Quasi-differential search method and system based on matsui search method
Patent Information
- Application Number
- CN202610688356.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-05-19
- Publication Date
- 2026-10-23
AI Technical Summary
[0006]（1）每分析一个新的密码算法，都需要密码专家从头进行复杂的数学建模和约束编码工作
[0029]相较于现有技术，本发明具有以下有益效果：
Smart Images
Figure FT_1 
Figure FT_2 
Figure FT_3
Abstract
Description
Technical Field
[0001] This invention belongs to the field of cryptography technology, specifically relating to a general automated quasi-differential analysis method and system for SPN (Substitution-Permutation Network) block ciphers, which can be used for security evaluation of cryptographic algorithms, weak key detection, and differential characteristic analysis. Background Technology
[0002] Differential cryptanalysis is one of the most threatening attack methods against block ciphers. Traditional differential cryptanalysis typically assumes that the differential features in each round are independent (Markov assumption) and that the fixed key probability is consistent with the average probability (random equivalence assumption). However, numerous studies have shown that these assumptions do not hold true for most practical cryptography. For example, the differential feature probabilities of algorithms such as DES, SKINNY, and GIFT change significantly with the key value, and some published features are even ineffective for any key.
[0003] To overcome the limitations of the above assumptions, Beyne and Rijmen proposed a quasi-differential analysis framework in 2022. This framework, by introducing quasi-differential transition matrices and quasi-differential trajectories, can accurately calculate the probabilities of differential features under a fixed-key model, providing a solid theoretical foundation for cryptographic security assessment.
[0004] However, when applying this theoretical framework to the analysis of specific cryptographic algorithms, existing techniques have the following significant shortcomings:
[0005] Existing automated analysis methods suffer from poor versatility and high engineering implementation barriers. Currently, automated implementations of quasi-difference analysis primarily rely on constructing mixed-integer linear programming (MILP), satisfiability theory (SAT), or satisfiability modular theory (SMT) models for specific algorithms. The core limitation of these methods lies in:
[0006] (1) Each time a new cryptographic algorithm is analyzed, cryptographic experts need to perform complex mathematical modeling and constraint coding from scratch. This "one algorithm, one model" approach makes it difficult for quasi-differential analysis to become a widely applicable and standardized evaluation tool;
[0007] (2) In the analysis of block cipher algorithms, a differential path will have a large number of quasi-differential trajectories. It is difficult to find an exact lower bound of the correlation of quasi-differential trajectories. Therefore, we often pay more attention to quasi-differential trajectories with greater correlation, that is, quasi-differential trajectories that can cause significant impact and their correlation. The conventional approach is to first search a large number of quasi-differential trajectories and then filter the quasi-differential trajectories worth paying attention to based on their correlation. This makes the time complexity of searching for quasi-differential trajectories within the target correlation interval extremely high. Summary of the Invention
[0008] The purpose of this invention is to provide a more lightweight and general quasi-differential analysis method for SPN structure block cipher algorithms, thereby reducing the engineering difficulty of quasi-differential testing of this type of block cipher algorithm. Furthermore, this invention introduces the idea of dynamic pruning using the Matsui search method, which reduces the complexity of the analysis while ensuring the reliability of the conclusions.
[0009] To achieve the above objectives, the technical solution of this invention is: a quasi-differential search method and system based on the Matsui search method, providing an S-box lookup table, a linear layer permutation table, a preset lower bound for the absolute value of correlation, and the S-box input-output difference for each round of the SPN block cipher algorithm, implemented according to the following steps:
[0010] Step S1: Construct the quasi-differential transition matrix. For the S-box used in the cryptographic algorithm, the cryptanalysis unit calculates its quasi-differential transition matrix (QDT). For the function F, let a be the input difference, b be the output difference, u be the input mask, and v be the output mask. The elements of the quasi-differential transition matrix are defined as follows:
[0011]
[0012] Step S2: Receive differential paths. The cryptanalysis unit receives a sequence of multiple rounds of differential pairs specified by the user. Each round includes an input differential array input_diff and an output differential array output_diff. The differential paths are provided by the user based on the differential characteristics of a custom SPN structure algorithm.
[0013] Step S3: First round of mask generation. For the first round, the mask search module starts from the input difference and output difference, traverses all possible input masks u and output masks v for each S-box position, and selects mask pairs (u, v) that satisfy the non-zero quasi-difference transition matrix; combines all candidate mask pairs of S-boxes by Cartesian product to obtain all possible input mask states for the first round; and then passes through the linear layer transformation of the linear layer processing module to obtain the actual input mask for the second round.
