

[0021] The steps for constructing the KPSMOD dataset are as follows:

[0022] S1. Generate several samples, each containing m pairs of plaintext, and assign labels to the samples. The labels are used to indicate whether the plaintext pairs are valid pairs carrying fixed input differences.

[0023] Specifically, based on the SPN structure characteristics of GIFT-64, n samples are randomly generated, each containing m plaintext pairs, denoted as... , Assign binary labels to samples Label 0 corresponds to a random plaintext pair, and label 1 corresponds to a pair carrying a fixed input difference. The plaintext is correct.

[0024] S2. Encrypt the plaintext pair using a random key for r rounds to obtain the corresponding ciphertext pair;

[0025] Perform an expansion operation on the initial key for each sample to obtain the round keys required for the r-round encryption process. Use the expanded round keys to... Perform r rounds of encryption to obtain the corresponding ciphertext. and tags Each pair in the ciphertext set In This represents the ciphertext corresponding to the j-th pair of plaintexts after the r-th round of encryption, and... It is by Differential input with fixed input Perform an XOR operation, then encrypt the ciphertext obtained in r rounds.

[0026] S3. Randomly generate the r-th round key, and sequentially perform the following operations on the ciphertext pair: round key addition inverse operation, inverse bit permutation operation, and inverse S-box replacement operation to obtain the first intermediate state, the second intermediate state, and the third intermediate state, respectively.

[0027] Specifically, it involves randomly generating the key for the r-th round. ,in , for r-round ciphertext Perform decryption transformation:

[0028] For r-round ciphertext Perform a round key addition operation. This operation is used to eliminate the effect of round key addition on the ciphertext and obtain the corresponding intermediate state. The execution process of this operation is as follows:

[0029] ;

[0030] For the obtained intermediate state Perform the reverse bit permutation operation, which is the inverse operation of PermBits, to restore the state bit order before the bit permutation operation during encryption. The execution process of this operation is as follows:

[0031] ;

[0032] For the obtained intermediate state Perform the reverse S-box replacement operation, which is the inverse operation of SubCells, to restore the original state value before the S-box replacement operation during encryption. The execution process of this operation is as follows:

[0033] .

[0034] S4. Calculate the differences between the first intermediate state, the second intermediate state, and the third intermediate state, and concatenate the three differences bit by bit to form an input feature vector in KPSMOD format, which together with the label constitutes the training sample.

[0035] Specifically, it refers to the three types of states obtained. , and Perform a bitwise XOR operation to obtain the corresponding difference features: , and These are combined into a new input data format, providing differential features from multiple operational stages to the neural network. This input format is represented as: ,in This indicates a bit-string concatenation operation, ultimately... and The input dataset that constitutes the differential discriminator of the neural network, wherein .

[0036] The core of the neural network model module is the MLPMixer-Net optimized model, which is used to receive the KPSMOD format data and perform feature learning and classification. The model consists of a neural network architecture consisting of an input layer, an initial convolutional layer, a feature extraction layer, and an output layer.

[0037] Input layer: Responsible for dimensionality reshaping and transformation of input data in KPSMOD format; the input layer receives feature inputs from the KPSMOD dataset in batches, where batch_size is the number of samples in a single batch, thus dividing the dataset into [number of batches]. Batch, where n is the number of samples in the dataset; let b be the batch number. The input to ) is a feature vector of dimension (batch_size, m×12×16);

[0038] First, the TensorFlow framework's Reshape operation is called to convert it into a four-dimensional feature tensor with dimensions (batch_size, m, 12, 16). Where batch_size is the number of samples in a single batch, m is the number of ciphertext pairs, 16 is the number of 4-bit sub-blocks of GIFT, and 12 is the feature dimension;

[0039] Then, the TensorFlow framework's Permute operation is called to adjust the dimensionality order of the four-dimensional feature tensor to (batch_size, m, 16, 12), resulting in the feature tensor. This is to match the input dimension requirements of subsequent convolution operations.

