A side channel related performance analysis attack method for SLH-DSA algorithm

Abstract

The application discloses a side channel related performance energy analysis attack method for SLH-DSA algorithm and relates to the technical field of side channel security of a cryptographic algorithm. A target cryptographic device is caused to perform a deterministic SLH-DSA-SHAKE signature on a plurality of known messages, and physical leakage tracks when a PRFmsg calls SHAKE256 are collected. A reference column without SK.prf in a first absorption state is used to calibrate a target column analysis time window, leakage prediction of a candidate intermediate byte is established for each byte of SK.prf, and correlation analysis is performed. When n is 16 bytes, 16 candidate pairs are combined into 65536 candidate private key components, a randomized string R is recalculated by using a public key seed and a verification message respectively, and the private key components are screened and recovered by using R in the signature. The method can reduce the influence of fixed sampling time offset on correlation analysis and eliminate complementary candidate ambiguity without prior knowledge of SK.prf.

Description

Technical Field

[0001] This invention relates to the field of cryptographic algorithm side-channel analysis and physical attack technology, specifically to an attack method that uses a known reference column of the SHAKE256 initial absorption state for time-series self-calibration, obtains byte candidates of the private key component SK.prf in the SLH-DSA-SHAKE implementation through correlation energy analysis, and recovers the private key component using a signature randomized string R. Background Technology

[0002] SLH-DSA is a stateless hash digital signature algorithm. Its SHAKE parameter set uses SHAKE256 as the underlying hash function. The security parameter n of SLH-DSA-SHAKE-128s and SLH-DSA-SHAKE-128f is 16 bytes. The private key contains SK.seed, SK.prf, PK.seed, and PK.root, while the public key contains PK.seed and PK.root. In deterministic signature mode, the optional randomization input opt_rand is set to PK.seed. The message random number generation function PRFmsg generates a randomized string R based on SK.prf, opt_rand, and the message string participating in the signature. R constitutes the starting part of the signature.

[0003] When cryptographic devices perform logical operations, node flipping in registers, buses, and combinational logic causes changes in supply current or nearby electromagnetic fields related to the processing of intermediate data. Correlation energy analysis, by establishing leakage predictions for candidate intermediate data and statistically correlating these predictions with multiple measured trajectories at various sampling points, can filter candidate secret data values ​​from cryptographic devices with data-related physical leakage.

[0004] The core permutation Keccak-f

[1600] of SHAKE256 includes the Theta, Rho, Pi, Chi, and Iota steps. When the column parity value of the first round of the Theta step is used as an intermediate quantity for correlation analysis, the secret byte in the target column will participate in XOR with other state bytes in the same column. If the complete state is constructed directly, it is easy to mistakenly take other secret bytes that have not yet been recovered as known quantities; if the peak is searched directly in the full sampling window, it is easy to be disturbed by trigger jitter, compiler scheduling, pipeline pauses, and other adjacent operation peaks. In addition, the Hamming weight model makes a byte value theoretically correlated with its bitwise complementary value with opposite signs but the same absolute value. Therefore, the true value of the two cannot be determined based solely on the absolute correlation peak.

[0005] Existing general correlation energy analysis methods typically rely on pre-defined target times or manual trajectory checks, making it difficult to adapt to trigger jitter and execution timing variations in target cryptographic devices. When using the Hamming weight model, the target byte and its bitwise complementary value produce correlation peaks with the same absolute value but opposite signs. Relying solely on absolute correlation scores is insufficient to determine the true byte from candidate pairs; furthermore, in actual attacks, it's impossible to verify candidates byte-by-byte using the known SK.prf. Since the randomized string R in the deterministic SLH-DSA-SHAKE signature is located at the beginning of the signature and can be determined by SK.prf, the public key seed, and the verification message, a side-channel correlation energy analysis attack method is needed that utilizes known reference columns for timing calibration, preserves complementary candidates for each target byte, and recovers SK.prf from candidate combinations using the randomized string R. Summary of the Invention

[0006] The purpose of this invention is to provide a side-channel correlation energy analysis attack method for the SLH-DSA algorithm. The method uses the known reference column in the first absorption state to determine the target analysis window of the first round Theta step, independently filters the candidates for each target byte of SK.prf, combines the candidate bytes into candidate private key components, and filters the recovered private key components through the signature randomization string R, thereby eliminating the ambiguity of complementary candidates without prior knowledge of SK.prf.

[0007] To achieve the above objectives, the present invention adopts the following technical solution.

[0008] A side-channel correlation energy analysis attack method targeting the SLH-DSA algorithm includes: Obtain the public key seed PK.seed of the target cryptographic device, enable the target cryptographic device storing the private key component SK.prf to be recovered to perform SLH-DSA-SHAKE signature for multiple different known messages in deterministic signature mode, and collect the physical leakage trajectory of the first round Theta step of Keccak-f

[1600] after the first absorption when the message random number generation function PRFmsg calls SHAKE256 to cover the first absorption; Based on the known data in the initial absorption state, the column parity byte of the reference column excluding SK.prf is calculated, a reference leakage prediction vector is established, and the analysis window of the target column where SK.prf is located is determined according to the correlation between the reference leakage prediction vector and the physical leakage trajectory. For each target byte in SK.prf, the known status bytes other than the target byte in the corresponding target column are combined into a known byte. The candidate values ​​of the target byte are XORed with the known byte respectively. A candidate leakage prediction vector is established based on the obtained intermediate candidate bytes. Correlation analysis is performed within the analysis window. The candidate set of each target byte is obtained by filtering based on the correlation scores. The candidate values ​​in each candidate set are combined according to the byte index to obtain multiple candidate private key components. The randomized string R is recalculated using each candidate private key component, the public key seed, and the verification message. The recalculated randomized string R is compared with the randomized string R in the signature output by the target cryptographic device for the verification message. The candidate private key component corresponding to the consistent result is determined as the recovered private key component.

[0009] Further, the security parameter n of the SLH-DSA-SHAKE signature is 16 bytes; the initial absorption state consists of 25 64-bit state units lanes arranged in 5 columns and 5 rows, with the column index and row index denoted as x and y respectively, and the state unit denoted as A[x,y]; bytes 0 to 7 of SK.prf are located in A[0,0], bytes 8 to 15 are located in A[1,0], columns 0 and 1 are the target columns, and columns 2, 3, and 4 are the reference columns; the column parity byte of the reference column includes 24 known reference bytes of columns 2, 3, and 4 at byte offsets of 0 to 7 within the lane, and the column parity byte of the target column includes 16 target bytes of columns 0 and 1 at byte offsets of 0 to 7 within the lane.

[0010] Furthermore, determining the analysis window includes: determining the correlation peak positions of the reference leakage prediction vector and each sampling point of the physical leakage trajectory for each of the 24 known reference bytes; performing robust regression on the execution sequence number and correlation peak position of the known reference bytes according to the execution order of the parity check bytes calculated by the target cryptographic device to obtain the mapping relationship between the execution sequence number and the sampling position; extrapolating the center sampling position and analysis window of the 16 target bytes based on the mapping relationship, determining the sampling weight based on the local waveform of the reference correlation peak, and determining the leakage polarity based on the sign statistics of the reference correlation peak.

