A method and system for constructing a high-order differential distinguisher for finite field algorithms
By constructing a high-order differential discriminator over a finite field and utilizing an algebraic degree automated search model and a MILP model, the problems of high complexity and insufficient security in the construction of discriminators in the prior art are solved. This enables an efficient discriminative attack on the Poseidon(2)b algorithm and improves the privacy protection capabilities of cyberspace security.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SHANDONG UNIV
- Filing Date
- 2026-03-27
- Publication Date
- 2026-07-10
AI Technical Summary
Existing technologies struggle to effectively distinguish between cryptographic primitives and random permutations within polynomial time when constructing distinguishers. Furthermore, the simple algebraic expressions of novel symmetric cryptographic algorithms result in weak security and a lack of effective means to distinguish between attacks.
A high-order differential discriminator is constructed using an automated search model based on the algebraic degree of finite fields. By obtaining the cryptographic algorithm parameters and round number, the propagation rules between algorithm components are constructed using the MILP model, and the objective function and termination condition are set to achieve efficient discriminator construction.
It significantly reduces the complexity of data volume, enables the construction of longer high-order differential distinguishers, accurately grasps the growth law of the algorithm's algebraic number, provides an effective means of attacking the Poseidon(2)b algorithm, and enhances the privacy protection capability of cyberspace security.
Smart Images
Figure CN122365531A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of discriminator construction technology, specifically relating to a method and system for constructing a high-order difference discriminator for finite field algorithms. Background Technology
[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.
[0003] In the era of rapid development of big data and cloud computing, the demand for privacy protection in cyberspace security is growing, giving rise to privacy computing technologies that ensure data availability without visibility. In the field of cryptography, three of the most widely used and representative advanced cryptographic protocols for privacy computing are secure multi-party computation, fully homomorphic encryption, and zero-knowledge proofs. These advanced cryptographic protocols typically employ methods defined in large finite fields. superior( or large prime numbers A symmetric cryptographic algorithm that distinguishes a cryptographic algorithm from a random permutation is called an AO algorithm. A distinguishing attack is an attack that can obtain plaintext and ciphertext without knowing the specific cryptographic algorithm, and then differentiate that algorithm from a random permutation based on that data. In modern cryptography, a distinguishing attack aims to construct a distinguisher algorithm that can, in polynomial time, distinguish the output of a cryptographic primitive from a genuine random permutation with a non-negligible advantage, which is crucial for data security.
[0004] Because AO algorithms are relatively new and lack design and analysis experience, some algorithms have potential flaws in their design framework or component selection. More importantly, while these novel symmetric cryptographic algorithms solve the protocol compatibility problem, they also introduce new security vulnerabilities. To optimize performance in high-level protocols, algorithms often employ extremely simple algebraic degrees or sparse nonlinear layers, which leads to relatively simple algebraic expressions and weak algebraic properties. Summary of the Invention
[0005] To address the aforementioned problems, this invention proposes a method and system for constructing a high-order difference discriminator for finite field algorithms. This invention can construct a high-order difference discriminator based on an automated search model of algebraic degree over a finite field, significantly reducing data complexity.
[0006] According to some embodiments, the present invention adopts the following technical solution: A method for constructing a high-order difference discriminator for finite field algorithms includes the following steps: Obtain the cryptographic algorithm parameters and set the desired number of rounds r for the higher-order differential distinguisher; Based on the obtained parameters and number of rounds, the upper bound D of the algebraic degree of the cryptographic algorithm for round r is obtained by using an automated search model of algebraic degree, and a D+1 dimensional plaintext space is constructed. Calculate the XOR sum of the cryptographic algorithm output, and determine if the XOR sum is zero. If it is, the higher-order differential discriminator is successfully constructed; otherwise, adjust the number of rounds r of the expected higher-order differential discriminator and reuse the algebraic degree automated search model for searching.
