A quantum period discriminator automatic search method, system, medium and device

Abstract

The present application relates to the field of encryption technology, and provides a quantum period distinguisher automatic search method, system, medium and equipment, which comprises the following steps: expanding a target round section of a target cipher into a round level calculation graph; declaring a symbol state and an exact difference for each edge in the round level calculation graph, and declaring a common period in the whole model, so that each node capable of generating a period term compares its exact difference with the common period, and adding propagation constraints, input and output constraints, difference distribution table feasibility and path cost constraints, and connection constraints between all period generation nodes and the common period in the whole model, and solving by a solver; restoring candidate routes according to the solving result, and verifying according to the standard replay calculation graph of the target cipher. The invalid candidates caused by the inconsistency between the symbol route and the actual difference can be reduced.

Description

Technical Field

[0001] This invention belongs to the field of encryption technology, and in particular relates to an automatic search method, system, medium and device for quantum period distinguishers. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] With the development of quantum computing technology, the security of symmetric cryptography can no longer be evaluated solely based on the Grover algorithm (a quantum acceleration algorithm for unstructured exhaustive search) for its secondary acceleration of exhaustive search. The Simon algorithm (a quantum algorithm for solving the hidden XOR periodicity problem) can solve the hidden XOR periodicity problem under quantum superposition query conditions. Based on this, existing techniques have proposed quantum distinguishing methods for Feistel structures (a type of iterative block cipher structure) and Even-Mansour structures (a type of block cipher structure composed of public permutations and round key XOR). Subsequent research has applied periodic functions to the analysis of message authentication structures, FX structures (an extended structure of XOR keys before and after block ciphers), and various generalized Feistel structures. These works demonstrate that if a Boolean function with a hidden XOR periodicity can be constructed from cryptographic operations, even if the target cryptography does not have obvious structural weaknesses under the classical model, it may face new analytical results under the quantum query model.

[0004] Early periodic discriminators relied primarily on analysts deriving them round-by-round for specific cryptographic structures. To reduce manual construction, existing techniques established a link between periodic discriminators and truncated differentials, allowing truncated differential paths to be used to find periodic functions. Subsequent research proposed a symbolic automatic search method, encoding whether intermediate branches still possess the structural form required for periodic construction into symbol states, and using constraint solvers to search for periodic discriminators. These methods can handle lightweight block ciphers such as TWINE and LBlock, both block cipher algorithm names, but their search phase primarily tracks truncated differentials and symbol morphology. The exact difference values ​​and the transition probabilities given by the S-box (substitution box) difference distribution table (DDT, a table representing the frequency or probability of the input and output differences) are typically used for supplementary checks after obtaining symbol candidates.

[0005] This step-by-step processing has two problems: First, multiple nonlinear nodes may generate periodic terms in the same candidate, and the symbol state itself cannot determine whether these nodes use the same specific period value; if the nodes are only similar in symbol shape but different in actual precise difference, the resulting routes cannot form a discriminator with a common period. Second, checking the DDT only after the symbol search is completed may reveal that some S-box differential transformations are actually infeasible, or the probability of the selected exact differential path is too low. In this case, a new search is required, and a large amount of solution work in the previous stage cannot be directly used. Summary of the Invention

[0006] To address the technical problems mentioned above, this invention provides an automatic search method, system, medium, and device for quantum period distinguishers. It incorporates symbol states, precise differences, common defined periods, and DDT path costs into the same solution model. Each period generation node is compared with the same defined period, and the difference transformation undergoes a DDT feasibility check during the search phase. Therefore, it can reduce invalid candidates caused by inconsistencies between symbol paths and actual differences.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: The first aspect of the present invention provides an automatic search method for a quantum period distinguisher, comprising: The target cipher is expanded into a wheel-level computation graph; Declare symbolic states and exact differences for each edge in the round-level computation graph, and declare a common defined period in the full model. This allows each node capable of generating periodic terms to compare its exact difference with the common defined period. In the full model, propagation constraints, input and output constraints, feasibility and path cost constraints of the difference distribution table, and connection constraints between all period-generating nodes and the common defined period are added. The solution is then obtained through a solver. Based on the solution results, the candidate routes are reconstructed, and the computation graph is replayed according to the target cipher specifications for verification.

[0008] Furthermore, the operations in the wheel-level computation graph include at least ordinary join, copy operation, XOR operation, and nonlinear wheel function; The propagation constraints include connection, replication, XOR, nonlinear round functions, and inter-round permutation constraints.

[0009] Furthermore, the symbolic state and the precise difference must describe the same node; for a normal zero state, the precise difference is zero; for a pure fixed difference state, the precise difference is non-zero; for a pruned state, the precise difference is set to zero.