[0011] Furthermore, before performing relevant analysis, the physical leakage trajectory is subjected to abnormal trajectory removal, DC component removal, and time alignment; the abnormal trajectory removal adopts the median absolute deviation threshold based on trajectory energy or peak value, and the time alignment includes coarse alignment based on trigger signal and fine alignment based on cross-correlation of reference execution interval; for reference leakage prediction vector, candidate leakage prediction vector, or sampling column with zero variance, the corresponding correlation coefficient is not calculated.

[0012] Furthermore, the physical leakage trajectory is either the voltage trajectory across the shunt resistor or the electromagnetic trajectory near the target cryptographic device. When acquiring the voltage trajectory, a shunt resistor with a resistance of 0.1 ohms to 10 ohms is connected in series in the power supply branch of the target cryptographic device. The voltage across the shunt resistor is acquired through a differential amplifier. The analog-to-digital sampling rate is not less than 4 times the clock frequency used by the target cryptographic device to execute the Theta step. The acquisition window is based on the PRFmsg entry trigger signal.

[0013] Further, the correlation score is the maximum absolute value of the correlation coefficient within the analysis window, or the sum of the products of the absolute values ​​of the correlation coefficient within the analysis window and the sampling weights; for each target byte, the candidate value with the largest correlation score and its bitwise complementary value are determined as a candidate pair, the difference between the correlation score of the candidate pair and the highest correlation score after excluding the candidate pair is determined as the candidate interval, and the candidate pair is used as the candidate set of the corresponding target byte.

[0014] Furthermore, when the candidate intervals of each target byte reach the preset interval threshold and the correlation peak of the reference column reaches the preset reference threshold, the candidate set is verified; when the candidate interval of any target byte does not reach the preset interval threshold or the correlation peak of the reference column does not reach the preset reference threshold, the number of physical leakage trajectories is increased, time alignment is re-performed or the acquisition bandwidth is adjusted, and the analysis window and correlation score are recalculated.

[0015] Furthermore, when verifying the candidate set, a candidate value is selected from each candidate pair according to byte indices 0 to 15 and concatenated sequentially, so that the Cartesian product of the 16 candidate pairs forms 65536 candidate private key components; a combination index from 0 to 65535 is assigned to each candidate private key component according to the position of the selected candidate value in the candidate pair, and each candidate private key component is verified according to the combination index order or in parallel.

[0016] Furthermore, the verification message is different from the known message used for correlation analysis and does not participate in candidate leakage prediction and correlation score calculation; the optional randomized input opt_rand in the deterministic signature mode is PK.seed, and the randomized string R in the signature is the first 16 bytes obtained by performing a SHAKE256 operation on the concatenation result of the verification message string of SK.prf, PK.seed and the encoded actual input PRFmsg in the target cryptographic device; the same operation is performed by replacing SK.prf with each candidate private key component to obtain the corresponding recalculated randomized string R; when only one candidate private key component has a recalculated randomized string R that is identical byte-by-byte to the 16 bytes at the beginning of the signature, the candidate private key component is determined as the recovered private key component; when there is no consistent result, the process returns to the physical leakage trajectory collection or candidate screening stage; when there are multiple consistent results, the verification message is replaced and the candidate private key component that is consistent under different verification messages is retained until a unique consistent result is obtained.

[0017] Furthermore, at least three rounds of attacks are carried out on the same target cryptographic device. In each round, the known message and verification message used for correlation analysis are changed, while keeping SK.prf and PK.seed in the target cryptographic device unchanged. Only when at least two rounds of attacks have obtained a unique and consistent candidate private key component and the obtained recovered private key components are the same, the recovered private key component is determined as the final attack result, and the reference peak position deviation, candidate interval, number of candidate private key components, combination index of unique and consistent results and comparison result of randomized string R of each round of attacks are recorded.

[0018] The present invention has the following beneficial effects: (1) The reference column and the target column belong to the same Keccak-f

[1600] first round Theta step. The reference correlation peak can reflect the actual execution timing of the target cryptographic device under the current compilation, clock and sampling conditions, reducing the impact of fixed sampling time offset on candidate screening; (2) Each target intermediate byte consists only of the current candidate byte and the known state byte in the same column, without relying on other bytes of SK.prf. The 16 target bytes can be modeled and analyzed separately, avoiding error propagation in byte-by-byte recovery; (3) The 16 target bytes are completely combined into 65536 candidate private key components. The target SK.prf does not need to be known in advance, nor does it rely on the relevant peak symbols to arbitrarily discard complementary candidates, thus avoiding the real bytes being eliminated in advance due to symbol judgment deviation. (4) By using the 16-byte randomized string R located at the beginning of the signature in the deterministic signature as a precise filtering condition, a unique consistent result can be determined from the candidate private key components; combined with different verification messages and repeated attack results, it is also possible to distinguish between incomplete candidate sets, inconsistent message encoding and accidental collisions. Attached Figure Description

[0019] Figure 1 A three-dimensional coordinate diagram of the internal state of Keccak-f

[1600] ; Figure 2 The schematic diagram of the mapping principle from SK.prf, PK.seed, message, padding value and initial value of capacity area in the first absorption block of SHAKE256 to the Keccak-f

[1600] state lane; Figure 3 Modeling the parity check byte of the target column and its relationship with the self-calibration of the known reference column; Figure 4 This is a schematic diagram illustrating the principle of physical leak trajectory acquisition. Figure 5 To reproduce the trigger alignment trajectory, target execution window, and related peak plots of known reference columns in the experiment; Figure 6The correlation curves for the correct candidate, complementary candidate, and strongest non-complementary incorrect candidate for the 0th target key byte; Figure 7 A comparison chart of the correlation peaks of correct candidate pairs and the strongest non-complementary error peaks for 16 target key bytes; Figure 8 The figure shows a reproducible experimental curve of the correct candidate pair entry rate as a function of the number of trajectories under different noise standard deviations. Figure 9 Hamming distance and its distribution when filtering 65,536 candidate private key components using a randomized string R. Detailed Implementation

[0020] The following description, in conjunction with the accompanying drawings, further illustrates a complete embodiment of the present invention. The numerical values ​​are used to illustrate possible implementations and do not constitute a limitation on the scope of protection. Unless otherwise specified, bitwise XOR is denoted as... Circular left shift by one bit is denoted as The Hamming weight function is denoted as The floor function is denoted as .

[0021] This embodiment implements a side-channel correlation energy analysis attack against SLH-DSA-SHAKE-128s or SLH-DSA-SHAKE-128f, with parameter n=16 bytes. The target cryptographic device internally stores fixed SK.prf and PK.seed, where PK.seed can be obtained from the public key, and SK.prf is the unknown private key component to be recovered. In deterministic signature mode, opt_rand=PK.seed, and the output of PRFmsg is:

[0022] In the formula, R_i is the randomized string of the i-th signature; SK.prf is a 16-byte private key component that is fixed inside the target cryptographic device and unknown to the attack analysis end; PK.seed is a fixed and known 16-byte public key seed; When the known message string actually sent to the PRFmsg for the i-th signature contains the context encoding required by the specification, This represents the string after encoding; the symbol ∥ indicates byte string concatenation; 8n represents the number of output bits, since n=16, R_i is 16 bytes.