[0014] Step S4: Intermediate round mask propagation. For each subsequent round, the mask search module uses the multiple mask states output in the previous round as the input mask for the current round. For each input mask state, it iterates through all possible output masks v for each S-box position and selects the output mask v that satisfies the non-zero quasi-differential transition matrix. It calculates the cumulative absolute value of correlation for each path, which is the product of the absolute values of correlation of each S-box.
[0015] Step S5: Branch and Bound Pruning. The mask search module uses the branch and bound strategy of the Matsui search method for pruning: using the absolute value of the correlation of the all-zero mask quasi-differential trajectory as a benchmark, a dynamically tightened global upper bound is maintained during the depth-first recursive search process. The cumulative absolute value of the correlation of the current partial path is calculated in real time as a multiple of the benchmark absolute value of correlation. If the absolute value of the correlation of the current path is lower than the benchmark absolute value * the preset lower limit of the absolute value of correlation, the exploration of the current branch is terminated immediately.
[0016] Step S6: Linear layer transformation. For each round of generated output mask combination, the linear layer processing module multiplies the mask state by the linear layer transformation matrix according to the linear layer structure of the cryptographic algorithm, so as to realize the reverse propagation of the mask from the current round output to the next round input.
[0017] Step S7: Final round of mask processing. For the final round, the mask search module traverses all possible output masks v, prioritizing the selection of masks where v=0 and the quasi-differential transition matrix is non-zero. If there is no zero mask, all output masks v with non-zero quasi-differential transition matrices are selected. The output mask of the final round does not undergo linear layer transformation and the result is directly output.
[0018] Step S8: Result classification and output. The cryptanalysis unit collects the absolute values of the probability correlation of all complete quasi-differential trajectories, using the absolute value of the first-round baseline correlation as a reference. Let the absolute value of the first-round baseline correlation be W. base For each quasi-difference trajectory finally found, calculate its correlation absolute value ratio r = W / W base The trajectories are classified into 1-fold and 2-fold classes based on their r-values. -1 Multiples, 2 -2 Multiples and 2 -3 Output the number of masks for each category and the corresponding quasi-differential trajectory.
[0019] To test quasi-differential analysis of new algorithms not included in the system's default implementation, this invention also provides a quasi-differential analysis system for SPN structured block ciphers based on the Matsui search method. The system is used to implement the above method and is characterized by including the following modules:
[0020] Module M0: Algorithm configuration interface module, used to receive user-input S-box permutation table, linear layer permutation table and algorithm parameters for a custom SPN structure algorithm.
[0021] Module M1: Test class auto-generation module, used to automatically generate test class files for the algorithm based on the configuration information input by the user, and dynamically load them into the analysis framework.
[0022] Module M2: Quasi-differential transition matrix generation module, used to calculate the quasi-differential transition matrix based on the S-box permutation table.
[0023] Module M3: Differential path input module, used to receive user-specified multi-round difference pair sequences.
[0024] Module M4: Mask search module, used to implement the branch-bound recursive search of the Matsui search method, including the first round mask generation submodule, the intermediate round mask propagation submodule and the last round mask processing submodule.
[0025] Module M5: Linear layer processing module, used to perform mask state transformations based on the linear layer permutation table.
[0026] Module M6: Combination generation module, used to combine candidate masks of multiple S-boxes using Cartesian product.
[0027] Module M7: Pruning Decision Module, used to decide whether to discard a branch based on a comparison of the cumulative absolute value of correlation with a preset threshold.
[0028] Module M8: Result Classification Output Module, used to classify and output the final quasi-differential trajectories according to the absolute value ratio of their correlation. Beneficial effects
[0029] Compared with the prior art, the present invention has the following beneficial effects:
[0030] First, portability. This invention does not require building complex MILP / SAT / SMT models for each cryptographic algorithm. It only needs to implement a simple interface (S-box quasi-differential transition matrix acquisition, linear layer transformation) to complete the automated search of quasi-differential trajectories, which significantly reduces the application threshold and engineering implementation difficulty of quasi-differential analysis.
[0031] Second, the results are generally reliable. For the shorter differential paths (typically 4-6 rounds) of SPN block ciphers, this invention, based on the completeness of the quasi-differential framework, can obtain generally reliable search results, providing cryptographers with a fast and effective security assessment reference.
[0032] Third, it has strong versatility. This invention adopts the branch-and-bound framework of the Matsui search method, which does not depend on the internal structural details of a specific cryptographic algorithm. It can be applied to any SPN block cipher without the need to redesign the search strategy for different algorithms.
[0033] Fourth, it supports custom algorithms. This invention provides an algorithm configuration interface. Users only need to input the S-box permutation table and the linear layer permutation table, and the system can automatically generate test class files and complete quasi-difference analysis without manually writing code. This greatly expands the applicability of this invention and lowers the threshold for security analysis of new algorithms. Attached Figure Description
[0034] Figure 1 This is an overall flowchart of the method of the present invention.