[0007] As an alternative implementation, the cryptographic algorithm parameters include the target cryptographic algorithm Poseidon(2)b and the bit length of the plaintext or data block. Algorithm algebra times detected A randomly generated reference plaintext of length n bits and containing A set of different bit position indices.
[0008] As an alternative implementation, based on the acquired parameters and number of rounds, the process of obtaining the upper bound D of the algebraic degree of the cryptographic algorithm for r rounds using an automated search model of algebraic degree, and constructing the D+1 dimensional plaintext space includes: setting the plaintext dimension to be traversed... ,judge Is it greater than ,if If the algebraic order is too high, it means that a discriminator cannot be constructed within the group length, and an error is returned directly and the algorithm is terminated. Initialize a variable to store the result of the XOR operation, let... ; Start the outer loop, for variables from Traversing to Execute the following sub-steps in sequence: (1) Copy the base plaintext: Make the current plaintext = Copy ( ).
[0009] (2) Constructing the data structure: Start the inner loop, for the variable from Traversing to Extracting variables The The bit value is denoted as ,Will Assign the value to the active bit corresponding to the current plaintext; (3) Encryption calculation: Input the current plaintext into the target encryption function to obtain ciphertext or intermediate state; (4) XOR accumulation: XOR the current encryption result into the sum.
[0010] As an alternative implementation, the process of calculating the XOR sum of the cryptographic algorithm output and determining whether the XOR sum is zero includes: after all loops have finished, determining the final... Value, if If the value is 0, it indicates that the zero-sum characteristic has been successfully captured, and the higher-order difference discriminator is valid; if If the result is not equal to 0, it indicates that the zero-sum property has not occurred, and the discriminator verification fails.
[0011] As an alternative implementation, the construction process of the automated algebraic degree search model includes: obtaining cryptographic algorithm parameters, constructing an XOR model, an S-box model, a copy and modular addition model, and a matrix multiplication model, constructing an overall automated algebraic degree search model based on the above models, setting an objective function and termination conditions, and using a solver to perform algebraic degree calculations to obtain the algebraic degree corresponding to each round.
[0012] As a further defined implementation, the process of constructing an XOR model, an S-box model, a copying and modular addition model, and a matrix multiplication model, and then constructing an automated search model for the overall algebraic degree based on the above models, includes: Let X be the input of the XOR function and Y be the output. for The propagation path of the previous XOR operation results in the inequality:
[0013] To perform an S-box exponentiation operation: Let Y be the input of the S-box and Z be the output of the S-box. for The path of exponentiation operations on the path, and the greatest common divisor. ,make Let the parameter set Corresponding to The three non-zero bits of this power operation are characterized by the following set of equations:
[0014] in, This is an intermediate vector used to temporarily store the addition result, and the dimensions of the above vectors are all... , This involves a circular shift operation; Perform matrix multiplication: Let The path for the upper linear layer (matrix multiplication) operation is: , Introduction intermediate variable matrix Then the operational constraint is abstracted as:
[0015] in, This represents a generalized copy operation, mapping a single input state to... An intermediate state; This represents the generalized XOR operation, which will... The intermediate states are linearly aggregated into one output state; Perform a circular shift operation: Let The input state vector, This is the output state vector, and the vector's bit width is... Given parameters , The transformation is essentially a left circular shift operation on the input vector, and the MILP model of this operation is rigorously characterized by the following set of equations:
[0016] in, This represents the bit index within the state vector. This represents the modulo operation; Perform a generalized copy operation: Extend the copy operation to a generalized model: Let for superior A generalized unidirectional propagation path of the copy operation (passing through) (operation), among which for Bit vectors; characterized by a system of inequalities:
[0017] Based on the model of the components mentioned above, and the structural logic of the algorithm, construct the overall algorithm model, denoted as... , ,in
[0018]
[0019]
[0020] Where t is the number of algorithm branches, and rp and rf are the number of partial and external rounds, respectively. Note that the algorithm structure has two external rounds at the beginning and end, so the algorithm has [number of external rounds]. Total number of rounds .