[0023] Before launching the attack, the target cryptographic device is set to deterministic signature mode in an authorized testing environment. If the target cryptographic device also supports randomized signature mode, the deterministic mode is explicitly selected through the test interface, and `opt_rand` is confirmed to be `PK.seed` in the current public key before each signature; if this condition cannot be confirmed, the randomized string R filtering stage is not entered. The attack analysis end only obtains the index relationship between `PK.seed`, known messages, signatures, and physical leakage traces, and does not obtain `SK.prf` in the target cryptographic device. The actual value of `SK.prf` is not used in reference modeling, correlation score calculation, candidate sorting, threshold determination, and candidate combination.

[0024] One method for constructing a message set is as follows: the first 8 bytes of the message are encoded using the little-endian code of a 64-bit unsigned count value i. The concatenation result of the fixed label CAL, the count value, and the device identifier digest is extended using SHAKE256, and the first 56 bytes are taken as the last 56 bytes of the message, resulting in a 64-byte message. Since the first 8 bytes of each message directly contain distinct count values, all messages are unique. Verification messages are generated using the fixed label VERIFY and count intervals that do not overlap with the collected set, preventing verification messages from participating in related score calculations. If the signature interface also encodes the context string, pre-hash identifier, or message length, the relevant analysis end reconstructs the message according to the actual encoding rules of the target cryptographic device. The encoded complete byte string is then saved to the attack log.

[0025] SHAKE256 uses Keccak-f

[1600] , and its state A[x,y] consists of 25 64-bit lanes, where x,y∈{0,1,2,3,4}, and the state coordinate relationship is as follows. Figure 1 As shown. SHAKE256 has a bitrate of 1088 bits (136 bytes) and a capacity of 512 bits (64 bytes). When constructing the first absorb block, SK.prf, PK.seed, and... The data is written sequentially to the rate area. When the input data ends within the block, it is XORed with the hexadecimal value 0x1F at the end position and with the hexadecimal value 0x80 at the last byte of the block. If the input data does not end within the block, the first 136 bytes are absorbed as a complete rate block, and a field suffix and a terminating bit are added to the subsequent last block. The capacity area is zero before the first replacement.

[0026] Let the byte offset of the first absorbed block be... Then the lane number, column index, row index, and byte offset within the lane corresponding to this byte are as follows:

[0027] In the formula, For lane number; The value range is from 0 to 135; For column indexes; For row index; This is the byte offset within the lane. Each byte is written to the lane in little-endian order, i.e., the offset within the lane. Bit mapping to status bits ,in .

[0028] like Figure 2 As shown, bytes 0 to 7 of SK.prf are located in Bytes 8 to 15 are located in ;Bytes 0 to 7 of PK.seed are located in Bytes 8 to 15 are located in ; message string from Write continues. Therefore, the target secret bytes are only distributed in the column. and And list , and It does not contain the SK.prf byte.

[0029] During state construction, a 200-byte array of all zeros is first created, with the first 136 bytes used as the rate area and the last 64 bytes as the capacity area. Then, SK.prf, PK.seed, and... are written sequentially. Then, write the field suffix and termination bit according to the actual end offset of this input. Then proceed according to... , , , and The aforementioned relationships are written byte-by-byte into the state array. The attack program reconstructs this state for each message, preventing the reuse of values ​​from the previous message. As a mapping consistency check, values ​​can be read separately... , , and The 8 bytes were confirmed to correspond to two 8-byte segments of SK.prf and two 8-byte segments of PK.seed, respectively. This check was performed offline using public test vectors before the attack, without using SK.prf in the target cryptographic device or participating in related analysis.

[0030] In each round of Keccak-f

[1600] , the Theta step first calculates five 64-bit column parity values:

[0031] In the formula, For the first The column corresponding to each input The 64-bit parity check value; For the first The input is the state lane after the first absorption. Then, the following calculations are performed:

[0032]

[0033] In the formula, To spread to the column The 64-bit difference value; This is the lane updated after the Theta step. This invention uses computation... The byte values ​​formed or transmitted during this period are treated as first-order leak-sensitive intermediates, without requiring the internal implementation of subsequent Rho, Pi, Chi, and Iota steps to be the same.

[0034] After completing the initial absorption state construction, according to Figure 4 The power acquisition device shown acquires physical leakage traces. This device uses a 1-ohm non-inductive shunt resistor with a temperature coefficient not exceeding 50 ppm / ℃ connected in series in the 3.3 V power supply branch. A differential amplifier with an input bandwidth of 200 MHz and a differential gain of 20 is used to measure the voltage across the shunt resistor. A 12-bit analog-to-digital converter is used for sampling at 500 MS / s. An independent trigger pin is set at the PRFmsg input, and the trigger branch is not collinear with the differential measurement branch. The window length is set to 8 microseconds during acquisition, and each trace is obtained... Each sample value. The above parameters are suitable for target cryptographic devices with a clock frequency not exceeding 100 MHz; for other devices, the sampling rate and window length should be adjusted based on whether the relevant peaks of the reference column appear completely.

[0035] The shunt resistor value is selected based on the supply current and allowable voltage drop. Taking a peak current of 60 mA as an example, a 1-ohm shunt resistor generates a maximum voltage drop of approximately 60 mV, which is less than 2% of the 3.3 V supply voltage. This provides a measurable differential voltage without easily causing the target cryptographic device to enter an undervoltage state. After connection, record 200 idle traces without performing signatures to check if the differential amplifier output is in the center of the analog-to-digital acquisition device's range, whether clipping occurs, and whether there is power frequency or switching power supply cycle interference. If clipping occurs, reduce the gain; if the reference peak is below the noise floor and the supply voltage drop allows, increase the shunt resistor or gain. The trigger line, differential input line, and analog-to-digital acquisition device clock line use different routing paths, and the differential input lines are arranged with equal lengths to avoid direct coupling of the trigger edge into a pseudo-correlation peak.

[0036] The shunt resistor can be selected from 0.1 ohms to 10 ohms: a value close to 0.1 ohms is used when the peak current is large to limit the supply voltage drop, and a value close to 10 ohms is used when the peak current is less than 5 mA to increase the measurable voltage. The selection should ensure that the minimum voltage at the target cryptographic device's power supply is higher than the rated operating lower limit. The analog-to-digital sampling rate is set to at least four times the clock frequency of the target cryptographic device; for example, 500 MS / s is used when the device clock is 100 MHz. If the processor has a multiplier or the Keccak operation uses an independent clock, the sampling rate is determined based on the higher clock frequency actually involved in the Theta calculation.