[0035] Figure 2 This is a schematic diagram of the branch delimitation and pruning strategy in this invention.
[0036] Figure 3 This is a module architecture diagram of the system of the present invention.
[0037] Figure 4 Automatically generate module workflow diagrams for test classes.
[0038] Figure 5 This is a schematic diagram of the system operation interface according to an embodiment of the present invention. Detailed Implementation
[0039] The technical solution of the present invention will now be described in detail with reference to the accompanying drawings.
[0040] This invention provides a quasi-differential search method and system based on the Matsui search method. The core of this invention lies in combining the branch-and-bound strategy of the Matsui search method with Beyne's quasi-differential analysis to achieve automated and efficient searching of quasi-differential trajectories in SPN structure block ciphers.
[0041] 1. A Quasi-Differential Analysis Method for SPN Structured Block Ciphers Based on Matsui Search
[0042] like Figure 1 The above is an overall flowchart of the present invention, and the specific steps are as follows:
[0043] (1) Construct the quasi-difference transition matrix
[0044] The quasi-differential transition matrix generation module adopts the quasi-differential transition matrix generation method used by Beyen and Neyt in the quasi-differential analysis of the lightweight block cipher SPEEDY. It uses the transformation matrix method to calculate the quasi-differential transition matrix (QDT) of the S-box. For details, please refer to the paper Tim Beyne, Addie Neyt. Improved differential crypt analysis of SPEEDY. Cryptology ePrint Archive, Paper 2025 / 915, 2025. The specific implementation is as follows:
[0045] 1) For a single n-bit S-box function f, construct its transition matrix M. M is a... A binary matrix M[f(x)][x] = 1, with all other positions set to 0. This matrix records the deterministic input-output mapping relationship of the S-box.
[0046] 2) For an SPN structure containing nc parallel S-boxes in each round, the transition matrix of a single S-box is expanded into a joint transition matrix using the Kronecker product:
[0047] The dimension is This records the joint transition relationships for all S-boxes operating in parallel. Subsequently, [the following is done / then...] Perform an interleaving transformation to adjust the order of matrix rows and columns to accurately reflect the distribution of S-boxes in the states.
[0048] 3) Employing a quasi-difference transformation matrix right Perform similarity transformation:
[0049]
[0050] This transformation transforms the transition matrix to the quasi-difference domain. The transformed matrix... In this algorithm, the element's position index corresponds to a combination of (output difference b, output mask v) and (input difference a, input mask u). This transformation is efficiently implemented using a recursive algorithm similar to FFT, avoiding direct computation. The overhead of traversing each element.
[0051] 4) Deinterleave the transformed matrix according to the number of S-boxes to obtain the quasi-difference transition matrix QDT. QDT is a... A matrix whose elements This represents the absolute value of the joint probability correlation between the output difference b and the output mask v, given the input difference a and the input mask u, satisfying:
[0052]
[0053] (2) Receive differential path
[0054] The differential path input module receives a user-specified sequence of multiple rounds of difference pairs, each round containing an input difference array `input_diff` and an output difference array `output_diff`. The length of the difference array is equal to the number of S-boxes in each round. In a preferred embodiment of the invention, quasi-difference analysis is performed for shorter difference paths (4-6 rounds).
[0055] (3) First round of mask generation
[0056] For the first round, since the input mask is all zeros, the output mask for the first round is as follows:
[0057] 1) For each S-box position, let its input difference value be a and its output difference value be b. Iterate through all possible output masks v for inputs that are all zeros. ), and check the corresponding elements in the quasi-difference transition matrix one by one. Is it zero? If not zero, record the mask pair (0, v) and its absolute value of correlation. .
[0058] 2) Input the list of candidate mask pairs for all S-boxes into the combination generation module, perform Cartesian product combinations, and obtain all possible mask state combinations for the first round. Let the i-th S-box have... If there are candidate mask pairs, then the total number of combinations is .
[0059] 3) Combine each mask state and pass it through a linear layer transformation to obtain the actual input mask for the second round. See (6) for the specific implementation of the linear layer transformation.
[0060] (4) Intermediate wheel mask propagation
[0061] For rounds 2 through R-1, perform the following operations:
[0062] 1) Use the mask list output from the previous round as the input mask for the current round. Let the length of the previous round's output mask list be L.
[0063] 2) For each input mask state (an array of length S boxes), for each S box position, let its input difference value be a, its output difference value be b, and its input mask value be u. Iterate through all possible output masks v. Check each element in the quasi-difference transition matrix one by one. Is it zero? If not zero, record the output mask v and its absolute value. .