[0021] As a further defined implementation, the process of setting the termination condition includes considering the first... When calculating the algebraic degree of each encrypted variable, in the original model... In addition to the above, corresponding constraints are added to characterize the propagation behavior of the variable after multiple iterations, and the termination condition is:
[0022] in, It represents the j-th bit of the i-th branch in the r-th round of output; when i=k, this variable is the ciphertext of interest, and only one bit of it is of interest.
[0023] As an alternative implementation, the process of setting the objective function includes: there are two objective functions, one of which essentially describes the first objective function. The highest algebraic degree of all possible plaintext monomials in a given ciphertext variable is characterized by counting the number of active variables in the initial round: ; The second objective function only considers the algebraic number of certain specific branches in the algorithm. By modifying the range of branches counted by the objective function, the corresponding optimization search is completed.
[0024] in, Used to characterize the set of branches involved in the calculation of the objective function.
[0025] A system for constructing a high-order difference discriminator for finite field algorithms includes: The data acquisition module is configured to acquire cryptographic algorithm parameters and set the desired number of rounds r of the higher-order differential distinguisher; The upper bound search module is configured to use an automated search model based on the acquired parameters and round number to obtain the upper bound D of the algebraic number of the cryptographic algorithm for round r, and construct a D+1 dimensional plaintext space. The iteration module is configured to calculate the XOR sum of the cryptographic algorithm output, determine whether the XOR sum is zero, and if so, the higher-order differential distinguisher is successfully constructed; otherwise, the number of rounds r of the expected higher-order differential distinguisher is adjusted, and the search is performed again using the algebraic degree automated search model.
[0026] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention can construct a high-order difference discriminator based on an automated search model of algebraic degree over a finite field, which significantly reduces the complexity of the data and constructs a longer high-order difference discriminator for Poseidon(2)b.
[0027] This invention also provides a comparison between the precise upper bound of the algebraic number searched using automated search attacks and the theoretical upper bound. The results show that the algebraic number growth searched by the technique of this invention does indeed exhibit an almost linear growth, while theoretically the algebraic growth trend of this algorithm is exponential. This indicates that this invention can not only construct high-order difference discriminators, but also has a significant accuracy advantage in evaluating the algebraic number growth trend of the Poseidon(2)b algorithm, and has broad application prospects.
[0028] Furthermore, this invention also presents a general method for searching higher-order differential discriminants. Specifically, if an attacker does not know the exact algebraic degree of the algorithm being attacked, they can exhaustively search the plaintext space dimensions and check round by round whether the output exhibits zero-sum characteristics, thereby achieving a higher-order differential attack. In fact, this search method gradually expands the plaintext space construction of a certain branch as the number of rounds increases, judging whether an integral characteristic appears. This not only allows for the discovery of higher-order differential discriminants at a specific number of rounds, but also uses the integral characteristic to inversely determine the algebraic degree of that branch of the cryptographic algorithm at the corresponding number of rounds, thus providing strong evidence for our automated search results for algebraic degrees. However, this method also suffers from high complexity. The table provides a comparison between higher-order differential discriminants constructed based on exact algebraic degrees and general higher-order differential discriminants.
[0029] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description
[0030] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.
[0031] Figure 1 This is a flowchart of the construction process of a high-order differential divider; Figure 2 This is a flowchart of the Poseidon(2)b algorithm's automated search process based on algebraic iterations; Figure 3 Here is the structure diagram of the Poseidon(2)b algorithm; Figure 4 It is an internal wheel structure diagram that introduces auxiliary variables; Figure 5 This is the external wheel structure diagram with auxiliary variables introduced: Figure 6 It is a header structure diagram that introduces auxiliary variables; Figure 7 This is a comparison chart of the actual algebraic degree and the theoretical value of the first branch of an instance of Poseidon(2)B.
