An automated code verification method and apparatus
By relaxing constraints in the automated search of the impossible difference distinguisher, feasible difference paths are constructed, enabling automatic consistency verification of the model and code. This solves the problems of model complexity and manual verification in existing technologies, and improves the credibility and efficiency of search results.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- UNIV OF CHINESE ACAD OF SCI
- Filing Date
- 2026-03-26
- Publication Date
- 2026-07-21
AI Technical Summary
Existing technologies for automated search of impossible differential distinguishers suffer from complex model characterization and error-prone code implementation, resulting in a lack of effective verification methods for search results and affecting the reliability and credibility of the results.
An automated code verification method is proposed. By relaxing some constraints in the differential propagation model, a feasible differential propagation path is constructed to verify the consistency between the model and the code implementation, thereby reducing the reliance on manual verification.
It improves the credibility and reliability of impossible difference search results, reduces the difficulty of model characterization and debugging, improves verification efficiency, and has good versatility and scalability.
Smart Images
Figure CN122432011A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of cryptanalysis and information security technology, specifically to an automated code verification method and apparatus, which is used to verify the correctness of the automated search results of an impossible differential discriminator based on the Boolean satisfiability problem (SAT), belonging to the field of formal analysis and model verification technology of symmetric cryptographic algorithms. Background Technology
[0002] Symmetric cryptography refers to a cryptosystem that uses the same key for both encryption and decryption. It is characterized by high computational efficiency and simple implementation, and is widely used in data storage protection and network communication, such as block ciphers like AES and SM4.
[0003] Impossible differential analysis (IDA) is an important block cipher method. Its core idea is to eliminate erroneous candidate keys by utilizing input-output differential combinations that are impossible to occur in certain encryption rounds. Unlike classical differential analysis, which seeks "high-probability differential paths," impossible differential analysis focuses on paths with zero probability of differential propagation. Since such "zero-probability events" almost never occur in ideal random permutations, they can serve as highly binding screening criteria.
[0004] Over the past two decades, impossible differential analysis has been widely used in the security evaluation of various block cipher structures, including DES, AES, Camellia, and ARX-like ciphers. It has played a crucial role in evaluating the robustness of cryptography to differential attacks and improving the security of cryptographic designs.
[0005] The intermediate phase shift method is a commonly used approach for finding impossible differential distinguishers. Its basic idea is to find contradictions in differential propagation. The basic idea is as follows:
[0006] Plaintext difference → Forward propagation → [Intermediate state] ← Backward propagation ← Ciphertext difference .
[0007] Search for a guaranteed differential path from the encryption direction. Similarly, in the decryption process, we also search for a differential path that must exist. If there is a contradiction between the two paths found in these two directions... Then it is called It is an impossible difference. The probability of is 0, which cannot be 0 in random permutations, so this is an impossible difference discriminator.
[0008] Automated search is currently the main method for finding impossible differential discriminants. The basic idea is to formalize the differential propagation process in cryptographic algorithms as a constraint-solving problem, and use automated solvers (such as SAT or SMT) to systematically search for impossible differences.
[0009] The differential propagation process can be abstracted as a set of Boolean constraints, representing each intermediate variable, input-output difference, and their constraint relationships as a logical formula. Based on the model of the differential characteristics of block ciphers propagating through different components, the round function differential propagation process can be characterized. Then, by setting constraints on the input and output differences and writing them into the model, an automated search model for impossible differential discriminators can be achieved.
[0010] STP is an SMT solver based on SMT technology, specifically designed for solving Bit-Vector and Array formats. Internally, it uses SAT for solving. Figure 1 The diagram illustrates an automated search algorithm for an impossible difference discriminator implemented using Python to call STP. Figure 1 In the program, if STP returns "Valid" based on the output, it means the model has no solution, and the input and output correspond exactly to an impossible difference. .