[0010] Furthermore, the input and output constraints include: For normal connections, the sign state and precise difference of the input and output remain unchanged; For the copy operation COPY (meaning copy operation), both outputs copy the same input: ;in, This represents the six-bit sign state of the COPY input node. This indicates the six-bit sign state of the first output node of COPY. This indicates the six-bit sign state of the second output node of COPY. This represents the exact difference between the COPY input nodes. This represents the exact difference of the first output node in COPY. This represents the exact difference between the second output node of COPY; For the XOR operation (bitwise XOR), when the output is not pruned, its precise difference satisfies: ;in, This represents the exact difference between the XOR output nodes. This represents the exact difference between the first input nodes of the XOR expression. ⊕ represents the exact difference of the second input node of XOR, and ⊕ represents the bitwise XOR operation.

[0011] Furthermore, the connection constraint between all periodic generation nodes and the commonly defined period is: when the input state of a node belongs to Furthermore, when the exact input difference of a node equals a non-zero specified period, the output is a periodic state, where x is a variable branch. This represents a separable term generated in shift form and having a specified period with respect to the variable x; it is not an ordinary zero-difference term. S represents a fixed difference term generated by the difference between two sets of public constant inputs. gen This represents the set of input states that can generate periodic states.

[0012] Furthermore, the feasibility and path cost constraints of the differential distribution table are as follows: For nonlinear components with a difference distribution table, when the input is a pure fixed difference state, the difference distribution table of the nonlinear component is queried. If the corresponding entry is zero, conversion is prohibited; If the corresponding entry is non-zero, then calculate the local cost. The path cost is obtained by summing the costs of all nonlinear nodes involved in the probability calculation. ;in, As the upper bound of the allowed path cost, DDT represents the difference distribution table, where n is the branch width. This represents the precise difference between the current input nodes of the nonlinear component. w represents the precise difference between the output nodes of the current nonlinear component.v Let v represent the local exponential cost of the current nonlinear node v, p represent the cumulative path cost of all nodes participating in the probability calculation, and log2 represent the logarithm to the base 2.

[0013] Furthermore, after verification, according to Generate a quadruple test, where, For variable branches, and There are two sets of public inputs. This represents all public quantities other than the two sets of public inputs. To establish a common cycle, This represents the output branch mapping numbered j after r rounds of operation on the target cipher, and ⊕ represents the bitwise XOR operation.

[0014] A second aspect of the present invention provides an automatic search system for quantum period distinguishers, comprising: The computation graph generation module is configured to expand the target wheel segment of the target cipher into a wheel-level computation graph. The solver module is configured to: declare symbolic states and exact differences for each edge in the round-level computation graph, declare a common defined period in the full model, compare the exact difference of each node that can generate a periodic term with the common defined period, and add propagation constraints, input and output constraints, feasibility and path cost constraints of the difference distribution table, and connection constraints between all periodic generating nodes and the common defined period to the full model, and solve the problem through the solver. The restoration module is configured to restore the candidate routes based on the solution results and replay the computation graph according to the target cipher specification for verification.

[0015] A third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of an automatic search method for a quantum period distinguisher as described above.

[0016] A fourth aspect of the present invention provides a computer device including a computer-readable storage medium, a processor, and a computer program stored on the computer-readable storage medium and executable on the processor, wherein the processor executes the program to implement the steps of the automatic search method for a quantum period distinguisher as described above.

[0017] Compared with the prior art, the beneficial effects of the present invention are: This invention incorporates symbolic state, precise difference, common defined period, and DDT path cost into the same solution model. Each periodic node is compared with the same defined period, and the difference transformation undergoes DDT feasibility check during the search phase. Therefore, it can reduce invalid candidates caused by inconsistency between symbolic routes and actual differences.

[0018] The solution obtained by this invention includes input difference, variable branch, node-by-node state, exact difference, DDT entry, path cost, and output position. It can be re-examined by an independent program according to cryptographic standards. Compared with outputting only a symbolic route, this result is more convenient for discovering errors in branch numbering, inter-round permutation, difference propagation, and probability accumulation. It is also convenient for reviewing the search results under different parameters. Attached Figure Description

[0019] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0020] Figure 1 This is a flowchart of an automatic search method for a quantum period distinguisher according to Embodiment 1 of the present invention; Figure 2 This is a flowchart of the search and verification process according to Embodiment 1 of the present invention; Figure 3 This is a route diagram of the twelve-round TWINE cycle distinguisher according to Embodiment 1 of the present invention; Figure 4 This is a route diagram of the twelve-round LBlock cycle distinguisher according to Embodiment 1 of the present invention; Figure 5 This is a route diagram of the 25-round ALLPC cycle distinguisher in Embodiment 1 of the present invention; Figure 6 This is a schematic diagram of the structure of a computer device according to Embodiment 4 of the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0022] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0023] Example 1 This embodiment provides an automatic search method for quantum period distinguishers.

[0024] This embodiment provides an automatic search method for quantum period distinguishers. The technical problem to be solved is: in the automatic search process of period distinguishers, how to simultaneously represent the symbol state, exact difference, common period, and DDT path cost in the same round-level model; how to ensure that each node that generates a period term is subject to the same period value constraint; and how to directly restore the solution results to verifiable input differences, output conditions, and verification tasks, thereby reducing candidates that only meet the symbol conditions but cannot actually be true.