[0064] 3) Calculate the cumulative absolute value of the correlation of the current path, which is the product of the absolute values of the correlation of each S-box. For a partial path that passes through t S-boxes, its cumulative absolute value is... .
[0065] (5) Branch demarcation and pruning
[0066] like Figure 2 As shown, the Matsui search method's branch-and-bound strategy is used for pruning. The core idea of this strategy is to maintain a dynamically tightening global upper bound during the depth-first recursive search process. It calculates in real time the sum of the cumulative absolute value of the correlation of the current partial path and the minimum possible absolute value of the correlation of the remaining rounds. If the sum is greater than or equal to the best solution found, the exploration of the current branch is terminated immediately.
[0067] The specific implementation method is as follows:
[0068] 1) Let the absolute value of the cumulative correlation generated by the first input mask in the first round be _____. Preset threshold User-selected, this usually requires consideration of actual experimental conditions, such as memory. Let the absolute value of the best cumulative relevance found so far be... (Initial value) (the reciprocal of or other sufficiently large value).
[0069] 2) During the recursive search process, suppose that the first i S-boxes (or the first i rounds) have been processed, and the current cumulative correlation absolute value is... Calculate in advance the lower bound of the minimum absolute value of correlation that the remaining unprocessed portion (remaining S-boxes or remaining rounds) may reach. This lower bound can be obtained through pre-computation: for each possible combination of input difference, output difference, and input mask, record the absolute value of its minimum non-zero output mask correlation, take the minimum value at all positions as the lower bound for that round, and multiply the values for multiple rounds.
[0070] 3) If If the current branch is not found, prune it and terminate the search. Otherwise, continue the search.
[0071] (6) Linear layer transformation
[0072] For each round of generated output mask combinations, the linear layer processing module performs mask state transformations according to the linear layer structure of the cryptographic algorithm.
[0073] For a linear layer that uses bit permutation, the linear layer transformation function moves each bit in the mask state vector to a new position according to the permutation table. Let the current round's output mask state be... (A bit vector of length equal to the number of state bits), the linear layer permutation table P has a length equal to the number of state bits, P[i] represents the position after the permutation at position i, then the input mask for the next round. satisfy: .
[0074] (7) Determination of effective quasi-difference trajectory
[0075] The definition of quasi-differential trajectory requires that both the initial input and final output of the mask be all zeros. Therefore, for the Rth round (the last round), the mask search module performs the following operation:
[0076] 1) For each S-box position, let its input difference value be a, its output difference value be b, and its input mask value be u. Iterate through all possible output masks v (0 ≤ v < 2). n ).
[0077] 2) Check v=0 and the elements of the quasi-difference transition matrix If the value is non-zero, record the mask v=0 and its absolute correlation value. If there is no zero mask that meets the condition, return "No valid quasi-differential trajectory".
[0078] 3) The output mask in the last round is not transformed by a linear layer and is directly output as the final result. This is because there is no need to propagate the mask to the next round after the last round.
[0079] (8) Result classification output
[0080] The cryptanalysis unit collects the absolute values of the probability correlations of all complete quasi-differential trajectories. Let the absolute value of the baseline correlation for each round be W. base (i.e., the product of the absolute values of the correlations of the first mask pair combination in step S3), for each quasi-differential trajectory finally searched, calculate its absolute correlation ratio r = W / W base The trajectories are categorized by their r-values, and the number of masks for each category and the corresponding quasi-differential trajectory details are output.
[0081] 2. Specific Implementation Methods of System Modules
[0082] This invention also enables quasi-differential testing of various lightweight block ciphers such as PRESENT, and supports user testing of lightweight block ciphers with custom SPN structures. The quasi-differential analysis system provided by this invention will be described below in conjunction with the system architecture.
[0083] (1) Algorithm configuration interface module
[0084] This module provides a graphical or command-line interactive interface, through which users can input configuration information for custom SPN structure algorithms, including:
[0085] 1) S-box permutation table: length 2 n An array, where n is the number of bits in the S-box;
[0086] 2) Linear layer permutation table: An array of length equal to the number of state bits, describing the bit permutation rules;
[0087] 3) Number of S-boxes: The number of S-boxes in each round;
[0088] 4) Number of rounds:
[0089] 5) The total number of rounds of the cryptographic algorithm to be analyzed.
[0090] After receiving the configuration information input by the user, the system first calls the parameter validation module to automatically verify the validity of the input parameters, ensuring that the subsequent analysis process will not be interrupted due to incorrect parameters. The validation rules include:
[0091] 1) S-box length verification: The length of the S-box permutation table must be equal to 2. n , where n is the number of bits in the S-box. For example, for a 4-bit S-box, the permutation table length should be 16.