[0011] This analytical approach, combining formal modeling with automated solution, significantly improves the systematicity and accuracy of impossible difference search and significantly reduces reliance on human experience. However, it places high demands on the model's characterization of the differential features of block ciphers during round function propagation. Researchers need to precisely describe the differential propagation relationships of S-boxes, linear layers, or hybrid layers at the formal level to ensure consistency between the solution results and actual cryptographic behavior. This poses a significant challenge to researchers' coding and debugging abilities. Even if the solver returns candidate impossible differences, researchers still need to manually verify the results to ensure the rationality and correctness of the path derivation. However, manual verification is not only time-consuming but also prone to omissions or logical errors.
[0012] Specifically, the following problems may be encountered during the modeling and code writing process:
[0013] 1. Conceptual errors at the modeling level
[0014] (1) Errors in the round function model, such as incorrect implementation of AES S-box, row shift, column mixing and round key addition, reversed order or missing a step, column mixing was added in the last round, and the row shift order was wrong.
[0015] (2) Byte order and bit number are confused, and the direction of byte row and column expansion (column-major order vs. row-major order) is easy to get wrong. Column mixing is operated on by column in AES semantics, and indexing by row in the code will be completely wrong.
[0016] 3. Common Program Errors at the Implementation Level
[0017] (1) Index / offset error: When generating a large number of variable names (y1_3_2_0, etc.), the loop boundary or step size is written incorrectly, resulting in the loss or duplication of variable names.
[0018] (2) Variable name duplication / pollution: Non-standard variable naming leads to overlapping and duplicate declarations of variables in the generated STP file.
[0019] (3) Forgetting to constrain certain intermediate variables or incorrectly adding constraints may turn the problem into an over-constrained (UNSAT) or under-constrained (resulting in false counterexamples).
[0020] (4) When generating STP files, string concatenation, escape characters or misplaced comments will generate incorrect syntax or semantics, causing the solver to malfunction.
[0021] 3. STP Interactions and Semantic Misunderstandings
[0022] (11) STP returns Valid, indicating no counterexample (UNSAT), meaning the input and output correspond to an impossible difference, and returns Invalid, indicating that a counterexample exists (SAT). Reversing these two interpretations will lead to completely opposite conclusions.
[0023] (2) Incompleteness caused by timeout / resource limitations. If the script continues to use the "pending" conclusion without detecting it, it will produce an incorrect judgment.
[0024] Therefore, ensuring the correctness of the impossible-differential discriminator search code is fundamental. It not only relates to the accuracy of specific experimental results but also affects the reproducibility and reliability of subsequent research. Especially in scenarios employing formal solution techniques such as SAT / SMT, any inconsistency between the modeling and coding layers can introduce hidden errors. Summary of the Invention
[0025] To address the problem that existing automated search processes for impossible difference discriminators based on SAT suffer from a lack of effective verification methods for search results due to the complexity of the difference propagation model, numerous constraints, and the susceptibility of the code implementation process to modeling errors or implementation mistakes, this invention proposes an automated code verification method and apparatus for verifying the correctness of the difference search program, thereby improving the reliability and model consistency of impossible difference search results.
[0026] To achieve the above objectives, the present invention provides an automated code verification method for verifying the correctness of impossible differential search results, comprising the following steps:
[0027] S1: Obtain an impossible difference output by the difference search program, wherein the impossible difference includes the input difference and the output difference;
[0028] S2: While keeping the input difference and output difference unchanged, relax some of the constraints in the differential propagation model used for impossible differential search;
[0029] S3: Solve the differential propagation model based on the relaxed constraints to obtain a feasible differential propagation path;
[0030] S4: Based on the feasible differential propagation path, verify the consistency between the code implementation of the differential propagation model and the differential search program.
[0031] In one embodiment of the present invention, optionally, in step S2, the partial constraint conditions include at least one of the following:
[0032] (1) Differential propagation constraint;
[0033] (2) Round function constraints;
[0034] (3) Difference constraints of nonlinear components.