[0025] This embodiment provides an automatic search method for quantum periodicity distinguishers. First, the target wheel segment is expanded into a computational graph composed of connections, replication, XOR operations, nonlinear wheel functions, and inter-wheel permutations. Then, a sign state and an exact difference variable are simultaneously set for each edge in the computational graph. Only one non-zero defined period is set in the entire model, and all nonlinear nodes capable of generating periodic terms have their exact input differences compared to this defined period. For nonlinear components with countable difference distribution tables such as S-boxes, the model directly excludes zero entries in the DDT during the search phase and accumulates the exponential cost of the selected exact difference path.

[0026] This embodiment provides an automatic search method for quantum period distinguishers. Instead of first searching for truncated differential paths and then supplementing those paths with precise differences, it combines symbol propagation, precise difference propagation, DDT feasibility, path cost upper bound, input conditions, output conditions, and common period conditions into a single constraint problem. When the solver returns a satisfactory result, the same model assignment already provides the input difference arrangement, variable branches, specified period, node-by-node precise differences, DDT entries, path cost, and period output position. Subsequently, an independent verification program recalculates according to the true round function of the target cipher and constructs a quadruple verification task.

[0027] In this way, candidates that use different cycles for different nodes, are infeasible for S-box transformation, or have path costs exceeding a given threshold can be excluded during the search phase. This reduces the workload of manually constructing and repeatedly testing the cycle distinguisher, and allows the search results to be reviewed in a uniform format.

[0028] This embodiment provides an automatic search method for a quantum period distinguisher, such as... Figure 1 As shown, the specific steps are as follows: In this embodiment, B represents the number of branches in the target cipher, n represents the bit width of each branch, r represents the number of rounds to be analyzed, j represents the output branch number, x represents the variable branch, and s and Δ per Both represent a common defined period, δ i Let X represent the fixed input difference, Δv represent the exact difference at node v, N represent the test budget for the input tuple, q represent the number of test points for each input tuple, and X represent the fixed input difference. t Y represents the input branch state in round t.t This represents the output branch state in round t, where t is the round index, 0x is the hexadecimal prefix; COPY represents the copy operation, XOR represents the exclusive OR operation, R represents the nonlinear round function, S-box represents the substitution box, DDT represents the difference distribution table; g(x) represents the candidate function or candidate function value, S gen This indicates that the input state set is generated periodically. diff Describes the differentially constrained complete model, {0,1} n / {0,s} represents the quotient set obtained by partitioning the binary set generated by the zero vector and the period s, 2 -p This represents the probability estimate of a single precise differential path obtained by converting the cumulative path cost p.

[0029] Step 1: Given a... There are 1 branch, and the width of each branch is 1. The target cipher in bits, and the number of rounds to be analyzed. The algorithm reads the round functions, branch connections, S-boxes, inter-round permutations, and output selection methods, and expands the target round segment, determined by the number of rounds to be analyzed, into a round-level computational graph.

[0030] The operations in the round-level computation graph include at least ordinary connection, copy operation COPY (representing copy operation), XOR operation (representing bitwise XOR operation), and nonlinear round function R (representing the nonlinear round function in a round of the target cipher). Other operations can be added after the corresponding symbol propagation and precise differential propagation rules are given.

[0031] Step 2: For the branch selected from all the above output branches, the number is... The output branches (branch numbers start from 0, and j ranges from 0 to B-1) have two fixed sets of public inputs. , And other public quantities Let the variable branch be denoted as Construct candidate functions: (1); in, Let represent the output branch mapping numbered j after r rounds of operation of the target cipher, ⊕ represents the bitwise XOR operation, r is the target round number, j is the output branch number, x is the variable branch, α0 and α1 are two sets of public inputs, and c is other public variables besides the two sets of public inputs; g(x) represents the candidate function value obtained by bitwise XOR of the two sets of public inputs on the j-th output branch.

[0032] Step 3: Search for a non-zero common defined period , making In a specified-period quadruple test, which has a pass probability that can be distinguished from random permutations of the same size, it is equivalent to checking the XOR relationship of the four cipher outputs: where s represents the non-zero common specified period to be searched.

[0033] (2); Equation (2) gives the verification target of the search results. Instead of directly enumerating the four complete inputs in the search phase, the propagation rules of symbolic state and exact difference on the round-level computation graph are used to find the path that satisfies the relationship.

[0034] Among them, the probability of success of equation (2) is first defined by sampling the variable branch x; in actual verification, the public input tuples are also sampled according to the fixed input difference, and the proportion of the sampled input tuples passing all test points is counted.