[0092] 2) S-box range check: The value of each element in the S-box permutation table must be within the range [0, 2]. n Within the range of -1, ensure that all output values are valid n-bit values.
[0093] 3) Linear layer permutation table length verification: The length of the permutation table must be equal to the block length (number of state bits).
[0094] 4) Linear layer permutation table value range verification: Each position index in the permutation table must be within the range of [0, group length - 1].
[0095] 5) Divisibility check: The group length must be divisible by the number of S-boxes to ensure that the state can be completely divided into an integer number of S-boxes.
[0096] The above verification can detect and prompt user input errors in a timely manner before the analysis process starts, avoiding subsequent calculation abnormalities or incorrect conclusions due to invalid parameters.
[0097] (2) Test class automatic generation module
[0098] This module automatically generates test class files that inherit from the base class of the cryptanalysis framework based on the configuration information input by module M0. The process is shown in the attached figure. Figure 4 As shown. After parameter validation passes, the test class auto-generation module automatically generates test class files that inherit from the base class of the cryptanalysis framework, based on the configuration information provided by the user. The generation process includes the following automatic calculation and code injection steps:
[0099] 1) Automatic calculation of S-box number: The system automatically calculates the number of parallel S-boxes per round based on the group length and the number of S-box bits. Users do not need to manually specify this parameter. The system can adaptively adapt to SPN structure algorithms with different group sizes (e.g., 32-bit, 64-bit) and different S-box bits (e.g., 3-bit, 4-bit).
[0100] 2) Permutation Table Code Formatting: The system automatically formats the user-provided S-box permutation table and linear layer permutation table into Python list literals. For lists longer than 16, the system automatically formats them with 16 elements per line to ensure the readability of the generated code.
[0101] 3) Automatic Injection of Core Methods: The system generates the main code framework of the test class. First, it automatically injects the necessary import statements, including references to the base class CipherTestFramework of the cryptanalysis framework and the quasi_differential_transition_matrix function for calculating the quasi-differential transition matrix. Then, it generates the class definition header, declaring the class name and parent class inheritance relationships, and injects the formatted S-box permutation table and linear layer permutation table as static attributes of the class.
[0102] 4) The system automatically generates the class initialization method. In this method, the code logic of calling the parent class initialization, calculating the quasi-difference transition matrix QDT and storing it as an instance attribute, and saving the number of S-boxes as an instance attribute is automatically written.
[0103] 5) The system automatically generates the implementation code for three core interface methods. These three core interface methods include:
[0104] get_qdt(position): Returns the quasi-difference transition matrix at the specified S-box position;
[0105] linear_layer(state, round_num): Performs a linear transformation on the input state according to the linear layer permutation table;
[0106] get_sbox_count(): Returns the number of S boxes.
[0107] 6) The system automatically generates auxiliary function code to add convenient testing methods to the generated files, including: the print_algorithm_info() method for printing algorithm parameter information, the find_high_probability_differentials() method for finding high-probability differential features using the quasi-differential transition matrix, and the run_single_round_test() method for performing a single round of quasi-differential testing.
[0108] 7) The system automatically generates the module's autonomous running entry code, enabling the generated test class files to automatically create test instances, print algorithm information, find and display high-probability differential features, and complete exemplary test runs when executed directly.
[0109] 8) The system will write the generated complete code string to a file. The file name rule is {algorithm name lowercase}_test.py, and it will be saved to the specified output directory. If the output directory does not exist, the system will automatically create it.
[0110] Through the automated generation process described above, users only need to provide the S-box permutation table and the linear layer permutation table. Without needing expertise in cryptography or mathematical modeling, or manually writing any code, they can obtain a complete and runnable algorithm test class file within minutes.
[0111] (3) Quasi-difference transition matrix generation module.
[0112] This module calculates the quasi-difference transition matrix using the transformation matrix method based on the S-box definition generated by module M1. The specific implementation process is as follows:
[0113] 1) Construct the transition matrix M of a single S-box, where M is... A binary matrix, M[f(x)][x] = 1.
[0114] 2) Extend M into a joint transition matrix using the Kronecker product.
[0115]
[0116] And on Perform an interleaving transformation.
[0117] 3) Similarity transformation is performed using the quasi-differential transformation matrix T_quasi_differential:
[0118]
[0119] 4) De-interleave the transformation results to obtain the quasi-differential transfer matrix QDT.
[0120] (4) Differential path input module
[0121] This module receives a user-specified sequence of multiple rounds of difference pairs. Each round contains an input difference array and an output difference array. The difference array is a list of integers, the length of which is equal to the number of S-boxes in each round. Each element is the corresponding S-box input difference or output difference value.