[0037] The acquisition sequence for a trajectory is as follows: First, the message index, message length, and message content are written to the test queue; second, the analog-to-digital acquisition device enters a pre-trigger waiting state; then, the signature interface of the target cryptographic device is called, the trigger pin is toggled before entering PRFmsg, and the trigger state is maintained within the interval of the first round of Theta steps after the first absorption; after the signature is completed, the first 16 bytes of R are read and sampling ends; finally, the message index, R, complete signature, trigger timestamp, and trajectory sample are written as a single record. If the signature interface returns an error, the trigger count is not 1, the R length is not 16 bytes, or the record index is inconsistent, the entire record is invalidated, and only the trajectory data is deleted.

[0038] Initial collection is acceptable Each trajectory undergoes a reference peak check. If fewer than 16 valid anchor points out of the 24 reference bytes meet the reference threshold, 200 more trajectories are added each time until the number of valid anchor points meets the condition or reaches the preset acquisition limit. Newly added trajectories use different messages than the original trajectories, but retain the same power supply, probe, amplification, and filtering parameters. This allows for a gradual improvement in the stability of the correlation estimation without altering the statistical model.

[0039] The message strings are located within the target cryptographic device and are stored in SK.prf and PK.seed. Each message contains 64 bytes, and all messages are unique. Messages are sent one by one, and their corresponding signatures and trajectories are obtained to produce the measured trajectory matrix.

[0040] In the formula, The number of trajectories; The number of sampling points for each trajectory; For trajectory indexing; For sampling point index; For the first Trajectory at sampling point The voltage or electromagnetic amplitude at that location.

[0041] During preprocessing, the mean square energy and peak value of each trajectory are calculated after removing the mean. Trajectories with any index deviating from the median by more than 5 times the absolute deviation of the median are marked as abnormal trajectories and removed. Subsequently, coarse alignment is performed using the trigger edge, and fine alignment is performed within a wide window containing the known reference column using the normalized cross-correlation peaks of each trajectory and the median reference trajectory; the maximum shift for fine alignment is set to ±12 sampling points in this embodiment. Finally, the DC component is removed from each trajectory. Depending on the acquisition environment, bandpass filtering can be used without changing the target frequency band, but all trajectories should use the same filtering parameters.

[0042] Specifically, the mean value of each trajectory within the analysis window is recorded as the DC baseline. This baseline is first subtracted from the original samples, and then the mean square energy and peak value are calculated. The median and median absolute deviation are calculated for both indicators. Trajectories are deleted when either indicator exceeds its corresponding upper or lower threshold. If the median absolute deviation is 0, no deletion is performed based on that indicator to avoid mistakenly deleting all trajectories due to identical indicators after quantization. Coarse alignment uses the 50% amplitude position of the trigger pulse rising edge. The fine alignment template is obtained by taking the median of all valid trajectories after coarse alignment, searching for the position of maximum normalized cross-correlation within ±12 sampling points, and shifting the trajectory. After one fine alignment, the template is regenerated and aligned again, with the sum of the two shifts still limited to ±12 sampling points.

[0043] Filtering is not a prerequisite for correlation analysis. When significant low-frequency power supply drift exists, a zero-phase bandpass filter with a passband of 5 MHz to 120 MHz can be used as an example. The reference peak position should be checked before and after filtering. If the peak position changes by more than two sampling points or significant ringing occurs in the peak shape, the filter setting should be cancelled. After preprocessing, the sample variance is calculated for each sampling point; sampling columns with a variance of 0 are marked as invalid. The same check is performed on candidate prediction vectors; if the vector variance is 0, the correlation coefficient is not calculated, and the corresponding known synthetic bytes are sufficiently varied by changing the message set.

[0044] Self-calibration of known reference columns is performed on the collected and preprocessed physical leak trajectories. For the columns... , From a known PK.seed, message, or padding value. to From known messages, padding values, unused bytes in the rate zone, or capacity zones initialized to zero. Therefore, parity bytes for all three columns can be calculated without requiring the actual SK.prf value.

[0045] set up Represents a 64-bit lane or column parity value. The offset within the middle lane is The bytes. The predicted leakage of the known reference column is:

[0046] In the formula, For the first Trajectory, Reference Column and byte offset The corresponding Hamming weight prediction value. For any prediction vector and sampling column The Pearson correlation coefficient is:

[0047] In the formula, The sample mean of the reference prediction vector; Sampling points The sample mean of N trajectories; This serves as the correlation coefficient between the reference prediction vector and the sampled column. When any factor in the denominator is zero, that position is marked as invalid and no correlation peak is assigned.

[0048] by Indicates the execution sequence number of the reference byte, and determines the absolute correlation peak positions of 24 reference prediction vectors within a preset wide search window. Robust fitting of the effective anchor points using Huber loss is performed.

[0049] In the formula, The extrapolated sampling position of the first byte; The average sampling interval for the positions of adjacent bytes; Use the reference anchor point residuals. Extrapolate the target column using the fitting results. The center position of each byte is determined. The sampling weight is obtained by the normalized average of the absolute correlation curves within 9 sampling points on each side of the center position of the reference peak; the leakage polarity is taken as the median of the effective reference peak signs. When there are fewer than 16 effective reference peaks, the median of the fitting residuals exceeds 3 sampling points, or the maximum reference peak is below 0.10, the data in this round will not enter the target byte decision, but will first be adjusted for alignment or the trajectory will be increased.

[0050] The self-calibration of the known reference column can be performed in the following order. First, reconstruct the initial absorption state for each valid trajectory and calculate the values ​​separately. , and The parity value is then divided into 24 reference bytes by byte offsets from 0 to 7 within the lane. Next, the Hamming weights of each reference byte across the entire trajectory are arranged into lengths of... The reference prediction vector is calculated, and its correlation coefficient is plotted with each valid sample column within a wide search window. The wide search window only needs to cover the first round of Theta calculation interval, for example, between 0.4 microseconds and 6.0 microseconds after triggering; it does not search throughout the entire signature execution period to reduce contention spikes caused by other Keccak rounds or storage accesses.

[0051] For a reference prediction vector, first find the local peak with the largest absolute correlation coefficient, then check whether there are complete rising and falling segments within the four sampling points to the left and right of that peak. Peaks that fall on the search window boundary, have incomplete samples on either side of the peak, or have a prediction vector variance of 0 are not used as anchor points. The sign of the reference peak is taken from the sign of the correlation coefficient at the peak location, and the intensity of the reference peak is taken from the absolute correlation coefficient at that location. The resulting anchor point contains the execution sequence number, sampling location, peak intensity, and peak sign simultaneously, not just a single time point.

[0052] Robust fitting is achieved using iterative reweighted least squares. The first step uses ordinary least squares to obtain... and The scale is then estimated based on the median absolute deviation of the anchor point residuals; anchor point weights with residual absolute values ​​not exceeding 1.5 times the scale are assigned a weight of 1, while anchor point weights exceeding this range are decayed by the reciprocal of the residual. This process is repeated until... and The process ends when all changes are less than 0.01 sampling points or reach 20 iterations. This process reduces the impact of erroneous anchor points caused by individual scheduling pauses, cache accesses, or periodic interference on the extrapolation of the target time window. After fitting, in addition to checking the median of the residuals, the process also checks... Whether it is positive and whether adjacent extrapolation windows maintain their order; if not, switch to the reference peak template mapping method described later, instead of continuing to use the erroneous linear extrapolation result.