[0035] Step 4: Nodes in the round-based computation graph represent the position of a cryptographic branch in a specific round, or the input and output of operations such as COPY, XOR, and R; the node corresponding to the next position after the same cryptographic branch is joined or permuted between rounds. For each node... Set a six-bit sign state variable: (3); in, This indicates that the highest bit of the six-bit code is unavailable; when this bit is 1, the node is no longer used to construct a periodic candidate. This indicates that the node contains separable terms that satisfy a specified period; This represents the variable term after the action of a nonlinear function; This indicates that the nodal expression contains variable terms that have not been acted upon by nonlinear functions. ; and These represent terms containing nonlinear difference terms and fixed difference terms, respectively; after adding the exact difference layer, it can be... Fixed at zero, the corresponding propagation is directly represented by precise difference variables and connection constraints. Each of the above b subscripts is a Boolean flag in symbolic state encoding, used to indicate whether the node expression contains the corresponding structural term; ∈ indicates a membership relation.

[0036] In this embodiment, a six-bit state code is used to encode the basic structure item. Alternatively, an enumerated state, a Boolean variable group, or other encoding methods that do not change the meaning and propagation relationship of each structure item can be used, without being limited by a specific number of bits.

[0037] The main state used in this implementation is: Normal Zero State The code is 000000; fixed differential state. The code is 000001; variable state. The code is 000100; combined state The code is 000101; nonlinear variable state. The code is 001000; combined state The code is 001100; periodic state. The code is 010000; combined periodic state The encoding is 010101; unavailable state? The encoding 1 is reserved in the inherited symbolic model. In the complete model of this implementation, the standard code 100000 is uniformly adopted. It is not a regular zero difference, but rather represents the term's difference from the variable. It has a prescribed cycle.

[0038] Step 5: Except for the symbol state, each node Also set precise difference variables with the same bit width as the nodes. Fixed input difference is denoted as The specified period for use by the entire model is denoted as .

[0039] The three have different meanings: It is the difference between two fixed inputs; This difference is propagated to the node. The specific value at time; It is a variable The non-zero period (commonly defined period), and the model requires: (4); The symbolic state and the precise difference must describe the same node. For a normal zero state, the precise difference is zero; for a purely fixed difference state, the precise difference is non-zero; for a pruned state, this implementation sets the precise difference to zero to close subsequent constraints. This correspondence can be written as: (5); in, The lowest two bits representing the six-bit sign state are the nonlinear fixed difference term flag and the fixed difference term flag. The highest bit of the six-bit symbolic state, i.e., the unavailable state flag, This indicates the flag bit for the nonlinear fixed difference term; in this embodiment, this bit is fixed to 0.

[0040] Step 6: Build the complete model.

[0041] (1) Input and output constraints.

[0042] At the input, at least one branch is required to be a fixed-difference state, and at least one branch carries a variable. and restrict variables It appears only in one input branch. Other branches are either in a normal zero state or set to allowed fixed differences depending on the specific cryptography. This allows the two public input embeddings and their fixed differences to be directly reconstructed from the solution.

[0043] For normal connections, the sign state and precise difference of the inputs and outputs remain unchanged.

[0044] For the copy operation COPY (meaning copy operation), both outputs copy the same input: (6); in, This represents the six-bit sign state of the COPY input node. This indicates the six-bit sign state of the first output node of COPY. This indicates the six-bit sign state of the second output node of COPY. This represents the exact difference between the COPY input nodes. This represents the exact difference of the first output node in COPY. Represents the exact difference of the second output node in COPY. For the XOR operation (bitwise XOR), when the output is not pruned, its precise difference satisfies: (7); in, This represents the exact difference between the XOR output nodes. This represents the exact difference between the first input nodes of the XOR expression. ⊕ represents the exact difference of the second input node of XOR, and ⊕ represents the bitwise XOR operation.

[0045] The sign state is updated according to the combination and cancellation relationships of each basic term under XOR. For example, variable bits are updated by XOR, and periodic bits and nonlinear variable bits are updated according to whether they still contain the corresponding term; if any input is in an unavailable state and cannot be eliminated by the registered rules, the output is set to an unavailable state.

[0046] For a nonlinear round function R, the ordinary zero state is still propagated as the ordinary zero state, the fixed difference state is still denoted as the fixed difference state, and the variable state and... , Equal state propagation Type: If a periodic state already exists, it will continue to maintain the periodic state.

[0047] Specifically, the sign state of the nonlinear round function R is updated according to the following rules: when the input is 0, 0, ...s When δ is reached, the outputs are 0 and 0 respectively. s When the input is x, R(x), or R(x)⊕x, the output is R(x); when the input is x⊕δ or 0, the output is R(x). s When ⊕x⊕δ, the precise input difference is compared with the common specified period according to equations (9) and (10); other inputs and outputs are in an unavailable state. For calls with input δ, the precise output difference is constrained by non-zero entries in the DDT and is not required to be the same as the precise input difference.

[0048] (2) Commonly defined periodic connections.