[0032] Figure 8 This is a comparison chart of the actual algebraic degree and theoretical value of a single branch over three finite fields in Poseidon2B. Detailed Implementation
[0033] The present invention will be further described below with reference to the accompanying drawings and embodiments.
[0034] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.
[0035] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.
[0036] Where there is no conflict, the embodiments and features described in this application may be combined with each other.
[0037] Example 1 As a relatively recent achievement in arithmetic-oriented symmetric cryptography, the Poseidon(2)b algorithm was not proposed independently, but rather evolved from the classic Poseidon algorithm. In zero-knowledge proof (ZKP) systems, since the arithmetic performance of traditional cryptographic hash functions is usually not ideal, Lorenzo Grassi et al. proposed a method that natively supports large prime number fields. The Poseidon algorithm team developed a modular hash function framework and designed a concrete example, Poseidon. As a cryptographic primitive optimized for ZKP, Poseidon boasts excellent performance advantages. However, with the advancement of multivariate binary field proof systems such as Binius, the Poseidon algorithm team has addressed the issue of binary extended fields. The Poseidon(2)b algorithm is proposed based on the hash function. The Poseidon(2)b algorithm adopts the Hades structure and its non-linear layer uses a low-order mapping of x→x7. The linear layer uses different strategies in the inner and outer parts, but both are relatively dense matrices. In addition, the Poseidon(2)b algorithm is also divided into two versions, Poseidon2b and Poseidonb, for different engineering environments.
[0038] Existing attack methods against the Poseidon algorithm include linear layer bypass techniques based on invariant subspace trajectories, system solutions of algebraic equations, and Gröbner basis attacks. These attack methods suffer from the following technical shortcomings when transferred to Poseidon(2)b: Traditional difference analysis and linear analysis pose no threat to Poseidon(2)b.
[0039] The methods for solving algebraic equation systems cannot reduce the extremely high complexity, nor can they explore the growth law of the algebraic degree of Poseidon(2)b; The invariant subspace technique can only solve the input-output constraint problem (CICO problem) and cannot perform a distinguishing attack on the Poseidon(2)b algorithm.
[0040] An automated search model based on MILP is proposed to explore the algebraic degree of Poseidon(2)b, and then a method for constructing a higher-order differential discriminator based on the evaluated precise algebraic degree is proposed. The complete process of constructing the higher-order differential discriminator by the present invention is as follows: First, the propagation rules between the components of the algorithm are constructed by introducing auxiliary variables, and the algebraic relationship between the components in the cryptographic algorithm is converted into variable constraints based on MILP, and the algorithm structure logic is formed into an algorithm model.
[0041] Furthermore, this invention constructs termination conditions and objective optimization functions based on the target ciphertext, and transforms them into MILP-based variable constraints. Next, by calling Gurobi to search the objective optimization function, the upper bound of the algorithm's algebraic number at each iteration round is obtained. Finally, a precise algebraic degree is constructed. The plaintext space is defined, and the encrypted ciphertext is XORed and summed. The presence of a zero-sum property is then checked to complete the construction of the higher-order differential discriminator for the algorithm. A complete flowchart of the higher-order differential discriminator construction can be found here. Figure 1 The flowchart for the automated search of algebraic degrees can be found in [link to flowchart]. Figure 2 .
[0042] This invention can grasp the growth law of the algebraic degree of the algorithm itself, and can construct a high-order difference discriminator through a precise upper bound on the algebraic degree. At the same time, this method has good versatility and flexibility, and can be applied to all specific instances of the algorithm.
[0043] This invention solves the problem that multivariate polynomial equations cannot accurately explore the actual algebraic degree growth law of the algorithm itself, and has low data complexity; it also solves the defect that invariant subspace techniques cannot perform distinguishable attacks, and can effectively perform distinguishable attacks on algorithms through high-order difference distinguishers.