[0040] Initial convolutional layer: Embedded with the Inception module, employing parallel one-dimensional convolutional paths (such as 1x1 and 3x3 convolutional kernels) to capture local difference features at different scales;

[0041] Specifically: the initial convolutional layer deals with the four-dimensional feature tensor output by the input layer. The Inception module is embedded, which includes two parallel one-dimensional convolutional operations to extract multi-scale local features. One of these operations uses a 1×1 convolutional kernel to capture fine-grained local features, resulting in a feature tensor of dimension (batch_size, m, 16, 16). Another approach uses a 3×3 convolutional kernel to mine a wider range of feature dependencies, resulting in a feature tensor of dimension (batch_size, m, 16, 16). Both convolutional layers are configured with 16 filters and L2 regularization is applied. Then, the TensorFlow framework's concatenate function is called to output the two convolutional layers. and By concatenating the last dimension (channel dimension), we obtain a four-dimensional feature tensor with dimensions (batch_size, m, 16, 32). Then, the TensorFlow framework's BatchNormalization function is called to standardize the distribution of the current batch of data, stabilize the feature input patterns, alleviate the internal covariate shift problem, and obtain the normalized feature tensor. Then on ReLU activation is performed to filter out invalid features through nonlinear truncation, while nonlinear transformation is introduced to learn the correlations between complex difference features, ultimately resulting in a processed feature tensor of dimension (batch_size, m, 16, 32). This is used as the initial input to the feature extraction layer.

[0042] Feature extraction layer: This layer uses the feature tensors output by the initial convolutional layer. The input consists of a residual convolutional feature enhancement unit and an MLP-Mixer global feature fusion unit, in sequence.

[0043] Residual convolutional feature enhancement unit: It is composed of multiple residual convolutional blocks stacked together, which gradually enhances the local and nonlinear capabilities of features. The kernel size can be increased layer by layer to increase the receptive field.

[0044] The residual convolutional feature enhancement unit performs 5 rounds of residual convolution loops. The initial kernel size is 3, and it increases by 2 with each subsequent loop. The input tensor for the first round of the loop The cycle process for each round is as follows:

[0045] First, consider the current input tensor. ( For the current cycle, The first layer of one-dimensional convolution is performed, and its output is normalized by BatchNormalization and activated by ReLU to obtain an intermediate feature tensor with dimensions (batch_size, m, 16, 32). ;

[0046] Next to Performing a second layer of one-dimensional convolution, the output of which is also normalized by BatchNormalization and activated by ReLU, yields an intermediate feature tensor of dimensions (batch_size, m, 16, 32). ;

[0047] Then, the TensorFlow framework's Add operation is called to... With the input tensor of this round Perform a residual connection to obtain the current output tensor with dimensions (batch_size, m, 16, 32). ( For the current cycle, ) as the input tensor for the next iteration ;

[0048] After 5 iterations, the final feature tensor is output. Its local correlation and nonlinear expression capabilities are significantly improved, among which ;

[0049] After completing the residual convolution feature enhancement stage, the Reshape operation is called to modify the feature tensor output by this stage. A dimensionality transformation is performed, reshaping it from a four-dimensional tensor of (batch_size, m, 16, 32) to a three-dimensional tensor of (batch_size, m × 16, 32), resulting in a feature tensor adapted to the input requirements of the MLP-Mixer. This serves as the input for the second-stage MLP-Mixer global feature fusion.

[0050] The MLP-Mixer global feature fusion unit consists of a token-mixing subunit and a channel-mixing subunit. Each subunit performs global mixing and information fusion on the spatial location (token) and feature channel of the feature through layer normalization and fully connected layers (MLP), and introduces residual connections to stabilize training.

[0051] The token mixing subunit first processes the input feature tensor For standardization, the TensorFlow framework's LayerNormalization is first invoked. This standardization is achieved by calculating the mean and variance of all feature dimensions for a single sample, stabilizing the global feature distribution to adapt to the global feature fusion logic of the MLP-Mixer, resulting in a tensor whose output dimension remains at (batch_size, m×16, 32). ;

[0052] The Permute operation is then called to transpose the tensor dimensions, resulting in a feature tensor with dimensions (batch_size, 32, m×16). ;

[0053] Then, after standardization... As input, it is connected to a multilayer perceptron module consisting of two fully connected networks:

[0054] First, the first-layer multilayer perceptron module uses a fully connected network to... The feature dimension is expanded from (batch_size, 32, m×16) to (batch_size, 32, 128), and a smooth nonlinear transformation is introduced through the GELU activation function to obtain a two-dimensional tensor with dimension (batch_size, 32, 128). ;

[0055] Then the second layer fully connected network will Dimensional projection back The feature dimension size is (batch_size, 32, m×16), and a Dropout layer with a dropout rate of 0.1 is added to suppress overfitting, achieving global feature fusion of the spatial location dimension, resulting in an intermediate tensor with dimension (batch_size, 32, m×16). ;

[0056] The Permute operation is then called. The dimension of the tensor when entering the token-mixing stage is transformed back. The order is (batch_size, m×16, 32); finally, the Add function is called to... and Perform a residual join to obtain an output tensor with token mixing of (batch_size, m×16, 32). .

[0057] The channel mixing subunit first processes the input tensor Perform standardization and LayerNormalization to obtain a tensor whose output dimension is maintained at (batch_size, m×16, 32). Subsequently, it connects to a multilayer perceptron module consisting of a two-layer fully connected network, consistent with the token hybrid structure:

[0058] The first-layer multilayer perceptron module will input tensors. The channel dimension is expanded from 32 to 128, and a smooth nonlinear transformation is introduced through the GELU activation function to obtain an intermediate tensor with dimensions (batch_size, m×16, 128). Then on Perform a Dropout layer with a dropout rate of 0.1 to suppress overfitting, while maintaining the dimensionality (batch_size, m×16, 128);

[0059] The second-layer multilayer perceptron module will The channel dimension is projected back from 128 to the initial channel dimension of 32, and the feature association is strengthened again by the GELU activation function to obtain an intermediate tensor with dimensions (batch_size, m×16, 32). Then, the Dropout operation is performed again, and the dimensions are still maintained (batch_size, m×16, 32);

[0060] Finally, by calling Add... and Perform a residual join to obtain an output tensor with token mixing of (batch_size, m×16, 32). This is passed from the current layer to the output layer.

[0061] Output layer: Tensors output by the feature extraction layer Global average pooling is performed, and after mapping through two fully connected layers, the binary classification probability mapping output is achieved through the Sigmoid activation function. The training optimization module is used to configure the training process, including setting the loss function (e.g., cross-entropy), optimizer (e.g., Adam), batch size, learning rate, etc., and implementing an early stopping strategy to prevent overfitting. Specifically, the training phase uses cross-entropy as the loss function and the Adam algorithm as the optimizer. First, the KPSMOD dataset is divided into training and validation sets. The model is set to traverse the entire training dataset E times (i.e., the number of training epochs is E). In each training iteration, the training set is divided into batches according to a preset batch size (batch_size). The training set is divided into... For each batch, the gradient is calculated for the b-th batch of training data, and the parameters of the MLPMixer-Net model are iteratively updated; finally, the b-th batch is traversed again. ;

[0062] During training, after completing all batches in each round, the validation set is used in real time to traverse and infer batches to monitor classification accuracy and loss value. Training is terminated when the validation set accuracy does not improve for 10 consecutive times. This approach relies on the batch-by-batch iterative training mode to ensure that the model fully learns the correlation rules of differential features, and avoids overfitting problems through the early stopping strategy, ultimately resulting in a GIFT-64 block cipher differential discriminator model with high classification accuracy.

[0063] On the other hand, a method for constructing a deep learning-based GIFT-64 block cipher differential distinguisher is provided, including the steps performed by the aforementioned device.

[0064] The beneficial effects of this invention are as follows:

[0065] 1. Dataset Innovation: The KPSMOD dataset construction method provides richer and more discriminative input information for neural networks by structurally fusing the differential features of multiple key cryptographic operation points, thereby enhancing the potential of the discriminator from a data perspective.

[0066] 2. Innovative Model Architecture: The MLP Mixer-Net model cleverly combines the advantages of the Inception module (multi-scale local feature extraction), residual convolution (deep feature enhancement), and MLP-Mixer (global feature fusion). It is specifically designed to address the spatial and channel dependencies of cryptographic differential features, achieving an optimized balance between model performance and parameter efficiency.