[0053] The sampling weight generation process is as follows: For each valid reference anchor point, extract the absolute correlation curves of 9 sampling points to the left and right, shift the peak positions of each segment to the same center, and take the median for the same relative position to obtain a 19-point reference peak shape; then divide the 19 non-negative values ​​by their sum to obtain a weight sequence with a total sum of 1. For the target byte... The weight sequence is shifted to the extrapolation center. place, form In If only the maximum absolute correlation peak is used as the score, this weighted sequence is also retained to check whether the candidate peak is within the coverage area of ​​the reference peak shape. The leakage polarity is determined by the median of the effective reference peak symbols; when the number of positive and negative symbols is the same or the majority ratio is less than 70%, the leakage polarity is marked as unstable, and it is required to add a trajectory or reselect the acquisition frequency band.

[0054] The reference threshold is determined before the formal attack using leak-free control or message tag scrambling data. One example is to independently and randomly scramble the message index at least 1000 times, recalculating 24 reference peaks each time, recording the largest absolute correlation peak obtained from each scrambling, and using the larger of the 99.9th percentile of these largest peaks and 0.10 as the final reference threshold. This threshold determination process does not read the SK.prf file from the target cryptographic device, nor does it adjust the threshold in reverse based on the matching results of candidate private key components and the signature randomization string R.

[0055] like Figure 3 As shown, the self-calibration data mentioned above comes from the same round, the same step, and the same trajectory set as the target byte, and therefore can be updated as the scheduling and acquisition time base of the target cryptographic device changes, rather than using a fixed time given by another device or offline template.

[0056] After completing the self-calibration of the known reference columns, independently model and make relevant decisions for the target bytes of SK.prf. Let... If the target byte index is SK.prf, then the target column index and the byte offset within the lane are:

[0057] In the formula, , For each trajectory, calculate the known composite bytes of the other four lanes in the same column:

[0058] In the formula, It is determined solely by known information, padding values, and an initial zero value. For candidate values... The target column parity byte and predicted leakage are as follows:

[0059]

[0060] In the formula, For the first Trajectories in candidate values The target intermediate byte; This is the corresponding Hamming weight prediction value. Since XOR operations are performed independently at the same position... Excluding the other 15 bytes of SK.prf, thus each It can be calculated independently, without the need to set random or fixed values ​​for secret bytes that have not yet been recovered.

[0061] For example, From time to time , It is known that the synthesized bytes are composed of to The result is obtained by XORing the four bytes at offset 0 in the middle; From time to time , It is known that the synthesized bytes are composed of to The result is obtained by XORing the four bytes at offset 1. (Two examples) Each byte contains only the current target byte and will not be mixed with other bytes from the same SK.prf file. Therefore, the 16 target bytes can be processed independently in the same way or in parallel on the computing platform.

[0062] Composition of all predicted values matrix Following the aforementioned definition of the Pearson correlation coefficient, in the target byte... calibrated time window Internal calculation:

[0063] In this embodiment, the absolute correlation peak is used as the candidate score:

[0064] Self-calibrated weights can also be used. Calculate the weighted score ,in While calculating the absolute correlation value, the sign of the correlation coefficient is retained to facilitate checking whether it is consistent with the leakage polarity specified in the reference column.

[0065] For 8-bit values, candidate Its bitwise complementary value satisfy:

[0066] Therefore, the Pearson correlation coefficients of the two are theoretically equal in absolute value but opposite in sign. For each target byte, the candidate with the highest score and its complementary value are retained as candidate pairs. After excluding the candidate pair, the highest error score is recorded as... and will As a candidate interval. The example threshold can be set to... and The threshold should be determined through a leak-free control device or a scrambled tag test, and should not be selected in reverse based on the matching result of the candidate private key component and the signature randomization string R.

[0067] In actual calculations, the 256 candidate values ​​can be arranged in a row and generated one by one using a byte-by-byte XOR operation. The candidate intermediate bytes are calculated, and their Hamming weights are obtained by looking up a table. After calculating the score for each candidate, they are first sorted from highest to lowest based on their absolute correlation scores. The first candidate and its complementary value obtained by XORing it with 0xFF are treated as a single candidate pair, and both values ​​are simultaneously deleted from the sorted results. The highest score among the remaining candidates is then taken as the peak value of the non-complementary error. This deletion step avoids mistaking the complementary value as an independent second candidate, thus ensuring that the candidate interval truly reflects the degree of separation between the candidate pair and other candidates.

[0068] The candidate decision also checks peak position and peak sign. At least one candidate in the candidate pair should have a peak position that falls within the specified range. The deviation from the extrapolation center should not exceed half the width of the weight window; the correlation peak symbols of the two complementary candidates should be opposite, and one of the symbols should be consistent with the leakage polarity indicated by the known reference column. If the highest score appears at the window boundary, the complementary candidate symbols are not opposite, or the candidate interval is lower than the threshold, the byte is marked as undecided and will not be included in the complete key combination.

[0069] If any target byte is not determined, adjust the data according to the reason for failure. When both the reference peak and the target peak are weak, prioritize increasing the number of trajectories; when the reference peak position drifts between trajectories, re-perform fine alignment; when the reference peak is stable but the target peak is affected by narrowband periodic interference, adjust the acquisition bandwidth while keeping all trajectory parameters consistent; when only a few target bytes have excessively concentrated known composite byte values, change the message set. After each adjustment, recalculate from the reference column self-calibration, and do not fix the better-performing target candidates from the previous round as prior values.

[0070] The candidate score threshold and candidate interval threshold are also determined by message tag scrambling comparison. At least 200 scrambling operations are performed independently for each target byte, and the maximum candidate pair score and candidate interval in the scrambled data are recorded. The candidate score threshold is the larger of the 99th quantile of the corresponding distribution and 0.20, and the candidate interval threshold is the larger of the 99th quantile of the corresponding distribution and 0.04. This setting ensures that the two criteria reflect statistical fluctuations under leak-free conditions, and the randomized string R matching results of candidate combinations must not be used to change the above thresholds.

[0071] After obtaining 16 candidate pairs of target bytes, at least one verification message that was not involved in the relevant analysis is selected, causing the target cryptographic device to generate a deterministic signature under the same SK.prf and PK.seed, and then reading a 16-byte randomized string from the beginning of the signature. The candidate pairs of the q-th target byte are sequentially designated as the first candidate value and the second candidate value. A 16-bit binary selection vector is used to select one value from each candidate pair, and these values ​​are concatenated by byte index to form a candidate private key component. The q-th bit selection of the first and second candidate values ​​is designated as 0 and 1 respectively. The combination index u is determined by the unsigned integer corresponding to the 16-bit binary selection vector, where u ranges from 0 to 65535. For each candidate private key component, the following calculations are performed:

[0072] In the formula, u is the candidate combination index, K represents the candidate private key component, R with a cap symbol represents the predicted randomized string calculated from the corresponding candidate private key component, and 128 is the number of output bits. The calculation iterates through u from 0 to 65535; when only one predicted randomized string is identical to the 16 bytes of the signature randomized string, the corresponding candidate private key component is determined as the recovered private key component. If no consistent result exists, the candidate set is determined to be incomplete or the verification input is inconsistent; if multiple consistent results exist, the calculation is recalculated using another verification message, and the candidate private key component that is consistent under different verification messages is retained until a unique consistent result is obtained.