[0035] In one embodiment of the present invention, optionally, in step S3, the differential propagation model is a Boolean satisfiability problem model, and the solution is performed using the SAT solver.
[0036] In one embodiment of the present invention, optionally, in step S2, the method of relaxing the constraints includes the following three types:
[0037] (1) Remove some inter-round differential consistency constraints;
[0038] (2) Weaken the differential constraint conditions of nonlinear components;
[0039] (3) Relax the restrictions on the difference values of intermediate states.
[0040] In one embodiment of the present invention, optionally, if a feasible differential propagation path that satisfies the input difference and output difference can be obtained after relaxing the constraints, then it is determined that the differential propagation model and the code implementation of the differential search program are consistent under the corresponding constraints.
[0041] The present invention also provides an automated code verification device for verifying the correctness of impossible difference search results based on SAT, comprising:
[0042] The impossible difference acquisition module is used to obtain the impossible difference paths output by the difference search program;
[0043] The constraint relaxation module is used to relax some constraints in the difference propagation model while keeping the input difference and output difference unchanged.
[0044] The path solving module is used to solve for feasible differential propagation paths based on relaxed constraints.
[0045] The consistency verification module is used to verify the consistency between the differential propagation model and the differential search program code implementation based on the feasible differential propagation path.
[0046] The automated code verification method and apparatus provided by this invention have the following beneficial technical effects:
[0047] (1) Reduce the reliance of impossible difference search results on manual verification
[0048] In existing technologies, even when candidate impossible differential discriminators are obtained through automated solvers such as SAT or SMT, researchers still need to manually derive and verify the results to determine whether the differential paths are truly unreachable. This process is highly dependent on human experience, and verification is complex and prone to omissions or logical errors.
[0049] This invention automatically relaxes some differential input or differential output constraints on the basis of the original impossible differential constraint model, constructs the corresponding feasible differential propagation path, and uses the feasible path to verify the consistency between the differential propagation model and the code implementation, thereby significantly reducing or even avoiding manual intervention and improving the automation level of the verification process.
[0050] (2) Improve the credibility and reliability of the results of the impossible difference discriminator.
[0051] In existing technologies, due to the complexity of the differential propagation model, subtle errors in model constraints or code implementation may cause the solver to return "pseudo-impossible differentials". Manual verification is difficult to fully cover all implicit propagation conditions, and there is a risk of misjudgment.
[0052] This invention introduces an "infeasible difference - feasible difference" verification mechanism, using the solution results of the same difference propagation model under different constraints to cross-verify. When a feasible path conforming to the difference propagation rules can be obtained after relaxing the constraints, the consistency between the model and the code implementation can be effectively proven, thereby improving the credibility of the originally impossible difference results and avoiding erroneous conclusions due to model mischaracterization.
[0053] (3) Reduce the difficulty of characterizing the differential propagation model and debugging the code.
[0054] In the background technology, researchers need to accurately describe the differential propagation rules of S-boxes, linear layers or mixed layers in block ciphers during the formal modeling stage. The models are complex and difficult to debug, and once there is a modeling deviation, it is often difficult to detect in time.
[0055] This invention introduces a self-verification mechanism into the automated search process, which can promptly detect potential errors in model description or code logic without relying on additional manual analysis, thereby effectively reducing the difficulty of model building and debugging and improving the robustness of the automated search system.
[0056] (4) Improve the overall efficiency of impossible difference search and verification.
[0057] In existing technologies, manual verification processes are often time-consuming, and the complexity of verification increases exponentially with the number of rounds, which seriously affects research efficiency.
[0058] This invention utilizes specific differential propagation instances generated by an automatic solver for verification, transforming abstract logical derivation into an instance-level verification process, significantly shortening verification time and improving the overall efficiency of impossible differential discriminator search and verification.
[0059] (5) It has good versatility and scalability.