[0049] The inputs that can generate new periodic states are limited to: (8); in, This represents a separable term generated in shift form and having a specified period with respect to the variable x; it is not an ordinary zero-difference term. S represents a fixed difference term generated by the difference between two sets of public constant inputs. gen This represents the set of input states that can generate periodic states.

[0050] The output is set to a periodic state only when the node's input state belongs to equation (8) and the node's exact input difference equals the common defined period of the entire model; otherwise, the output is set to an unavailable state. (9); (10); in, This represents the sign state of the output nodes of the nonlinear round function R. This indicates an unavailable state with a canonical code of 100000. This represents the logical AND operation, where ∈ indicates a membership relation. ≠ indicates a logical implication relationship, and ≠ indicates not equal to.

[0051] Equations (9) and (10) ensure that all periodic generating nodes in a candidate accept the same... Constraints should be imposed to prevent different actual cycles from being pieced together into a single route simply because they share the same symbolic form.

[0052] (3) Feasibility and path cost of DDT (Difference Distribution Table).

[0053] For nonlinear components such as S-boxes with differential distribution tables, when the input is a purely fixed differential state, the DDT of the nonlinear component is queried; if the corresponding entry is zero, the current nonlinear component is prohibited from transitioning from precise input differential to precise output differential; if the entry is non-zero, the local cost is calculated. (11); The path cost is obtained by summing the costs of all nonlinear nodes involved in the probability calculation: (12); in, This is the upper bound of the allowed path cost. In equations (11) and (12), w v Let p represent the local exponential cost of node v, p represent the cumulative exponential cost of a single exact difference path, τ represent the upper bound of the allowed path cost, and Δ represent the maximum exponential cost. in and Δ out Let represent the precise input difference and precise output difference of the current nonlinear component, respectively, and n represent the branch width. log2 represents the logarithm to the base 2.

[0054] During implementation, the local cost can be converted into an integer or fixed-point number, but the accumulated bit width must be sufficient to accommodate the maximum sum, and candidates exceeding the threshold should not be incorrectly accepted due to bit vector wrapping.

[0055] In this embodiment, for small S-boxes, DDT can be queried directly. For nonlinear components that are inconvenient to tabulate, equivalent differential feasibility constraints or verified pre-calculated probability tables can be used, as long as infeasible transformations can be excluded and the corresponding costs accumulated during the search phase.

[0056] (4) The above constraints, together with the input and output conditions, constitute the complete model: (13); in, The corresponding input state, fixed difference, and unique variable branch constraint in step (1) of this step; The symbol propagation rules correspond to normal join, COPY, XOR, R, and inter-round permutation; The output constraint corresponding to at least one final output branch contains a periodic state. Equations (5) to (7) are used to propagate the symbolic state and the exact difference along the same computational graph; Use equations (11) and (12) to exclude zero entries in the DDT table and limit the cumulative path cost; jointly define periodic connections. Use equations (8) to (10) to connect the precise difference with the common specified period. This represents a complete differential joint constraint model composed of input constraints, propagation constraints, output constraints, differential consistency constraints, DDT feasibility and path cost constraints, and periodic connectivity constraints.

[0057] Step 7: Solve the joint constraints.

[0058] After the model is built, perform an automatic search according to the following process, such as Figure 2 As shown: (1) Set the target number of rounds, the upper bound of the path cost, and the allowed input templates to generate a complete round-level computation graph; (2) Declare a symbolic state and exact difference for each edge, and declare a non-zero specified period for the entire model; (3) In sequence, add the state and exact difference identity constraints of the ordinary connection, the equation (6) of COPY, the equation (7) of XOR, the complete state transition rules of R above, and the node equations corresponding to the inter-round permutation; (4) Add input constraints, output constraints, DDT feasibility and path cost upper bound constraints (i.e. DDT feasibility and path cost constraints). (5) Add connection constraints between all periodic generation nodes and the common defined period; (6) Call the SMT (Satisfiability Modulo Theories) solver or other constraint solvers that can equivalently express the above conditions; (7) If the model is determined by the solver to be unsatisfactory, that is, there is no assignment that simultaneously satisfies all the constraints of equation (13), then the number of rounds, input template or path cost upper bound is adjusted and the search is repeated; if the model is satisfactory, then the candidate route is restored according to the solution results, and the symbolic route, precise difference route, common specified period, DDT entry, path cost and period output position in the same assignment are output. The candidate routes include the target cryptographic identifier, number of rounds, input difference arrangement, variable branches, node-by-node symbol state, node-by-node precise difference, and periodic output position; the verification includes the common defined period, the precise input difference and precise output difference of each activated nonlinear node, the corresponding DDT entries and local costs, the cumulative path cost, and the comparison results between the precise input difference of each periodic generation node and the common defined period.