[0073] Candidate private key components can be generated iteratively: first, the two candidate values ​​of the 0th candidate pair are used as two 1-byte partial combinations, and then the two candidate values ​​from the 1st to the 15th candidate pairs are appended sequentially, doubling the number of partial combinations each time, ultimately resulting in 65,536 candidate private key components of 16 bytes each. Alternatively, the first or second candidate value in the q-th candidate pair can be selected directly based on the q-th bit of the combination index. All candidate private key components are processed in a randomized string R, without pre-removing candidates based on whether the candidate value is close to the predicted value, the Hamming distance, or the number of intermediate matching bytes. The calculation can be divided into multiple processing threads in fixed batches, but each combination index is calculated only once, and its byte-by-byte comparison result is retained.

[0074] When reading the randomized string for verification, first confirm that the signature length conforms to the selected SLH-DSA parameter set, and then read the first 16 bytes from the signature start position. The signature of the verification message is generated by the same target cryptographic device under the same SK.prf, PK.seed, and deterministic mode. The verification end constructs the verification message string to be sent to PRFmsg according to the same message encoding rules as the target cryptographic device. For each candidate private key component, it sequentially concatenates PK.seed and the verification message string, and then calls SHAKE256 to obtain a 16-byte predicted randomized string. It then compares the predicted randomized string with the byte-by-byte complete equality criterion, without substituting partial byte similarity or Hamming distance less than a threshold for complete consistency.

[0075] If no matching candidate exists, the encoding of the verification message at the signing and verification ends, whether opt_rand is PK.seed, the SHAKE256 output length, and the read offset of the randomized string R in the signature are checked sequentially. If no match is found after these conditions are met, the process returns to the physical leak trajectory acquisition and candidate filtering stage. When multiple matching candidates appear, the method does not directly select one based on the relevant score, but instead changes the verification message and recalculates the predicted randomized string for each candidate. When the predicted randomized string of an erroneous candidate is considered as a 128-bit uniform output, the upper bound of the probability that at least one of the 65535 erroneous candidates is completely consistent with a single signature randomized string is less than 2 to the power of -112. This method still uses the actual byte-by-byte comparison result as the standard and handles the case of multiple matching candidates by adding a verification message.

[0076] The correlation analysis and verification ends can be deployed as independent logical modules. The correlation analysis end receives PK.seed, known messages, and physical leakage traces, and outputs candidate pairs, candidate scores, and candidate intervals for each target byte. The verification end receives candidate pairs, PK.seed, verification messages, and the randomized string R in the corresponding signatures, generates 65536 candidate private key components, performs comparisons of the randomized string R, and outputs the number of consistent candidates, the combination index, and the recovered private key component. Neither logical module needs to receive SK.prf from the target cryptographic device.

[0077] When the number of valid reference anchors and the reference peak strength reach the threshold, the candidate intervals of the 16 target bytes all reach the threshold, and only one of the 65,536 candidate private key components is identical byte-by-byte to the signature randomization string R, the unique and consistent candidate private key component is determined as the result of this round of attack. The attack is repeated using three independent message sets. In each round, abnormal trajectory removal, alignment, self-calibration, target modeling, candidate combination, and randomization string R filtering are re-executed. The target cryptographic device, SK.prf, PK.seed, probe location, and hardware acquisition parameters remain unchanged between rounds. The final attack result is determined when at least two rounds yield unique and consistent results and the recovered private key components are identical; otherwise, the attack data is supplemented at the corresponding failure stage.

[0078] The attack log must include at least the target cryptographic device identifier, firmware version, sampling parameters, message set digest, number of valid traces, reference peak statistics, candidate pairs for each byte, candidate intervals, number of candidate private key components, combination index consistent with the signature randomization string R, and consistency of repeated attacks. The reference peak statistics must include at least the peak position, absolute peak value, peak sign, robust fitting residual, fitting intercept, and average sampling interval for each of the 24 reference bytes. The target decision log must include at least 256 candidate score digests, candidate pairs, the strongest non-complementary error value, candidate interval, and peak position deviation. The verification log must include at least the verification message digest, the read R, the predicted R for each consistent candidate, and the byte-by-byte comparison result. If a unique and consistent recovery private key component is not obtained, the failure stage and its corresponding data must be noted in the attack log; the failure of the attack should not be interpreted as the absence of side-channel leakage in the target cryptographic device.

[0079] To verify the mathematical consistency between the above modeling, self-calibration, and candidate verification, a deterministic simulation experiment is further constructed in this embodiment. This simulation experiment does not replace a physical attack against a specific target cryptographic device. Figures 5 to 9 The following values ​​are simulation results generated based on the parameters stated.

[0080] Set the target SK.prf to a hexadecimal byte string:

[0081] Set PK.seed to a hexadecimal byte string:

[0082] Using the PCG64 pseudo-random number generator, with a fixed random seed of 2052026, generate... Each message string is a unique 64-byte string. For each message, SK.prf, PK.seed, and the message are concatenated sequentially to obtain 96 bytes of data; then, 0x1F is XORed at byte offset 96, and 0x80 is XORed at byte offset 135. The remaining unused rate bytes and capacity areas are set to zero. Figure 2 The mapping calculation includes parity bytes for all five columns (8 columns).

[0083] Each simulation trajectory contains There are [number] sampling points, with an equivalent sampling rate of 250 MS / s. [Number] sampling points. The trajectory model is as follows:

[0084]

[0085] In the formula, The unit is mV; The sum of leakage pulses corresponding to 40 parity check bytes; 36 mV is the baseline. In 0 to Uniformly distributed within; the sinusoidal term has an amplitude of 0.18 mV and a period of 2.7 microseconds, used to represent low-frequency drift; Independent Gaussian white noise with a mean of 0 and a standard deviation of 1.05 mV; The trajectory gain has a mean of 1 and a standard deviation of 0.07. The time jitter is calculated for a mean of 0 and a standard deviation of 1.5 sampling points. The reference leakage pulse center is 4.7; the standard deviation of the Gaussian pulse sampling points is 4.7; and 0.52 mV is the leakage amplitude corresponding to each unit of centered Hamming weight. All of the above quantities are generated from a fixed random seed, and therefore can be recalculated.

[0086] Use columns Self-calibration was performed using 24 reference bytes, resulting in a linear relationship intercept of 260.3167 sampling points and an average interval of 21.9900 sampling points between adjacent bytes, consistent with the set values ​​of 260 and 22. Figure 5 As shown, reference column , and The example correlation peaks appeared at approximately 2.45 microseconds, 3.15 microseconds, and 3.86 microseconds, respectively, and the fitted relationship could be extrapolated forward. and The corresponding target time window.

[0087] A 16-byte correlation analysis was performed on 1200 trajectories, and the results are shown in the table below. In the table, "candidate pair peak" refers to the absolute correlation peak shared by the true value and its complementary value, and "erroneous peak" refers to the highest absolute correlation peak after excluding the complementary candidate pair.