[0122] (5) Mask search module
[0123] This module implements the branch-bound recursive search of the Matsui search method and is the core module of the system, containing three sub-modules:
[0124] 1) First-round mask generation submodule: Implements the function of step S3, directly generating mask pairs from the difference.
[0125] 2) Intermediate Round Mask Propagation Submodule: Implements the functions of steps S4 and S5, generates the current round mask based on the previous round mask and the quasi-differential transition matrix, and performs pruning judgment.
[0126] 3) Last round mask processing submodule: Implements the function of step S7, prioritizes screening zero masks and terminates propagation, and determines whether the output mask is all 0 in order to determine whether there is a feasible quasi-differential trajectory.
[0127] (6) Linear layer processing module
[0128] This module performs a linear transformation on the mask state vector based on the linear layer transformation function generated by module M1. For linear layers of bit permutation type, this module performs bit rearrangement operations; for linear layers of matrix multiplication type, this module performs vector-matrix multiplication operations.
[0129] (7) Combination generation module.
[0130] This module performs a Cartesian product operation on the candidate mask lists returned by multiple S-boxes to generate all possible mask state combinations. Let the number of candidate masks returned by the i-th S-box be... The total number of combinations generated is .
[0131] (8) Pruning Judgment Module
[0132] During the recursive search process, this module determines whether to terminate the current branch by comparing the current cumulative absolute value of relevance with a preset threshold. The specific decision logic is detailed in the branch-bound pruning formula in step S5.
[0133] (9) Result classification output module.
[0134] This module collects the absolute values of the probability correlation of all complete quasi-difference trajectories and classifies them into 1-fold, 2-fold, and 3-fold categories based on the ratio of their absolute correlation values. Multiples, Multiples and The system can classify data into multiples, etc., and output the classification statistics and corresponding quasi-difference trajectory details. 3. Specific Implementation Examples
[0136] (1) Example 1: Quasi-difference analysis of PRESENT algorithm
[0137] The PRESENT algorithm uses 4-bit S-boxes, with 16 parallel S-boxes per round, and the linear layer consists of bit permutations. The experimental environment was an Intel Core i9 processor, 32GB of RAM, implemented in Python 3.9, with an expected pruning threshold of [value missing]. .
[0138] Quasi-differential analysis was performed using a four-round differential path, and the input and output differences for each round are shown in Table 1.
[0139] Table 1. Differential Paths for PRESENT's 4 Rounds
[0140] Round 1 0x0000000000001001 0x0000000000009009 Round 2 0x0000000000090009 0x0000000000040004 Round 3 0x0000001001000000 0x0000009009000000 Round 4 0x0900000000000900 0x0400000000000400
[0141] After the experiment was completed, a total of 792,590 quasi-differential trajectories were tested. Among them, the only quasi-differential trajectory that met the definition of quasi-differential, that is, the quasi-differential trajectory with all-zero mask input and all-zero mask output, was the key-independent quasi-differential trajectory (all four rounds of mask were all zero).
[0142] Test results show that when the differential probability of the all-zero mask is multiplied by 2... -6 Within the probability interval of the all-zero mask differential, there are no all-zero mask outputs other than the all-zero mask itself. This indicates that there is no mask trajectory within this probability interval that can significantly affect the differential operations of the PRESENT algorithm in these four rounds.
[0143] (2) Example 2: Quasi-difference analysis of uLBC algorithm
[0144] The uLCB algorithm uses 4-bit S-boxes, with 32 parallel S-boxes per round, and the linear layer consists of bit permutations. The experimental environment was an Intel Core i9 processor, 32GB of RAM, implemented in Python 3.9, with a pruning expectation threshold set to... .
[0145] Quasi-differential analysis was performed using a four-round differential path, and the input and output differences for each round are shown in Table 1.
[0146] Table 2. 4-round differential paths of uLBC
[0147] Round 1 0x00020000000000000200000000002000 0x00090000000000000900000000009000 Round 2 0x00000000000000000000000900000000 0x00000000000000000000000600000000 Round 3 0x00000000000606006000000000000000 0x0000000000090200c000000000000000 Round 4 0xccc00000000009990000202200000000 0xc6600000000003630000501100000000
[0148] Test results show that the first round generated 512 output masks, the second round yielded 634,888 output masks after filtering, the third round produced 4,284,672 mask combinations, and the fourth round produced 5,708,360 mask combinations, effectively testing 5,708,360 four-round quasi-differential paths. Among these, two quasi-differential paths met the definition of quasi-differential (all-zero mask input and all-zero mask output): one was a four-round quasi-differential path with all-zero masks, and the other had a non-zero intermediate mask. The absolute correlation value of both quasi-differential paths was [value missing]. .