[0059] (8) An independent verification program that does not depend on the internal state of the solver replays the computation graph according to the target cryptographic specification and re-examines the symbol state, exact difference, DDT entries and periodic connections of each node; Specifically, the independent verification program reads candidate routes and regenerates the round-level computation graph according to the target cryptographic specification; starting from the input node, it sequentially checks the identity relation of ordinary connections and COPY, the XOR equation (7), the symbol state transition of R, the DDT entries and local costs of each activated nonlinear node, the cumulative path cost, and the common period comparison of equations (9) and (10); finally, it checks whether the specified output branch contains a periodic state. If any node is inconsistent, the node and the inconsistency type are recorded.

[0060] (9) If the independent replay verification fails, discard the current candidate and continue to solve other candidates after excluding the current assignment; if the verification passes, generate a quadruple test according to formula (2) and count the pass rate on the target password and random permutation of the same size respectively.

[0061] In this embodiment, the SMT solver is used to express bit vector states, exact differences, DDT, and common periodic constraints, where SMT stands for Satisfiability Modulus Theory. Where the above conditions can be expressed equivalently, SAT (Boolean Satisfiability Problem), MILP (Mixed Integer Linear Programming), CP-SAT (a solution method combining constraint programming and Boolean satisfiability), or other constraint solvers can also be used.

[0062] Step 8: Quadruple verification.

[0063] When performing the quadruple test of equation (2) above, let and This represents the two public input embeddings reconstructed from the solution result, for the oracle. The Each output branch is used to calculate: (14); in, This represents the quadruple test value obtained by bitwise XORing the four output branch values, with the oracle, output branch j, and input tuple fixed. (O) j Let O represent the output mapping of the oracle on the j-th output branch, where O represents the oracle used for verification, and I0(x) and I1(x) represent the first and second complete inputs formed by embedding two sets of public inputs, respectively.

[0064] Let the test budget for the input tuples be N, and the number of test points for each input tuple be q. For each input tuple test, a first set of public inputs is randomly selected. A second set of public inputs is obtained based on the fixed input difference given by the solution result, and other public variables are randomly selected. Subsequently, q representatives are selected from different cosets determined by non-zero periods, where q does not exceed the total number of representatives in all cosets. Here, N is the upper limit of the number of input tuples, and q is the number of representative points selected for each input tuple.

[0065] For each representative, perform four oracle calls according to equation (14) and calculate the test value of the quadruple. If all q test values ​​of the same input tuple are 0, the input tuple passes; if at least one of the N input tuples passes, output the target password; otherwise, output a random permutation. Record N, q, the number of passed tuples, the total number of oracle calls, and the actual passing ratio for the target password and the random permutation of the same size, respectively. Each input tuple undergoes at most 4q oracle calls, and all N input tuples undergo at most 4Nq oracle calls.

[0066] If the branch width is small, it can be obtained from the quotient set. Select all representatives from the given list to complete the full-domain check. Among them, {0,1} n Let {0, s} represent the entire value space of the n-bit variable branch, and let {0, s} represent the binary set generated by the zero vector and the period s. The slash indicates that the quotient set is divided according to this set.

[0067] When the branch width is large, multiple representatives can be selected for sampling inspection.

[0068] The report records the estimation of each exact difference path. The actual pass probability obtained from the quadrupole experiment does not need to be equal to the actual pass probability, because multiple compatible exact difference paths may simultaneously contribute to the same periodic relationship. Where 2 -p This represents the probability estimate of a single precise differential path obtained by converting the cumulative path cost p.

[0069] In this embodiment, for small branches, all input checks can be exhaustively performed (14); for larger branches, random testing with a sample size record can be used. Both methods require the use of input embeddings restored from the same candidate, a specified period, and output branches.

[0070] The automatic search in this embodiment is performed by a classical constraint solver; when the common period has been determined, the quadruplet test of equation (14) can also be completed by calling a classical oracle, without the need for quantum superposition queries on the target cipher. The search object is the hidden XOR periodic relationship of interest in quantum periodic analysis, and the search solver runs on a classical computer.

[0071] like Figure 3 As shown, taking TWINE as an example, the target structure contains sixteen four-bit branches, with each round including eight copy operations, eight nonlinear round functions, and eight XOR operations. The model obtains a common defined period 0x1 in twelve rounds of search, with the period output being the branch numbered 10 in the twelfth round. The cost of a single path is 25, and the actual calculated quadruple validation probability is approximately 2^-23.12. This result extends the existing ten-round periodic discriminator to twelve rounds.

[0072] like Figure 4 As shown, for LBlock, the model obtains a common defined period of 0x6 in twelve rounds of search, with the periodic output being the branch numbered 5 in the twelfth round. The cost of a single path is 24, and the experimentally verified quadruple validation probability is approximately 2. -21.99 For LBlock-S, the same model yields a twelve-round periodic discriminator, with a common period of 0x8. The periodic output is the branch numbered 2 in the twelfth round, the cost of a single path is 24, and the actual calculated quadruple validation probability is approximately 2. -22.97LBlock-S is the name of a variant algorithm of LBlock.