[0044] Existing technical methods lack analysis of the novel algorithm Poseidon(2)b. This invention provides an attack strategy for this algorithm.
[0045] This invention not only possesses the above advantages, but also constructs the longest high-order difference discriminator currently published. Furthermore, the core idea of this invention can be applied to a wider range of finite fields. The algorithm has clear practical value and potential for further research.
[0046] The following is a detailed introduction.
[0047] First, an automated search model for the number of algebraic iterations of the Poseidon(2)b algorithm based on MILP is constructed.
[0048] The structure of the Poseidon(2)b algorithm is as follows: Figure 3 As shown, the algorithm structure is decomposed, and variables are introduced. This yields a structural disassembly diagram, such as... Figures 4 to 6 As shown. Using these auxiliary variables, a constraint model is constructed between the components. The following is our technical model.
[0049] [Rounding constant plus model] Let for The propagation path of the previous round constant plus (XOR) is then the inequality is:
[0050] [S-box exponentiation operation] Let for The path of exponentiation operations on the path, and the greatest common divisor. .make ,Pick Its binary representation has a Hamming weight of 3. Then let the parameter set... Corresponding to The three non-zero bits. The MILP model of this power operation can be characterized by the following system of equations:
[0051] in, This is an intermediate vector used to temporarily store the addition result, and the dimensions of the above vectors are all... . This involves a circular shift operation.
[0052] [Matrix multiplication operation] Let The path for the upper linear layer (matrix multiplication) operation is: Introduction intermediate variable matrix Then the operational constraint can be abstracted as:
[0053] in, This represents a generalized copy operation, mapping a single input state to... An intermediate state; This represents the generalized XOR operation, which will... The intermediate states are linearly aggregated into one output state.
[0054] [Circular shift operation] Let The input state vector, This is the output state vector, and the vector's bit width is... Given parameters , The transformation involves performing a left circular shift on the input vector. The MILP model of this operation can be rigorously characterized by the following system of equations:
[0055] in, This represents the bit index within the state vector. This represents the modulo operation. The above equality constraint ensures that the input vector... Circular left shift After bit and output vector Each bit is equal.
[0056] [Generalized Copy Operation] Extending the copy operation to a generalized model: Let... for superior A generalized unidirectional propagation path of the copy operation (passing through) (operation), among which for Bit vector. Characterized by a system of inequalities:
[0057] [Overall Algorithm Model] Based on the models of the components described above, and the structural logic of the algorithm, an overall algorithm model is constructed, denoted as... , .in
[0058]
[0059]
[0060] By calling the algorithm model and flexibly adjusting the objective function, the number of algebras for different specific instances under more iterations can be evaluated.
[0061] Based on the model constructed above, the termination constraints and objective function are set. I achieved my search objective by setting termination conditions and an objective function. The following are the constraints added to the model.
[0062] [Termination Condition] When considering the first When calculating the algebraic degree of each encrypted variable, it is necessary to consider the existing model. Based on this, additional constraints are added to characterize the propagation behavior of the variable after multiple iterations, so the termination condition is:
[0063] One of the objective functions considered in [Objective Function 1] essentially characterizes the first... The highest algebraic degree of the plaintext monomials that can occur in a given ciphertext variable can be characterized by counting the number of active variables in the initial round, as shown below:
[0064] [Objective Function Two] The second objective function only considers the algebraic number of certain specific branches in the algorithm. The corresponding optimization search can be completed by modifying the branch range counted by the objective function, as follows:
[0065] in, Used to characterize the set of branches involved in the calculation of the objective function.
[0066] A high-order difference discriminator for a specific number of rounds is constructed based on the accurate algebraic number obtained through automated search.
[0067] Since the precise algebraic counts of all instances in the first few rounds before the first branch reaches saturation have already been obtained using an automated algebraic count search model based on MILP, using the aforementioned general search method is redundant and time-consuming. After obtaining the upper bound of the precise algebraic counts for each instance using this MILP model, the following algorithmic steps can be used to efficiently construct a high-order difference discriminator.