[0149] Test results show that the four-round differential paths given in the original uLBC paper have quasi-differential paths that can significantly affect the probability of differential features.
[0150] (3) Example 3: MyCipher Quasi-Difference Test with Custom Algorithm
[0151] Quasi-differential analysis experiments were conducted using the MyCipher algorithm, a custom SPN block cipher, as the test object. The MyCipher algorithm employs 4-bit S-boxes, with 8 parallel S-boxes per round, and a custom bit permutation for the linear layer. The S-box permutation table is shown in Table 1, and the linear layer permutation table is shown in Table 2, representing the bit permutations of the 32-bit state. The experimental environment consisted of an Intel Core i7 processor, 32GB of RAM, and was implemented using Python 3.9.
[0152] Table 3 S-box permutation table for MyCipher algorithm
[0153] S(x) C 5 6 B 9 0 A D 3 E F 8 4 7 1 2
[0154] Table 4. Linear Layer Permutation Table of MyCipher Algorithm
[0155] P(x) 0 16 1 17 2 18 3 19 4 20 5 21 6 22 7 23 x 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 P(x) 8 24 9 25 10 26 11 27 12 28 13 29 14 30 15 31
[0156] Users input the S-box permutation table and linear layer permutation table through the algorithm configuration interface, and the system automatically generates the MyCipher test class file and loads it into the analysis framework without writing any code.
[0157] Quasi-differential analysis was performed using a four-round differential path. The input and output differences for each round are shown in Table 3. The pruning threshold was set to 2. -6 .
[0158] Test results show that the test class automatically generated by the system successfully completed the quasi-differential analysis. Among the searched quasi-differential trajectories, only one trajectory met the requirements of both all-zero mask input and all-zero mask output (4 rounds of all-zero mask). This result verifies the automated adaptation capability of the present invention to the custom SPN structure algorithm. Users only need to input the S-box permutation table and the linear layer permutation table to complete the entire analysis process.
[0159] The experimental results above demonstrate that this invention can automatically adapt to custom SPN structure algorithms. Specifically, for block ciphers with only bit shift transformations in the linear layer, users only need to input the S-box permutation table and the linear layer permutation table to complete quasi-differential analysis; high-probability quasi-differential trajectories can be clearly identified through correlation absolute value classification.
[0160] Table 5. Differential paths in the four rounds of the MyCipher algorithm.
[0161] Round 1 0x00000001 0x00000005 Round 2 0x00000000 0x00000000 Round 3 0x00000000 0x00000000 Round 4 0x00000000 0x00000000
Claims
1. A quasi-differential analysis method for SPN structured block ciphers based on the Matsui search method, comprising the following steps: Step S1: Construct the quasi-differential transition matrix. For the S-box used in the cryptographic algorithm, calculate its quasi-differential transition matrix QDT. For a function F, let a be the input difference, b be the output difference, u be the input mask, and v be the output mask. The elements of the quasi-difference transition matrix are defined as follows: Step S2: Receive the difference path, receive the multi-round difference pair sequence specified by the user, each round contains an input difference array and an output difference array; Step S3: First round of mask generation. Starting from the input difference and output difference, traverse all possible input masks u and output masks v for each S-box position, filter out mask pairs that satisfy the non-zero quasi-difference transition matrix, combine all candidate mask pairs of S-boxes by Cartesian product to obtain all possible input mask states in the first round, and then obtain the actual input mask in the second round through linear layer transformation. Step S4: Intermediate round mask propagation. For each subsequent round, the multiple mask states output in the previous round are used as the input mask for the current round. All possible output masks v are traversed for each S-box position. Output masks v that satisfy the non-zero quasi-differential transition matrix are selected. The cumulative absolute value of correlation for each path is calculated. Step S5: Branch and bound pruning. The branch and bound strategy of Matsui search method is adopted. The absolute value of the correlation of the all-zero mask quasi-differential trajectory is used as the benchmark. During the depth-first recursive search process, a dynamically tightened global upper bound is maintained. The multiple relationship between the cumulative absolute value of the correlation of the current partial path and the benchmark absolute value of the correlation is calculated in real time. If the absolute value of the correlation of the current path is lower than the product of the benchmark absolute value of the correlation and the preset lower limit of the absolute value of the correlation, the exploration of the current branch is terminated immediately. Step S6: Linear layer transformation. For each round of generated output mask combination, according to the linear layer structure of the cryptographic algorithm, the mask state is multiplied by the linear layer transformation matrix or bit permutation is used to realize the reverse propagation of the mask from the current round output to the next round input. Step S7: Final round of mask processing. For the final round, iterate through all possible output masks v, and prioritize screening masks with v=0 and non-zero quasi-differential transition matrix. If there is no zero mask, then screen all output masks v with non-zero quasi-differential transition matrix. The output mask of the final round does not undergo linear layer transformation and directly outputs the result. Step S8: Result classification output. Collect the absolute values of probability correlation of all complete quasi-differential trajectories. Using the absolute value of correlation of the first round as a reference, calculate the ratio of the absolute value of correlation of each quasi-differential trajectory. Classify the trajectories according to the ratio and output the number of masks for each category and the corresponding quasi-differential trajectory.