[0073] like Figure 5 As shown, for ALLPC, the model yields a 25-round full-cycle distinguisher, with a common cycle of 0x1. The cycle output is the branch numbered 13 in the 25th round, and the output state is 0. s ⊕x⊕δ, the cost of a single path is 12, and the actual calculated quadruple validation probability is approximately 2. -9.06 The above examples illustrate that, by jointly searching symbol states, exact differentials, and DDT feasibility with path costs, a longer period distinguisher can be obtained than by using only truncated differential symbol search. ALLPC is the name of the target block cipher algorithm.

[0074] Figures 3 to 5 In the diagram, the color of each small rectangle corresponds to a symbol state, and the thick border indicates the periodic output branch of the corresponding instance. δ represents the fixed non-zero difference term generated by the difference between two sets of public constant inputs; x represents the variable branch; x⊕δ represents the combined state obtained by bitwise XORing the variable branch x with the fixed difference term δ; 0 represents the ordinary zero state; 0 s This represents a separable term with a common defined period s for the variable x, and is not a normal zero state; 0 s ⊕δ represents 0 s The combined state obtained by bitwise XORing with the fixed difference term δ; 0 s ⊕x⊕δ represents 0 s The combined periodic state is obtained by bitwise XORing the variable branch x with the fixed difference term δ; ? indicates an unavailable state. 0x represents a hexadecimal prefix; X t and Y t Let represent the input branch state and the output branch state in round t, respectively. Equation (11) calculates the local exponential cost w of node v based on the non-zero entries of the Differential Distribution Table (DDT). v Equation (12) sums up the local exponential costs of each node participating in the probability calculation into the cumulative exponential cost p of a single precise differential path, and uses τ as the upper bound of the allowed path cost.

[0075] In addition to TWINE, LBlock, LBlock-S, and ALLPC, the automatic search method for quantum period distinguishers provided in this embodiment can also be used for other Feistel, generalized Feistel, or hybrid branch structures composed of connections, replications, XOR, nonlinear functions, and branch permutations. When expanding, symbol propagation and precise differential propagation rules for the target operation should be added.

[0076] This embodiment provides an automatic search method for a quantum period distinguisher, which incorporates symbol state, precise difference, common defined period, and DDT path cost into the same solution model. Each period generation node is compared with the same defined period, and the S-box difference transformation undergoes a DDT feasibility check during the search phase. Therefore, it can reduce invalid candidates caused by inconsistencies between the symbol path and the actual difference.

[0077] This embodiment provides an automatic search method for quantum periodicity distinguishers. The solution obtained includes input difference, variable branches, node-by-node states, exact difference, DDT entries, path costs, and output positions, which can be recalculated by an independent program according to cryptographic standards. Compared to outputting only a symbolic path, this result is more conducive to detecting errors in branch numbering, inter-round permutations, difference propagation, and probability accumulation, and also facilitates the verification of search results under different parameters.

[0078] In practical applications, this embodiment provides an automatic search method for quantum period distinguishers, extending the period distinguishers of TWINE, LBlock, and LBlock-S to twelve rounds, and obtaining a twenty-five-round full-round period distinguisher for ALLPC. The verification probability of the ALLPC instance is approximately 2. -9.06 The results are higher than those of existing full-round differencing and boomerang differentiation. These results demonstrate that precise differencing, DDT feasibility, and path cost collectively participate in the constraints during the search phase, which can improve the search capability for long-round candidates.

[0079] This embodiment provides an automatic search method for quantum periodicity distinguishers, and the modeling object is not limited to a specific cryptography. For structures composed of replication, XOR, registerable nonlinear functions, and branching permutations, as long as the corresponding propagation rules and differential feasibility data are given, similar models can be established for periodic structure analysis in a quantum environment, automatic screening in the cryptographic design stage, and verification of existing analysis results.

[0080] Example 2 This embodiment provides an automatic search system for quantum period distinguishers, including: The computation graph generation module is configured to expand the target wheel segment of the target cipher into a wheel-level computation graph. The solver module is configured to: declare symbolic states and exact differences for each edge in the round-level computation graph, declare a common defined period in the full model, compare the exact difference of each node that can generate a periodic term with the common defined period, and add propagation constraints, input and output constraints, feasibility and path cost constraints of the difference distribution table, and connection constraints between all periodic generating nodes and the common defined period to the full model, and solve the problem through the solver. The restoration module is configured to restore the candidate routes based on the solution results and replay the computation graph according to the target cipher specification for verification.

[0081] Each module in this embodiment executes the corresponding steps in Embodiment 1, and the specific implementation process is the same as in Embodiment 1.

[0082] Example 3 This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in the automatic search method for a quantum period distinguisher as described in Embodiment 1 above.