[0068] [Input] E: Target cryptographic algorithm Poseidon(2)b (can be the first r rounds of the algorithm) n: Bit length of the plaintext or data block d: Algebraic degree detected Randomly generated reference plaintext of length n bits :Include A set of different bit position indices (i.e., active bits). [Output] Boolean value: Whether the higher-order difference discriminator was successfully validated (returns True or False) Step 1: Determine the active bit dimension: Let the plaintext dimension (number of active bits) to be traversed be defined. .
[0069] Step 2: Legality Check: Determine Is it greater than .if If the algebraic order is too high, it means that a discriminator cannot be constructed within the given group length. In this case, an Error will be returned and the algorithm will terminate.
[0070] Step 3: Initialize the accumulator: Initialize a variable to store the XOR result, let... .
[0071] Step 4: Traverse the active bit space: Start the outer loop, for the variable from Traversing to Execute the following sub-steps in sequence: 4.1 Copying the Base Plaintext: Make the current plaintext... = Copy ( ).
[0072] 4.2 Constructing the data structure: Start an inner loop, for the variable... from Traversing to Extracting variables The The bit value is denoted as (i.e., by shifting to the right) Position and (Obtained by performing a bitwise AND operation). Assign the value to the active bit corresponding to the current plaintext: .
[0073] 4.3 Encryption Calculation: Input the current plaintext into the target encryption function to obtain ciphertext or an intermediate state, denoted as . .
[0074] 4.4 XOR Accumulation: XOR the current encryption result and add it to the sum: .
[0075] Step 5: After all loops verifying the zero-sum property have finished, determine the final result. Value. If If the value is 0, it indicates that the zero-sum characteristic has been successfully captured, and True is returned (higher-order difference discriminator is valid); if If it is not equal to 0, it means that the zero-sum property has not occurred, and returns False (discriminator verification failed).
[0076] Based on the construction of the above higher-order difference discriminator, we performed a higher-order difference analysis on the Poseidon(2)b algorithm instance and obtained very effective results.
[0077] Through the above technical solutions, this embodiment has achieved beneficial effects. Theoretically, the lengths of higher-order differential discriminators that can be constructed by the Poseidon(2)b algorithm are shown in Table 1 below.
[0078] Furthermore, this embodiment also provides a comparison between the precise upper bound of the algebraic number searched by the automated search attack and the theoretical upper bound. The results show that the algebraic number growth searched by the present invention does indeed exhibit an almost linear growth, while theoretically the algebraic growth trend of this algorithm is exponential. This indicates that the present invention can not only construct high-order difference discriminators, but also has a significant accuracy advantage in evaluating the algebraic number growth trend of the Poseidon(2)b algorithm, and has broad application prospects.
[0079] Furthermore, this invention also presents a general method for searching higher-order differential discriminants. Specifically, if an attacker does not know the exact algebraic degree of the algorithm being attacked, they can exhaustively search the plaintext space dimensions and check round by round whether the output exhibits zero-sum characteristics, thereby achieving a higher-order differential attack. In fact, this search method gradually expands the plaintext space construction of a certain branch as the number of rounds increases, judging whether an integral characteristic appears. This not only allows for the discovery of higher-order differential discriminants at a specific number of rounds, but also uses the integral characteristic to inversely determine the algebraic degree of that branch of the cryptographic algorithm at the corresponding number of rounds, thus providing strong evidence for our automated search results for algebraic degrees. However, this method also suffers from high complexity. Table 2 shows a comparison between higher-order differential discriminants constructed based on exact algebraic degrees and general higher-order differential discriminants.
[0080] Table 1: Length of higher-order difference discriminant in Poseidon(2)b algorithm based on exact algebraic order
[0081] Table 2: Comparison of general high-order difference discriminator search and high-order difference discriminator verification based on exact algebraic degree.