[0060] The method proposed in this invention does not require specific restrictions on the block cipher structure, and can be applied to various impossible differential automatic search scenarios based on formal modeling such as SAT and SMT. It can also be extended to other cryptanalysis techniques based on unsatisfiability determination, and has good versatility and scalability. Attached Figure Description
[0061] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0062] Figure 1 A schematic diagram illustrating the automated search algorithm for an impossible difference distinguisher implemented using Python to call STP;
[0063] Figure 2 A schematic diagram for verifying traditional results;
[0064] Figure 3 A diagram illustrating automated code verification;
[0065] Figure 4 This is a schematic diagram of a code verification model. Detailed Implementation
[0066] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0067] This invention proposes an automatic verification method for impossible difference distinguishers based on "feasible difference proof by contradiction". By systematically relaxing the original impossible difference constraints, feasible difference paths are constructed, thereby achieving automatic consistency verification of the correctness of the difference model and the search code without manual derivation.
[0068] The main innovative points of this invention are as follows:
[0069] (1) A method for verifying impossible difference discriminators based on constraint relaxation and feasible difference construction is proposed, which transforms the traditional correctness verification process that relies on manual derivation into an automated consistency determination problem.
[0070] (2) An “infeasible-feasible” dual-model verification mechanism was designed. By systematically relaxing some constraints in the original impossible difference model, a specific feasible difference propagation path was constructed, thereby verifying the correctness of the difference propagation model and the search code in reverse.
[0071] (3) The method provided by the present invention avoids logical omissions and subjective misjudgments that may occur in manual verification, and improves the credibility and verification efficiency of impossible differential search results.
[0072] (4) The proposed verification framework does not require the introduction of additional external models or manual derivation. It can be directly embedded into the existing automated impossible difference search process, and has good versatility and scalability.
[0073] In the field of cryptanalysis, the correctness of the algorithm implementation directly determines the reliability of the research conclusions. Taking the search for an impossible differential distinguisher in AES as an example, researchers typically need to write complex programs to describe differential propagation, establish constraint models, and perform path searches. These programs often involve a large number of bit operations, finite field calculations, and logical condition symbol conversions. Even a slight oversight can lead to analysis results that do not match actual cryptographic behavior. For example, if the differential propagation conditions or S-box constraint expressions are flawed, the solver may incorrectly determine a path as "impossible" or "feasible," thereby undermining the credibility of the entire analysis.
[0074] 1. Traditional verification
[0075] like Figure 2The diagram illustrates traditional result verification. In the automated search of the impossible difference discriminator, the program returns some impossible differences. Firstly, when the correctness of the code is unknown, the correctness of these impossible differences is also unknown. Therefore, manual verification is required. If contradictions are encountered during verification, it indicates that the obtained path is incorrect and the code has a problem (either in model characterization or code logic).
[0076] However, this verification method is not only time-consuming, but also prone to omissions or logical errors.
[0077] 2. Automated code verification
[0078] To address this problem, the present invention makes improvements. For example... Figure 3 The diagram illustrates automated code verification. Based on the impossible differences obtained by the discriminator, some constraints are reduced (e.g., commenting out restrictions on the output differences). Using new difference inputs and outputs, the discriminator is re-used to return a feasible difference propagation path. With this feasible difference propagation path, the accuracy of the code can be directly verified.
[0079] If the verification passes, it means that the code has been made as correct as possible. In other words, the impossible difference path we just obtained is also as correct as possible. If the verification fails, it directly means that the code is wrong, and the impossible difference path is also wrong.
[0080] 3. Summary
[0081] like Figure 4 The diagram illustrates the code verification model. After the algorithm completes execution, it outputs a result indicating whether the searched differential path is valid. Based on this result, two cases can be identified:
[0082] (1) If the output result is Valid:
[0083] This indicates that the algorithm has determined the path to be an impossible difference path. In traditional analysis, this situation usually requires researchers to manually verify the rationality of the path and the correctness of the derivation. However, manual verification is not only time-consuming but also prone to omissions or logical errors. For a valid result, a few conditions can be reduced, such as commenting out the output difference restriction. In this case, the program will output invalid and a counterexample, which can then be used to verify the correctness of the program.