[0083] Example 4 This embodiment provides a computer device, such as... Figure 6 As shown, the system includes a computer-readable storage medium 1003, a processor 1001, a communication interface 1002, and a computer program stored on the computer-readable storage medium 1003 and executable on the processor 1001. The processor 1001, communication interface 1002, and computer-readable storage medium 1003 can be connected via a bus or other means. The communication interface 1002 is used to receive and transmit data. When the processor 1001 executes the program, it implements the steps in the automatic search method for a quantum period distinguisher as described in Embodiment 1 above.

[0084] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An automatic search method for a quantum period distinguisher, characterized in that, include: The target cipher is expanded into a wheel-level computation graph; Declare symbolic states and exact differences for each edge in the round-level computation graph, and declare a common defined period in the full model. This allows each node capable of generating periodic terms to compare its exact difference with the common defined period. In the full model, propagation constraints, input and output constraints, feasibility and path cost constraints of the difference distribution table, and connection constraints between all period-generating nodes and the common defined period are added. The solution is then obtained through a solver. Based on the solution results, the candidate routes are reconstructed, and the computation graph is replayed according to the target cipher specifications for verification.

2. The automatic search method for a quantum period distinguisher as described in claim 1, characterized in that, The operations in the wheel-level computation graph include at least ordinary join, copy operation, XOR operation, and nonlinear wheel function; The propagation constraints include connection, replication, XOR, nonlinear round functions, and inter-round permutation constraints.

3. The automatic search method for a quantum period distinguisher as described in claim 1, characterized in that, The symbolic state and the precise difference must describe the same node; for a normal zero state, the precise difference is zero; for a pure fixed difference state, the precise difference is non-zero; for a pruned state, the precise difference is set to zero.

4. The automatic search method for a quantum period distinguisher as described in claim 1, characterized in that, The input and output constraints include: For normal connections, the sign state and precise difference of the input and output remain unchanged; The copy operation (COPY) copies the same input to both outputs: ;in, This represents the six-bit sign state of the COPY input node. This indicates the six-bit sign state of the first output node of COPY. This indicates the six-bit sign state of the second output node of COPY. This represents the exact difference between the COPY input nodes. This represents the exact difference of the first output node in COPY. This represents the exact difference between the second output node of COPY; For the XOR operation, when the output is not pruned, its exact difference satisfies: ;in, This represents the exact difference between the XOR output nodes. This represents the exact difference between the first input nodes of the XOR expression. ⊕ represents the exact difference of the second input node of XOR, and ⊕ represents the bitwise XOR operation.

5. The automatic search method for a quantum period distinguisher as described in claim 1, characterized in that, The connection constraint between all periodic generation nodes and the commonly defined period is: when the input state of a node belongs to Furthermore, when the exact input difference of a node equals a non-zero specified period, the output is a periodic state, where x is a variable branch. This represents a separable term generated in a shifted form and having a specified period with respect to the variable x. S represents a fixed difference term generated by the difference between two sets of public constant inputs. gen This represents the set of input states that can generate periodic states.

6. The automatic search method for a quantum period distinguisher as described in claim 1, characterized in that, The feasibility and path cost constraints of the differential distribution table are as follows: For nonlinear components with a difference distribution table, when the input is a pure fixed difference state, the difference distribution table of the nonlinear component is queried. If the corresponding entry is zero, conversion is prohibited; If the corresponding entry is non-zero, then calculate the local cost. ; The path cost is obtained by summing the costs of all nonlinear nodes involved in the probability calculation: ;in, As the upper bound of the allowed path cost, DDT represents the difference distribution table, where n is the branch width. This represents the precise difference between the current input nodes of the nonlinear component. w represents the precise difference between the output nodes of the current nonlinear component. v Let v represent the local exponential cost of the current nonlinear node v, p represent the cumulative path cost of all nodes participating in the probability calculation, and log2 represent the logarithm to the base 2.

7. The automatic search method for a quantum period distinguisher as described in claim 1, characterized in that, After verification, according to Generate a quadruple test, where, For variable branches, and There are two sets of public inputs. This represents all public quantities other than the two sets of public inputs. To establish a common cycle, This represents the output branch mapping numbered j after r rounds of operation on the target cipher, and ⊕ represents the bitwise XOR operation.

8. An automatic search system for a quantum period distinguisher, characterized in that, include: The computation graph generation module is configured to expand the target wheel segment of the target cipher into a wheel-level computation graph. The solver module is configured to: declare symbolic states and exact differences for each edge in the round-level computation graph, declare a common defined period in the full model, compare the exact difference of each node that can generate a periodic term with the common defined period, and add propagation constraints, input and output constraints, feasibility and path cost constraints of the difference distribution table, and connection constraints between all periodic generating nodes and the common defined period to the full model, and solve the problem through the solver. The restoration module is configured to restore the candidate routes based on the solution results and replay the computation graph according to the target cipher specification for verification.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the automatic search method for a quantum periodicity divider as described in any one of claims 1-7.

10. A computer device comprising a computer-readable storage medium, a processor, and a computer program stored on the computer-readable storage medium and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the automatic search method for a quantum period distinguisher as described in any one of claims 1-7.

Images