[0088]

[0089] As can be seen from the table, all 16 target bytes have entered their respective complementary candidate pairs. Figure 6 The correlation curves for the correct candidate 0x76 and the complementary candidate 0x89 in the 0th byte show opposite signs; the peak value of the strongest non-complementary incorrect candidate 0x09 is lower than that of the candidate pair. Figure 7 Provide the mapping of all 16 bytes.

[0090] A sensitivity test was also conducted on single-byte candidates to the entry rate. Each combination of trajectory count and noise standard deviation was independently repeated 50 times; each time, a known synthetic byte, target byte, and noise were regenerated, and the success criterion was whether the candidate with the highest score and its complement contained the target byte. The results are as follows:

[0091] Figure 8 The above results were plotted as a curve. 100% in the table indicates that all 50 repetitions were successful under a fixed random seed, but does not mean that 100% can be achieved under any hardware or noise distribution.

[0092] The following hexadecimal byte strings are represented in groups of 4 bytes each, with spaces between groups not considered data. The 16 candidate pairs in the table form 65,536 candidate private key components. The target SK.prf is not read during the filtering process. The 64-byte verification message that was not included in the relevant analysis was selected. The actual byte sequence of the input PRFmsg of this verification message is 00010203 04050607 08090A0B0C0D0E0F 10111213 14151617 18191A1B 1C1D1E1F 20212223 24252627 28292A2B2C2D2E2F 30313233 34353637 38393A3B 3C3D3E3F. The randomized signature string R output by the target cryptographic device is 48C282BD A7448C82 FDFDD638 7183B16B. For each of the 65,536 candidate private key components, R was recalculated, and its Hamming distance to the signature R was calculated. Only the combination with index 11578 had a distance of 0; the distances of all other combinations were greater than 0. The recovered private key component corresponding to this unique matching combination was 76277D47 AAE8C2B7 AF328CEA 0C805C41. After R filtering, it was compared with the target SK.prf preset by the simulator, and the two matched. This comparison was only used to evaluate the simulation results and did not participate in candidate generation, threshold determination, or R filtering. The Hamming distance of all combinations ranged from 0 to 88 bits, with an average of 63.974 bits. Figure 9As shown, the randomized string R can directly determine a unique recovery combination from 65,536 candidate private key components.

[0093] The above experiments demonstrate that, given the leakage model and noise parameters, the known reference column can define the target analysis window, and the target byte-independent model can form complementary candidate pairs containing real bytes. By combining all 16 candidate pairs and performing precise comparison using the signature randomized string R, the unique recovery private key component can be determined without providing the target SK.prf to the attack analysis process, and the consistency of message encoding, deterministic randomized input, and PRFmsg computation chain can be verified. When launching attacks against specific chips, software libraries, or cryptographic modules, the following should be used... Figure 4 The device shown or an equivalent device collects the measured trajectory and determines the attack result according to the criteria described in this manual.

[0094] In this embodiment, the physical leakage trajectory is not limited to the shunt resistor power consumption trajectory. By placing a near-field magnetic probe on the surface of the target cryptographic device package and keeping the probe's position, orientation, and height constant, the electromagnetic trajectory of the first round of the Theta step can be collected; the known reference column self-calibration, target byte modeling, and R verification processes remain unchanged. For implementations with obvious register overwrite characteristics, the Hamming weight model can be replaced with a Hamming distance model between the known pre-state and candidate post-state, but the leakage polarity and candidate criteria should be re-determined using the known reference column.

[0095] One electromagnetic acquisition example uses a 3 mm diameter near-field magnetic probe. The probe plane is parallel to the chip package surface, and the probe center is located approximately 1 mm above the processor area performing Keccak operations. The probe output is amplified by a 20 dB low-noise amplifier and fed into an acquisition device with an analog bandwidth of 200 MHz, sampled at 500 MS / s. During localization, a small number of locations are first scanned at 1 mm intervals on the chip surface, acquiring 100 tracks at each location. The probe position is selected using only the maximum correlation peak of the known reference column. Once the position is determined, the probe is fixed and its position is not changed based on the target key candidate. Anomaly removal, fine alignment, and reference column thresholds for the electromagnetic tracks are all recalculated using this position; values ​​from the power consumption track conditions cannot be directly used.

[0096] When the message string length causes the initial absorbed data to span multiple 136-byte blocks, target modeling still targets the first absorbed block containing SK.prf. All input bytes in this block, except for SK.prf, are determined by PK.seed and the known message prefix; a 0x1F field suffix and a 0x80 terminating bit are only added when the data ends within this block. Attack analysis should calculate this block based on the actual message length, rather than assuming fixed padding positions.

[0097] For the 192-bit or 256-bit parameter set of SLH-DSA-SHAKE, it can be extended according to the same byte mapping principle. When n is 24 bytes, SK.prf occupies columns 0 to 2 of row 0, and columns 3 and 4 can be used as known reference columns; when n is 32 bytes, SK.prf occupies columns 0 to 3 of row 0, and column 4 can be used as a known reference column. The number of target bytes and the length of R are adjusted to n respectively; when each target byte retains two candidates, the number of candidate private key components are 2 to the power of 24 and 2 to the power of 32 respectively, which can be achieved by parallel computing or fixed batch traversal. When computing resources are limited, the number of candidates for some bytes can be reduced by using the leakage polarity predetermined by the reference columns or another independent intermediate quantity, but the candidate set cannot be adjusted in reverse by using the target SK.prf or R matching results. The 128-bit parameter set defined in claims 2 to 10 has three columns, 24 known reference bytes, and only requires traversing 65536 candidate private key components.

[0098] For implementations that do not calculate column parity values ​​in byte order, the linear execution interval assumption can be omitted. Instead, a reference peak template can be constructed using 24 reference correlation curves. The template is then mapped to each trajectory through dynamic time warping or local cross-correlation, and the target peak is searched at the mapped relative position. Regardless of whether linear fitting or template mapping is used, the target window is determined by known intermediate values ​​in the same batch of trajectories.

[0099] When implementing this attack method in authorized security assessments or product comparisons, simultaneously set up a no-leakage control, a message tag randomization control, and a repeated data collection control. If peak values ​​similar to unscrambled data still appear after tag scrambling, spurious peaks caused by periodic interference, triggered crosstalk, or multiple comparisons should be checked. Only when the reference peak, candidate interval, unique and consistent result of randomized string R, and repeatability all meet the preset conditions can the attack be considered verified.

[0100] This embodiment focuses on the self-calibration of known reference columns, independent modeling of target columns, complete combination of candidate private key components, and screening of the randomized signature string R. The sampling medium, trajectory preprocessing method, relevant score form, and calculation platform can be adjusted according to the implementation of the target cryptographic device, but the target SK.prf does not participate in reference modeling, relevant calculations, candidate sorting, threshold determination, and candidate combination screening.