[0084] (2) If the output result is Invalid:
[0085] In this scenario, the program returns a counterexample, which represents a feasible difference propagation path. This invention will use this path to verify the reliability of the algorithm implementation and the correctness of the code, confirming whether the algorithm's logic and constraint solving are correct. If the verification passes, it indicates that the algorithm is as correct and reliable as possible in terms of discriminator construction and path judgment; that is, the impossible difference obtained is as correct as possible, which will greatly accelerate the efficiency of finding impossible difference paths.
[0086] This invention provides an automated code verification method for verifying the correctness of impossible difference search results, comprising the following steps:
[0087] S1: Obtain an impossible difference output by the difference search program, wherein the impossible difference includes the input difference and the output difference;
[0088] S2: While keeping the input difference and output difference unchanged, relax some of the constraints in the differential propagation model used for impossible differential search;
[0089] S3: Solve the differential propagation model based on the relaxed constraints to obtain a feasible differential propagation path;
[0090] S4: Based on the feasible differential propagation path, verify the consistency between the code implementation of the differential propagation model and the differential search program.
[0091] In one embodiment of the present invention, optionally, in step S2, the partial constraint conditions include at least one of the following:
[0092] (1) Differential propagation constraint;
[0093] (2) Round function constraints;
[0094] (3) Difference constraints of nonlinear components.
[0095] In one embodiment of the present invention, optionally, in step S3, the differential propagation model is a Boolean satisfiability problem model, and the solution is performed using the SAT solver.
[0096] In one embodiment of the present invention, optionally, in step S2, the method of relaxing the constraints includes the following three types:
[0097] (1) Remove some inter-round differential consistency constraints;
[0098] (2) Weaken the differential constraint conditions of nonlinear components;
[0099] (3) Relax the restrictions on the difference values of intermediate states.
[0100] In one embodiment of the present invention, optionally, if a feasible differential propagation path that satisfies the input difference and output difference can be obtained after relaxing the constraints, then it is determined that the differential propagation model and the code implementation of the differential search program are consistent under the corresponding constraints.
[0101] The present invention also provides an automated code verification device for verifying the correctness of impossible difference search results based on SAT, comprising:
[0102] The impossible difference acquisition module is used to obtain the impossible difference paths output by the difference search program;
[0103] The constraint relaxation module is used to relax some constraints in the difference propagation model while keeping the input difference and output difference unchanged.
[0104] The path solving module is used to solve for feasible differential propagation paths based on relaxed constraints.
[0105] The consistency verification module is used to verify the consistency between the differential propagation model and the differential search program code implementation based on the feasible differential propagation path.
[0106] The automated code verification method and apparatus provided by this invention have the following beneficial technical effects:
[0107] (1) Reduce the reliance of impossible difference search results on manual verification
[0108] In existing technologies, even when candidate impossible differential discriminators are obtained through automated solvers such as SAT or SMT, researchers still need to manually derive and verify the results to determine whether the differential paths are truly unreachable. This process is highly dependent on human experience, and verification is complex and prone to omissions or logical errors.
[0109] This invention automatically relaxes some differential input or differential output constraints on the basis of the original impossible differential constraint model, constructs the corresponding feasible differential propagation path, and uses the feasible path to verify the consistency between the differential propagation model and the code implementation, thereby significantly reducing or even avoiding manual intervention and improving the automation level of the verification process.
[0110] (2) Improve the credibility and reliability of the results of the impossible difference discriminator.
[0111] In existing technologies, due to the complexity of the differential propagation model, subtle errors in model constraints or code implementation may cause the solver to return "pseudo-impossible differentials". Manual verification is difficult to fully cover all implicit propagation conditions, and there is a risk of misjudgment.