[0082] Example 2 A system for constructing a high-order difference discriminator for finite field algorithms includes: The data acquisition module is configured to acquire cryptographic algorithm parameters and set the desired number of rounds r of the higher-order differential distinguisher; The upper bound search module is configured to use an automated search model based on the acquired parameters and round number to obtain the upper bound D of the algebraic number of the cryptographic algorithm for round r, and construct a D+1 dimensional plaintext space. The iteration module is configured to calculate the XOR sum of the cryptographic algorithm output, determine whether the XOR sum is zero, and if so, the higher-order differential distinguisher is successfully constructed; otherwise, the number of rounds r of the expected higher-order differential distinguisher is adjusted, and the search is performed again using the algebraic degree automated search model.
[0083] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of one or more computer-usable storage media (including, but not limited to, disk storage, etc.) containing computer-usable program code. CD - ROM It takes the form of a computer program product implemented on (such as optical memory, etc.).
[0084] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0085] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0086] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0087] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made by those skilled in the art without creative effort within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. A method for constructing a high-order difference discriminator for finite field algorithms, characterized in that, Includes the following steps: Obtain the cryptographic algorithm parameters and set the desired number of rounds r for the higher-order differential distinguisher; Based on the obtained parameters and number of rounds, the upper bound D of the algebraic degree of the cryptographic algorithm for round r is obtained by using an automated search model of algebraic degree, and a D+1 dimensional plaintext space is constructed. Calculate the XOR sum of the cryptographic algorithm output, and determine if the XOR sum is zero. If it is, the higher-order differential discriminator is successfully constructed; otherwise, adjust the number of rounds r of the expected higher-order differential discriminator and reuse the algebraic degree automated search model for searching.
2. The method for constructing a high-order difference discriminator for finite field algorithms as described in claim 1, characterized in that, The cryptographic algorithm parameters include the target cryptographic algorithm Poseidon(2)b and the bit length of the plaintext or data block. Algorithm algebra times detected A randomly generated reference plaintext of length n bits and containing A set of different bit position indices.
3. The method for constructing a high-order difference discriminator for finite field algorithms as described in claim 1, characterized in that, Based on the acquired parameters and number of rounds, and using an automated search model based on algebraic degree, the upper bound D of the algebraic degree of the cryptographic algorithm for r rounds is obtained. The process of constructing the D+1 dimensional plaintext space includes: setting the plaintext dimension to be traversed... ,judge Is it greater than ,if If the algebraic order is too high, it means that a discriminator cannot be constructed within the group length, and an error is returned directly and the algorithm is terminated. Initialize a variable to store the result of the XOR operation, let... ; Start the outer loop, for variables from Traversing to Execute the following sub-steps in sequence: (1) Copy the base plaintext: Make the current plaintext = Copy ( ). (2) Constructing the data structure: Start the inner loop, for the variable from Traversing to Extracting variables The The bit value is denoted as ,Will Assign the value to the active bit corresponding to the current plaintext; (3) Encryption calculation: Input the current plaintext into the target encryption function to obtain ciphertext or intermediate state; (4) XOR accumulation: XOR the current encryption result into the sum.
4. The method for constructing a high-order difference discriminator for finite field algorithms as described in claim 3, characterized in that, The process of calculating the XOR sum of the cryptographic algorithm output and determining whether the XOR sum is zero includes: after all loops have finished, checking the final value... Value, if If the value is 0, it indicates that the zero-sum characteristic has been successfully captured, and the higher-order difference discriminator is valid; if If the result is not equal to 0, it indicates that the zero-sum property has not occurred, and the discriminator verification fails.