2. The method according to claim 1, characterized in that, The construction of the quasi-differential transfer matrix in step S1 is calculated using the transformation matrix method, including: constructing the transfer matrix M of a single S-box; expanding the transfer matrix of a single S-box into a joint transfer matrix through the Kronecker product and performing an interleaving transformation on it; performing a similarity transformation on the joint transfer matrix using a quasi-differential transformation matrix to transform the transfer matrix to the quasi-differential domain; and deinterleaving the transformed matrix according to the number of S-boxes to obtain the quasi-differential transfer matrix QDT.
3. The method according to claim 1, characterized in that, The lower limit of the preset absolute value of relevance mentioned in step S5 is set by the user according to the experimental conditions. This lower limit determines the balance between the aggressiveness of pruning and the completeness of the search.
4. The method according to claim 1, characterized in that, The linear layer transformation described in step S6 involves, for linear layers employing bit permutations, moving each bit in the mask state vector to a new position according to the permutation table; let the current round's output mask state be M. out If the linear layer permutation table is P, then the input mask for the next round is M. in Satisfy: Min[P[i]]=Mout[i].
5. The method according to any one of claims 1 to 4, comprising an automatic parameter verification step: after receiving configuration information input by the user, automatically verifying the legality of the input parameters, wherein the verification rules include S-box length verification, S-box value range verification, linear layer permutation table length verification, linear layer permutation table value range verification, and the divisibility of the group length with the number of S-box bits verification.
6. The method according to any one of claims 1 to 4 further includes a test class automatic generation step: automatically generating a test class file that inherits from the base class of the cryptanalysis framework based on the S-box permutation table, the linear layer permutation table and the algorithm parameters provided by the user; this step includes automatically calculating the number of parallel S-boxes, formatting the permutation table into code literals, automatically injecting the implementation code of the core interface methods, automatically injecting import statements and automatically generating the entry code for the autonomous operation of the module.
7. A quasi-differential analysis system for SPN structured block ciphers based on the Matsui search method, characterized in that... Includes the following modules: Module M0: Algorithm configuration interface module, used to receive user input of the S-box permutation table, linear layer permutation table and algorithm parameters of the custom SPN structure algorithm; Module M1: Test class auto-generation module, used to automatically generate test class files for the algorithm based on the configuration information input by the user, and dynamically load them into the analysis framework; Module M2: Quasi-difference transition matrix generation module, used to calculate the quasi-difference transition matrix based on the S-box permutation table; Module M3: Differential path input module, used to receive user-specified multi-round difference pair sequences; Module M4: Mask search module, used to implement the branch-bound recursive search of the Matsui search method, including the first round mask generation submodule, the intermediate round mask propagation submodule and the last round mask processing submodule; Module M5: Linear layer processing module, used to perform mask state transformation according to the linear layer permutation table; Module M6: Combination generation module, used to combine candidate masks of multiple S-boxes using Cartesian product; Module M7: Pruning Decision Module, used to determine whether to discard a branch based on a comparison of the cumulative absolute value of correlation with a preset threshold; Module M8: Result Classification Output Module, used to classify and output the final quasi-differential trajectories according to the absolute value ratio of their correlation.
8. The system according to claim 7, characterized in that... In module M5, for an SPN structure that uses nibbles as the basic unit of S-box operations and employs bit permutation in the linear layer, the linear layer processing module performs the following operations: expands the input nibble list state into a bit list; performs bit permutation according to the linear layer permutation table; and repacks the permuted bit vector into a nibble list in n bits, where n is the number of S-box bits.
9. The system according to claim 7 or 8, characterized in that, The system also includes a parameter verification module, used to verify the validity of the configuration information entered by the user before the analysis starts. The verification items include whether the S-box length is 2. n , whether the S-box element values are within the valid range, whether the length of the linear layer permutation table is consistent with the group length, and whether the group length is divisible by the number of S-box bits.
10. The system according to claim 7 or 8, characterized in that, The test class file generated by module M1 automatically includes the implementations of the following core interface methods: the get_qdt(position) method, which returns the quasi-differential transition matrix at the specified S-box position; the linear_layer(state, round_num) method, which performs a linear transformation on the input state according to the linear layer permutation table; and the get_sbox_count() method, which returns the number of S-boxes.