[0112] This invention introduces an "infeasible difference - feasible difference" verification mechanism, using the solution results of the same difference propagation model under different constraints to cross-verify. When a feasible path conforming to the difference propagation rules can be obtained after relaxing the constraints, the consistency between the model and the code implementation can be effectively proven, thereby improving the credibility of the originally impossible difference results and avoiding erroneous conclusions due to model mischaracterization.
[0113] (3) Reduce the difficulty of characterizing the differential propagation model and debugging the code.
[0114] In the background technology, researchers need to accurately describe the differential propagation rules of S-boxes, linear layers or mixed layers in block ciphers during the formal modeling stage. The models are complex and difficult to debug, and once there is a modeling deviation, it is often difficult to detect in time.
[0115] This invention introduces a self-verification mechanism into the automated search process, which can promptly detect potential errors in model description or code logic without relying on additional manual analysis, thereby effectively reducing the difficulty of model building and debugging and improving the robustness of the automated search system.
[0116] (4) Improve the overall efficiency of impossible difference search and verification.
[0117] In existing technologies, manual verification processes are often time-consuming, and the complexity of verification increases exponentially with the number of rounds, which seriously affects research efficiency.
[0118] This invention utilizes specific differential propagation instances generated by an automatic solver for verification, transforming abstract logical derivation into an instance-level verification process, significantly shortening verification time and improving the overall efficiency of impossible differential discriminator search and verification.
[0119] (5) It has good versatility and scalability.
[0120] The method proposed in this invention does not require specific restrictions on the block cipher structure, and can be applied to various impossible differential automatic search scenarios based on formal modeling such as SAT and SMT. It can also be extended to other cryptanalysis techniques based on unsatisfiability determination, and has good versatility and scalability.
[0121] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of one embodiment, and the modules or processes shown in the drawings are not necessarily essential for implementing the present invention.
[0122] Those skilled in the art will understand that the modules in the apparatus of the embodiments can be distributed in the apparatus of the embodiments as described in the embodiments, or they can be located in one or more devices different from this embodiment with corresponding changes. The modules of the above embodiments can be combined into one module, or they can be further divided into multiple sub-modules.
[0123] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. An automated code verification method for verifying the correctness of impossible differential search results, characterized in that, Includes the following steps: S1: Obtain an impossible difference output by the difference search program, wherein the impossible difference includes the input difference and the output difference; S2: While keeping the input difference and output difference unchanged, relax some of the constraints in the differential propagation model used for impossible differential search; S3: Solve the differential propagation model based on the relaxed constraints to obtain a feasible differential propagation path; S4: Based on the feasible differential propagation path, verify the consistency between the code implementation of the differential propagation model and the differential search program.
2. The method according to claim 1, characterized in that, In step S2, the partial constraints include at least one of the following: (1) Differential propagation constraint; (2) Round function constraints; (3) Difference constraints of nonlinear components.
3. The method according to claim 1, characterized in that, In step S3, the differential propagation model is a Boolean satisfiability problem model, and the solution is completed using the SAT solver.
4. The method according to claim 1, characterized in that, In step S2, the methods for relaxing the constraints include the following three: (1) Remove some inter-round differential consistency constraints; (2) Weaken the differential constraint conditions of nonlinear components; (3) Relax the restrictions on the difference values of intermediate states.
5. The method according to claim 1, characterized in that, If a feasible differential propagation path that satisfies the input difference and output difference can be obtained after relaxing the constraints, then it is determined that the differential propagation model and the code implementation of the differential search program are consistent under the corresponding constraints.
6. An automated code verification device for verifying the correctness of impossible difference search results based on SAT, characterized in that, include: The impossible difference acquisition module is used to obtain the impossible difference paths output by the difference search program; The constraint relaxation module is used to relax some constraints in the difference propagation model while keeping the input difference and output difference unchanged. The path solving module is used to solve for feasible differential propagation paths based on relaxed constraints. The consistency verification module is used to verify the consistency between the differential propagation model and the differential search program code implementation based on the feasible differential propagation path.