[0067] 3. Practicality and Flexibility: This invention supports flexible adjustment of the number of ciphertext pairs, learning rate, regularization parameters, etc., and can adapt to different application scenarios from resource-constrained environments to high-performance servers, and has good engineering application value.

[0068] 4. Portability: The core design concept of this invention (KPSMOD data construction, MLPMixer-Net hybrid model) can be extended to the security analysis of other lightweight block ciphers with similar SPN structures, providing a more efficient and universal analysis framework for the field of cryptography, and has broad engineering application value and academic reference significance. Attached Figure Description

[0069] Figure 1 This is the overall flowchart of the method of the present invention.

[0070] Figure 2 This is a schematic diagram of the GIFT-64 algorithm encryption round function.

[0071] Figure 3 A schematic diagram of the decryption of the round function for the GIFT-64 algorithm.

[0072] Figure 4 This is a schematic diagram of the initial convolutional layer (Inception module) structure of the present invention.

[0073] Figure 5 This is a schematic diagram of the overall structure of the feature extraction layer of the present invention.

[0074] Figure 6 This is a schematic diagram of the residual convolution feature enhancement unit structure.

[0075] Figure 7 This is a schematic diagram of the global feature fusion unit structure of MLP-Mixer.

[0076] Figure 8 This is a schematic diagram of the output layer structure of a neural network. Detailed Implementation

[0077] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments, but this is not intended to limit the scope of the invention.

[0078] The example uses the construction of a 6-round GIFT-64 differential distinguisher.

[0079] The construction method of the GIFT-64 block cipher differential discriminator based on deep learning is described in the following reference. Figure 1-8 This includes the following steps: Step 1: Building the KPSMOD dataset

[0080] (1.1) Plaintext sample generation: Randomly generate a large number of samples, each sample containing m=4 pairs of plaintext (half of which are valid pairs with fixed input differences and half are random pairs), and assign labels;

[0081] Example, randomly generated There are 4 training samples, each containing 4 pairs of plaintext, denoted as: , ;

[0082] Sample assignment binary classification labels are Label 0 corresponds to a random plaintext pair, and label 1 corresponds to a pair carrying a fixed input difference. The plaintext pair;

[0083] (1.2) Plaintext encryption to generate ciphertext: Refer to Figure 2 An expansion operation is performed on the initial key of each sample to obtain the round keys required for the 6-round encryption process. The expanded round keys are then used to perform 6 rounds of encryption on the 4 pairs of plaintext in the sample, outputting the corresponding 3 pairs of ciphertext. and tags .

[0084] (1.3) Randomly generate the subkey for the 6th round. , refer to Figure 3 The ciphertext is processed sequentially through round key addition, reverse bit permutation, and reverse S-box permutation, resulting in three intermediate states. The specific process is as follows: For the ciphertext of the 6 rounds... The round key addition operation is performed, and the execution process is as follows: ;

[0085] For the obtained intermediate state Perform the reverse bit permutation operation, which is the inverse operation of PermBits.

[0086] The operation is executed as follows:

[0087] ;

[0088] For the obtained intermediate state Perform the reverse S-box replacement operation, which is the inverse operation of SubCells. The execution process of this operation is as follows:

[0089] ;

[0090] (1.4) Construct the final input format: Combine the above three types of states , and The corresponding difference features are obtained by bit XORing: , and These are combined into a new input data format to provide differential features for multiple operational stages to the neural network. This input format is represented as: ,final and The input dataset that constitutes the differential discriminator of the neural network;

[0091] Concatenate the three differences bit by bit to obtain the KPSMOD feature vector of a sample. Repeat the above process to build a large-scale dataset. Step 2: Build the MLPMXer-Net model. Use frameworks such as TensorFlow or PyTorch to build the model, referring to... Figure 4 :

[0092] Input layer: Receives feature inputs from the KPSMOD dataset in batches, assuming a single batch contains 100 samples. That is, batch_size= The dataset is then divided into There are 1 batch; let the input of the b-th batch be of dimension ( eigenvectors of 4×12×16 , First, the TensorFlow framework's Reshape operation is called to convert it to a dimension of ( The four-dimensional feature tensor of (4, 12, 16) ,in 4 represents the number of samples in a single batch, 16 represents the number of ciphertext pairs, 16 represents the number of 4-bit sub-blocks in GIFT, and 12 represents the feature dimension.