5. The method for constructing a high-order difference discriminator for finite field algorithms as described in claim 1, characterized in that, The construction process of the automated algebraic degree search model includes: obtaining cryptographic algorithm parameters, constructing an XOR model, an S-box model, a copy and modular addition model, and a matrix multiplication model, constructing an overall automated algebraic degree search model based on the above models, setting the objective function and termination condition, and using a solver to perform algebraic degree calculation to obtain the algebraic degree corresponding to each round.
6. The method for constructing a high-order difference discriminator for finite field algorithms as described in claim 5, characterized in that, The process of constructing an automated search model for the overall algebraic degree based on the above models, including the XOR model, S-box model, copying and modular addition model, and matrix multiplication model, involves: Let X be the input of the XOR function and Y be the output. for The propagation path of the previous XOR operation results in the inequality: To perform an S-box exponentiation operation: Let Y be the input of the S-box and Z be the output of the S-box. for The path of exponentiation operations on the path, and the greatest common divisor. ,make Let the parameter set Corresponding to The three non-zero bits of this power operation are characterized by the following set of equations: in, This is an intermediate vector used to temporarily store the addition result, and the dimensions of the above vectors are all... , This involves a circular shift operation; Perform matrix multiplication: Let The path for the upper linear layer matrix multiplication operation is: , Introduction intermediate variable matrix Then the operational constraint is abstracted as: in, This represents a generalized copy operation, mapping a single input state to... An intermediate state; This represents the generalized XOR operation, which will... The intermediate states are linearly aggregated into one output state; Perform a circular shift operation: Let The input state vector, This is the output state vector, and the vector's bit width is... Given parameters , The transformation is essentially a left circular shift operation on the input vector, and the MILP model of this operation is rigorously characterized by the following set of equations: in, This represents the bit index within the state vector. This represents the modulo operation; Perform a generalized copy operation: Extend the copy operation to a generalized model: Let for superior A generalized unidirectional propagation path for the replication operation, in which for Bit vectors; characterized by a system of inequalities: Based on the model of the components mentioned above, and the structural logic of the algorithm, construct the overall algorithm model, denoted as... , ,in Where t is the number of algorithm branches, and rp and rf are the number of partial rounds and the number of external rounds, respectively.
7. The method for constructing a high-order difference discriminator for finite field algorithms as described in claim 6, characterized in that, The process of setting termination conditions includes considering the first... When calculating the algebraic degree of each encrypted variable, in the original model... In addition to the above, corresponding constraints are added to characterize the propagation behavior of the variable after multiple iterations, and the termination condition is: in, It represents the j-th bit of the i-th branch in the r-th round of output; when i=k, this variable is the ciphertext of interest, and only one bit of it is of interest.
8. The method for constructing a high-order difference discriminator for finite field algorithms as described in claim 1, characterized in that, The process of setting the objective function includes: the objective function essentially describes the first... The highest algebraic degree of all possible plaintext monomials in a given ciphertext variable is characterized by counting the number of active variables in the initial round: .
9. The method for constructing a high-order difference discriminator for finite field algorithms as described in claim 1, characterized in that, The process of setting the objective function includes: the objective function only considers the algebraic number of certain branches in the algorithm; by modifying the range of branches counted by the objective function, the corresponding optimization search is completed. in, Used to characterize the set of branches involved in the calculation of the objective function.
10. A system for constructing a high-order difference discriminator for finite field algorithms, characterized in that: include: The data acquisition module is configured to acquire cryptographic algorithm parameters and set the desired number of rounds r of the higher-order differential distinguisher; The upper bound search module is configured to use an automated search model based on the acquired parameters and round number to obtain the upper bound D of the algebraic number of the cryptographic algorithm for round r, and construct a D+1 dimensional plaintext space. The iteration module is configured to calculate the XOR sum of the cryptographic algorithm output, determine whether the XOR sum is zero, and if so, the higher-order differential distinguisher is successfully constructed; otherwise, the number of rounds r of the expected higher-order differential distinguisher is adjusted, and the search is performed again using the algebraic degree automated search model.