Claims

1. A side-channel correlation energy analysis attack method targeting the SLH-DSA algorithm, characterized in that, include: Obtain the public key seed PK.seed of the target cryptographic device, enable the target cryptographic device storing the private key component SK.prf to be recovered to perform SLH-DSA-SHAKE signature for multiple different known messages in deterministic signature mode, and collect the physical leakage trajectory of the first round Theta step of Keccak-f[1600] after the first absorption when the message random number generation function PRFmsg calls SHAKE256 to cover the first absorption; Based on the known data in the initial absorption state, the column parity byte of the reference column excluding SK.prf is calculated, a reference leakage prediction vector is established, and the analysis window of the target column where SK.prf is located is determined according to the correlation between the reference leakage prediction vector and the physical leakage trajectory. For each target byte in SK.prf, the known status bytes other than the target byte in the corresponding target column are combined into a known byte. The candidate values ​​of the target byte are XORed with the known byte respectively. A candidate leakage prediction vector is established based on the obtained intermediate candidate bytes. Correlation analysis is performed within the analysis window. The candidate set of each target byte is obtained by filtering based on the correlation scores. The candidate values ​​in each candidate set are combined according to the byte index to obtain multiple candidate private key components. The randomized string R is recalculated using each candidate private key component, the public key seed, and the verification message. The recalculated randomized string R is compared with the randomized string R in the signature output by the target cryptographic device for the verification message. The candidate private key component corresponding to the consistent result is determined as the recovered private key component.

2. The side-channel correlation energy analysis attack method for the SLH-DSA algorithm according to claim 1, characterized in that, The security parameter n of the SLH-DSA-SHAKE signature is 16 bytes; the initial absorption state consists of 25 64-bit state units lanes arranged in 5 columns and 5 rows, with the column index and row index denoted as x and y respectively, and the state unit denoted as A[x,y]; bytes 0 to 7 of SK.prf are located in A[0,0], bytes 8 to 15 are located in A[1,0], columns 0 and 1 are the target columns, and columns 2, 3, and 4 are the reference columns; the column parity byte of the reference column includes 24 known reference bytes of columns 2, 3, and 4 at byte offsets of 0 to 7 within the lane, and the column parity byte of the target column includes 16 target bytes of columns 0 and 1 at byte offsets of 0 to 7 within the lane.

3. The side-channel correlation energy analysis attack method for the SLH-DSA algorithm according to claim 2, characterized in that, The determination of the analysis window includes: determining the reference leakage prediction vector and the correlation peak positions of each sampling point of the physical leakage trajectory for each of the 24 known reference bytes; performing robust regression on the execution sequence number and correlation peak position of the known reference bytes according to the execution order of the parity check bytes of the target cryptographic device to obtain the mapping relationship between the execution sequence number and the sampling position; extrapolating the center sampling position and analysis window of the 16 target bytes based on the mapping relationship, determining the sampling weight based on the local waveform of the reference correlation peak, and determining the leakage polarity based on the sign statistics of the reference correlation peak.

4. The side-channel correlation energy analysis attack method for the SLH-DSA algorithm according to claim 1, characterized in that, Before performing relevant analysis, the physical leakage trajectory is subjected to abnormal trajectory removal, DC component removal and time alignment; the abnormal trajectory removal adopts the median absolute deviation threshold based on trajectory energy or peak value, and the time alignment includes coarse alignment based on trigger signal and fine alignment based on cross-correlation of reference execution interval; for reference leakage prediction vector, candidate leakage prediction vector or sampling column with zero variance, the corresponding correlation coefficient is not calculated.

5. The side-channel correlation energy analysis attack method for the SLH-DSA algorithm according to claim 4, characterized in that, The physical leakage trajectory is the voltage trajectory across the shunt resistor or the electromagnetic trajectory near the target cryptographic device. When collecting the voltage trajectory, a shunt resistor with a resistance of 0.1 ohms to 10 ohms is connected in series in the power supply branch of the target cryptographic device. The voltage across the shunt resistor is collected through a differential amplifier. The analog-to-digital sampling rate is not less than 4 times the clock frequency used by the target cryptographic device to execute the Theta step. The acquisition window is based on the PRFmsg entry trigger signal.

6. The side-channel correlation energy analysis attack method for the SLH-DSA algorithm according to claim 3, characterized in that, The correlation score is the maximum absolute value of the correlation coefficient within the analysis window, or the sum of the products of the absolute values ​​of the correlation coefficient within the analysis window and the sampling weights. For each target byte, the candidate value with the largest correlation score and its bitwise complementary value are determined as a candidate pair. The difference between the correlation score of the candidate pair and the highest correlation score after excluding the candidate pair is determined as the candidate interval. The candidate pair is then used as the candidate set for the corresponding target byte.

7. The side-channel correlation energy analysis attack method for the SLH-DSA algorithm according to claim 6, characterized in that, When the candidate intervals of each target byte reach the preset interval threshold and the correlation peak of the reference column reaches the preset reference threshold, the candidate set is verified; when the candidate interval of any target byte does not reach the preset interval threshold or the correlation peak of the reference column does not reach the preset reference threshold, the number of physical leakage trajectories is increased, time alignment is re-performed or the acquisition bandwidth is adjusted, and the analysis window and correlation score are recalculated.

8. The side-channel correlation energy analysis attack method for the SLH-DSA algorithm according to claim 7, characterized in that, When verifying the candidate set, a candidate value is selected from each candidate pair according to byte index 0 to 15 and concatenated sequentially, so that the Cartesian product of the 16 candidate pairs forms 65536 candidate private key components; a combination index from 0 to 65535 is assigned to each candidate private key component according to the position of the selected candidate value in the candidate pair, and each candidate private key component is verified in the order of the combination index or in parallel.

9. The side-channel correlation energy analysis attack method for the SLH-DSA algorithm according to claim 8, characterized in that, The verification message is different from the known message used for correlation analysis and does not participate in candidate leakage prediction and correlation score calculation; the optional randomized input opt_rand in the deterministic signature mode is PK.seed, and the randomized string R in the signature is the first 16 bytes obtained by performing a SHAKE256 operation on the concatenation result of the verification message string of SK.prf, PK.seed and the encoded actual input PRFmsg in the target cryptographic device; the same operation is performed by replacing SK.prf with each candidate private key component to obtain the corresponding recalculated randomized string R; when only one candidate private key component has a recalculated randomized string R that is identical byte-by-byte to the 16 bytes at the beginning of the signature, the candidate private key component is determined as the recovered private key component; when there is no consistent result, the process returns to the physical leakage trajectory collection or candidate screening stage; when there are multiple consistent results, the verification message is replaced and the candidate private key component that is consistent under different verification messages is retained until a unique consistent result is obtained.

10. The side-channel correlation energy analysis attack method for the SLH-DSA algorithm according to claim 9, characterized in that, At least three rounds of attack are carried out on the same target cryptographic device. In each round, the known message and verification message used for correlation analysis are changed, while keeping SK.prf and PK.seed in the target cryptographic device unchanged. The recovered private key component is determined as the final attack result only when at least two rounds of attack have obtained a unique and consistent candidate private key component and the obtained recovered private key components are the same. The reference peak position deviation, candidate interval, number of candidate private key components, combination index of unique and consistent results and comparison result of randomized string R of each round of attack are recorded.

Images