[0093] Subsequently, the Permute operation of the TensorFlow framework is called to adjust the dimensional order of the four-dimensional feature tensor to ( (4, 16, 12), to obtain the feature tensor This is to match the input dimension requirements of subsequent convolution operations.

[0094] Reference Figure 4Initial convolutional layer: for the four-dimensional tensor output by the input layer. Parallel deployment of two one-dimensional convolutional (Conv1D) operations to extract multi-scale local features, both using... For input: First convolution: kernel size set to 1, number of kernels set to 16, padding method set to "same" to maintain feature size, regularization method set to L2 regularization, coefficients set to... This is used to capture local correlations within feature channels, resulting in an output dimension of ( The characteristic tensor of (4, 16, 16) The second convolutional path: the kernel size is set to 3, the number of kernels is set to 16, the padding method is "same", and L2 regularization is also introduced to capture the neighborhood correlation in the feature space dimension, resulting in an output dimension of ( The characteristic tensor of (4, 16, 16) After completing the two convolution operations, call the TensorFlow framework's concatenate function to concatenate the outputs of the two convolutions. and Concatenating along the channel dimensions yields an output dimension of ( The characteristic tensor of (4, 16, 32) Subsequently Performing a BatchNormalization operation to perform batch normalization yields normalized feature tensors. Then on Performing the ReLU activation operation, the final processed dimension is ( ,4,16,32) Feature tensor This is used as the initial input to the feature extraction layer.

[0095] Feature extraction layer: This layer uses the feature tensors output by the initial convolutional layer. The input is divided into two stages: residual convolutional feature enhancement and MLP-Mixer global feature fusion, referring to... Figure 5-6 The specific process is as follows:

[0096] The first stage involves executing 5 rounds of residual convolution loops. The initial kernel size is 3, which increases by 2 with each subsequent loop. The input tensor for the first round of the loop The cycle process for each round is as follows:

[0097] First, consider the current input tensor. ( For the current cycle, The first layer of one-dimensional convolution is performed, which is configured with 12 filters, twice the number of filters in the initial convolutional layer. The padding method is set to "same" to maintain the feature size. L2 regularization is also introduced, with a regularization coefficient of 1. Its output, after BatchNormalization normalization and ReLU activation, yields a dimension of ( The intermediate feature tensor of (4, 16, 32) ;

[0098] Again A second layer of one-dimensional convolution is performed, with the same number of filters, padding method, and regularization strategy as the first layer; its output is also normalized by BatchNormalization and activated by ReLU, resulting in a dimension of ( The intermediate feature tensor of (4, 16, 32) Then, the TensorFlow framework's Add operation is called to... With the input tensor of this round Perform residual connections to obtain the output tensor of this round. tensor as input for the next iteration ;

[0099] After 5 iterations, the final feature tensor is output. Its local correlation and nonlinear expression capabilities are significantly improved, among which ;

[0100] After completing the residual convolution feature enhancement stage, the Reshape operation is called to modify the feature tensor output by this stage. Perform a dimensional transformation, converting it from ( The four-dimensional shape of ( , 4 , 16 , 32) is reshaped into ( ) The feature tensor with a 3D shape of 4×16,32 is obtained to meet the input requirements of MLP-Mixer. This serves as the input for the second-stage MLP-Mixer global feature fusion.

[0101] The second stage, the MLP-Mixer global feature fusion stage, refers to... Figure 7 :

[0102] The first step, the token-mixing stage:

[0103] First, the input feature tensor... To perform standardization, first call the TensorFlow framework's LayerNormalization function to maintain the output dimension at ( ). Tensors of 4×16,32 Then, the Permute operation is called to transpose the tensor dimensions, resulting in a tensor with dimensions ( ,32,4×16) characteristic tensor Then with As input, it is connected to a multilayer perceptron module consisting of two fully connected networks:

[0104] First, the first-layer multilayer perceptron module uses a fully connected network to... Feature dimensions from ( ,32,4×16) expanded to ( (32, 128), and at the same time, a smooth nonlinear transformation is introduced through the GELU activation function to obtain a dimension of ( Two-dimensional tensor (32, 128) ;

[0105] Next, the second layer multilayer perceptron module will Dimensional projection back Feature dimension size ( (32, 4×16), and simultaneously add a Dropout layer with a dropout rate of 0.1 to suppress overfitting, achieving global feature fusion of the spatial location dimension, to obtain the dimension ( (32, 4×16) is the intermediate tensor Then the Permute operation is called to The dimension of the tensor when entering the token-mixing stage is transformed back. The order, that is ( ,4×16,32);

[0106] Finally, by calling Add... and Perform a residual join to obtain a token mix as ( Output tensor (4×16, 32) .

[0107] The second step is the channel-mixing stage:

[0108] First, the input feature tensor... Standardization is performed, and the LayerNormalization operation is executed to keep the output dimension within ( ). Tensors of 4×16,32 ;

[0109] Subsequently, it connects to a multilayer perceptron module consisting of two fully connected networks, consistent with the token hybrid structure:

[0110] The first-layer multilayer perceptron module expands the channel dimension of the input tensor from 32 to 128, and simultaneously introduces a smooth nonlinear transformation through the GELU activation function, resulting in a dimension of ( The intermediate tensor (4×16, 128) Then on Performing a Dropout layer with a dropout rate of 0.1 to suppress overfitting still maintains its dimensionality. ,4×16,128);

[0111] The second-layer multilayer perceptron module will The channel dimension is projected back from 128 to the initial channel dimension of 32, and then the feature association is strengthened again by the GELU activation function, resulting in a dimension of ( The intermediate tensor of (4×16, 32) Finally, by calling Add, and Perform a residual join to obtain a token mix as ( Output tensor (4×16, 128) This is passed from the current layer's output to the output layer.

[0112] Reference Figure 8 Tensors output by MLP-Mixer Perform GlobalAveragePooling1D global average pooling to compress the dimension to ( ,32) two-dimensional tensor ;

[0113] Then on The Dropout operation is performed, and finally the feature dimension is mapped to 1 through a fully connected layer, with the activation function set to Sigmoid.

[0114] Step 3: Model Training and Evaluation

[0115] The model training process uses cross-entropy as the loss function and the Adam algorithm as the optimizer. First, the KPSMOD dataset is divided into training and validation sets. The model is set to traverse the entire training dataset 50 times (i.e., 50 training epochs). In each training iteration, the training set is divided into batches of a predetermined size. The training set is divided into batches. For each batch, the gradient is calculated for the b-th batch of training data, and the parameters of the MLPMixer-Net model are iteratively updated.

[0116] Finally, iterate through b again. ;

[0117] During training, after completing all batches in each round, the validation set is used in real time to traverse and infer batches to monitor classification accuracy and loss value. Training is terminated when the validation set accuracy does not improve for 10 consecutive times. This approach relies on the batch-by-batch iterative training mode to ensure that the model fully learns the correlation rules of differential features, and avoids overfitting problems through early stopping strategy, ultimately obtaining a GIFT-64 block cipher differential discriminator model with high classification accuracy.

[0118] Model evaluation and optimization involved randomly sampling from the KPSMOD dataset to construct an independent test set to evaluate model performance. Core evaluation metrics included model accuracy and parameter count. The model optimization and adjustment methods across multiple scenarios were as follows: Model performance was tested with ciphertext pairs m=1, 2, 4, and 8 to select the optimal number of ciphertext pairs. The learning rate (0.0005, 0.001, 0.002) and L2 regularization parameters (0.00005, 0.0001, 0.0002) were adjusted to balance model fitting ability and generalization ability. If severe overfitting occurred, the Dropout probability was increased to 0.3 to achieve comprehensive model performance optimization.

[0119] The above embodiments demonstrate the feasibility and effectiveness of the present invention.

Claims

1. An apparatus for constructing a differential distinguisher of a GIFT-64 block cipher based on deep learning, characterized in that, include: The dataset construction module is used to generate and process plaintext pairs and ciphertext pairs, extract intermediate state differential features in the final decryption process of the GIFT-64 algorithm, and construct a training dataset in KPSMOD format. The neural network model module integrates an optimized MLPMixer-Net model, which is used to receive the KPSMOD format data and perform feature learning and classification. The training and optimization module is used to configure training parameters, loss functions and optimization strategies, and to train and validate the neural network model module to obtain a trained difference discriminator model.

2. The apparatus of claim 1, wherein, The dataset building module performs the following steps to build the KPSMOD dataset: S1. Generate several samples, each containing m pairs of plaintext, and assign labels to the samples. The labels are used to indicate whether the plaintext pairs are valid pairs carrying fixed input differences. S2. Encrypt the plaintext pair using a random key for r rounds to obtain the corresponding ciphertext pair; S3. Randomly generate the r-th round key, and sequentially perform the following operations on the ciphertext pair: round key addition inverse operation, inverse bit permutation operation, and inverse S-box replacement operation to obtain the first intermediate state, the second intermediate state, and the third intermediate state, respectively. S4. Calculate the differences between the first intermediate state, the second intermediate state, and the third intermediate state, and concatenate the three differences bit by bit to form an input feature vector in KPSMOD format, which together with the label constitutes the training sample.

3. The apparatus of claim 1, wherein, The neural network model module includes: The input layer is used to receive and reshape input data in KPSMOD format; The initial convolutional layer, embedded with an Inception structure, includes at least two parallel one-dimensional convolutional layers with different kernel sizes, used to extract multi-scale local features; The feature extraction layer consists of a residual convolutional feature enhancement unit and an MLP-Mixer global feature fusion unit. The output layer is used to map the fused features into binary classification probability outputs.

4. The apparatus of claim 3, wherein, The residual convolutional feature enhancement unit comprises multiple residual convolutional blocks, each containing two one-dimensional convolutional layers. Each convolutional layer is followed by a batch normalization layer and an activation function. The output of the residual convolutional block is added to the input through residual connections. The kernel size increases with the network depth.

5. The apparatus of claim 3, wherein, The MLP-Mixer global feature fusion unit includes a token mixing subunit and a channel mixing subunit connected in sequence; each subunit contains a layer normalization layer, two fully connected layers and residual connections; the token mixing subunit mixes the spatial location dimension of the features in the fully connected layers, and the channel mixing subunit mixes the channel dimension of the features in the fully connected layers.

6. The apparatus of claim 1, wherein, The training optimization module is configured to: use the cross-entropy loss function and the Adam optimizer for training; and adopt an early stopping strategy to terminate training when the accuracy of the validation set no longer improves within a preset number of consecutive rounds.

7. The device of any one of claims 1 to 6, wherein, The device is configured to support adjustment of at least one hyperparameter among the number of ciphertext pairs m, learning rate, and L2 regularization coefficient to adapt to different computing environments and accuracy requirements.

8. A method for constructing a differential distinguisher for GIFT-64 block cipher based on deep learning, characterized in that, Includes the following steps: The data set construction step comprises: generating and processing plaintext pairs and ciphertext pairs, extracting intermediate state difference characteristics in the last round decryption process of the GIFT-64 algorithm, and constructing a KPSMOD format training data set; The model construction step comprises: building an MLPMixer-Net neural network model, wherein the model comprises an initial convolutional layer with an embedded Inception structure, a feature extraction layer comprising residual convolutional blocks and MLP-Mixer units, and an output layer; The model training step comprises: training the MLPMixer-Net model using the KPSMOD data set, adopting a cross-entropy loss function and an Adam optimizer, and combining an early stopping strategy to obtain a trained difference discriminator model.

9. The method of claim 8, wherein, The KPSMOD format training data set comprises: For r rounds of ciphertext pairs, a randomly generated sub-key is used to sequentially perform a round key addition and inverse operation, an inverse bit permutation operation, and an inverse S-box substitution operation. The differences of the states obtained after the above operations are calculated respectively, and the S-box substitution difference, the bit permutation difference, and the round key addition difference are spliced to form a multi-dimensional difference feature vector.

10. The method of claim 8, wherein, In the MLPMixer-Net model, the MLP-Mixer unit comprises two stages of token mixing and channel mixing, respectively performing global feature fusion on the spatial dimensions and channel dimensions of the feature tensor through a full connection layer, and introducing a residual connection at each stage.

Images