Method and device for enhancing white box SM4 cryptographic algorithm by using derived key

Abstract

Disclosed in the present invention is a method for enhancing a white box SM4 cryptographic algorithm by using a derived key. The method comprises: acquiring a working key and a transformation key, and generating a first round key and a second round key respectively on the basis of the working key and the transformation key; deriving the second round key of each round to generate a derived key corresponding to each round; on the basis of the i-th round of operation input data and the first round key corresponding to the i-th round, obtaining an i-th round input for a T calling in an encryption operation of the SM4 algorithm, so as to generate an S box of the first round key in the i-th round fusion; and, by means of the derived key corresponding to the i-th round, separately performing a scrambling operation on the S box generated in the i-th round, the i-th round of the operation input data of the T calling, and the i-th round of output data of the T calling, so as to generate ciphertext data. The present invention improves the redundancy, complexity and security of white box cryptography.

Description

Method and device for enhancing white box SM4 cryptographic algorithm using derived keys Technical Field The present invention relates to the field of cryptographic application technology, and in particular to a method and device for enhancing a white box SM4 cryptographic algorithm by using a derived key. Background Art In a white-box attack context, the execution process of the software is completely visible to the attacker. If the cryptographic software running in this environment does not have special protection for the key, the attacker can easily obtain the key information by observing or executing the cryptographic software. White-box cryptography is proposed for this situation. Its purpose is to protect the key in the white-box attack environment, hide the key information in the execution process of the cryptographic software, and prevent the attacker from extracting the key in the white-box attack environment. Most of the current SM4 white-box cryptographic algorithm implementations combine the expanded and derived round keys with the S-box, perform certain input and output transformations, and hide the key information in the table lookup process. For example, the patent application document with publication number CN115996113A proposes to white-box the domestic block cipher algorithm SM4 with a new lookup table technology, and use the domestic cryptographic algorithm SM3 to perform lookup table data integrity verification to prevent tampering. The patent application document with publication number CN111800255A proposes to hide the key information in the lookup table, and adds external coding, so that the input and output coding randomly selected by the lookup table is difficult to be broken and restored. The patent application document with publication number CN115348101A proposes to use chaotic sequences to dynamically construct S-boxes, system parameters and fixed parameters, and reduce the risk of being deciphered during data transmission by changing the content of the S-box. These implementations still have some problems: (1) Since the S-box and table lookup information are both accessible, there is a certain risk of key extraction. (2) The input-output transformation uses fixed parameters without combining variables, which poses a certain security risk. (3) Like keys, white-box cryptographic algorithm codes also need to be distributed. Due to the large amount of data, the distribution process is risky. Summary of the invention The technical problem to be solved by the present invention is how to increase the difficulty of cracking the key in the white-box cryptographic algorithm. The present invention solves the above technical problems by the following technical means: On the one hand, the present invention proposes a method for enhancing a white-box SM4 cryptographic algorithm using a derived key, the method comprising: Obtain a working key and a transformation key, and generate a first round key and a second round key based on the working key and the transformation key respectively. Key; Deriving the second round key of each round to generate a derived key corresponding to each round; Based on the operation input data of the i-th round and the first round key corresponding to the i-th round, obtain the i-th round input called by T in the encryption operation of the SM4 algorithm, and generate the i-th round S box that incorporates the first round key; The derived key corresponding to the i-th round is used to perform scrambling operations on the S-box generated in the i-th round, the i-th round operation input data called by T, and the i-th round output data called by T to generate ciphertext data. Furthermore, both the working key and the transformation key are generated by a quantum key distribution network. Further, the generating a first round key and a second round key based on the working key and the transformed key respectively includes: The working key is expanded using the round key generation algorithm of the SM4 algorithm to generate the first round key corresponding to each round; The round key generation algorithm of the SM4 algorithm is used to expand the transformation key to generate the second round key corresponding to each round. Furthermore, the deriving the second round key of each round to generate a derived key corresponding to each round includes: The second round key corresponding to each round is derived based on the random number preset in each round to generate the derived key corresponding to each round. The formula is expressed as: pkey i1 =HMAC_SM3(rk i2 ,salt i1 ||i||"parmeter derivation"); pkey i2 =HMAC_SM3(pkey i1 ,salt i2 ||i||"parmeter derivation"||0); In the formula, salt i1 、salt i2 The random number preset for round i, pkey i1 、pkey i2 is the derived key corresponding to the i-th round generated by the SM3 cryptographic hash algorithm, rk i2is the second round key corresponding to the i-th round, || indicates concatenation, “parmeter derivation” is a fixed string involved in the transformation, and HMAC_SM3 indicates the use of the SM3 algorithm for keyed hashing HMAC. Further, the i-th round input called by T in the encryption operation of the SM4 algorithm is obtained based on the i-th round operation input data and the first round key corresponding to the i-th round, and the i-th round S box integrating the first round key is generated, including: As the input of T in the encryption operation of SM4 algorithm, let rk i1 =(k i0 , k i1 , k i2 , k i3 ), then: The S-box generated for the i-th round that incorporates the first-round key is: In the formula, X is the operation input data, X i+1 , X i+2 , X i+3 The input data set included in the input data of the i-th round of operation, is an XOR operation, a0, a1, a2, a3 are four 8-bit components that make up the 32-bit X; rk i1 is the first Round key, k i0 , k i1 , k i2 , k i3 are the four subkeys included in the first round key corresponding to the i-th round; T() is a synthetic permutation function, which is composed of a linear transformation L and a nonlinear transformation τ; Sbox() represents a standard S box; x represents one of the four 8-bit components a that constitute the i-th round 32-bit X. j (j=0,1,2,3), k ij k is one of the four subkeys in round i ij (j=0,1,2,3). Further, the use of the derived key corresponding to the i-th round to perform scrambling operations on the S-box generated in the i-th round, the i-th round operation input data called by T, and the i-th round output data called by T to generate ciphertext data includes: Using the derived key corresponding to the i-th round to perform a scrambling operation on the S-box generated in the i-th round, to obtain a table lookup result of the i-th round S-box; Using the derived key corresponding to the i-th round, a scrambling operation is performed on the i-th round operation input data X called by T to obtain the scrambled i-th round input called by T; Using the derived key corresponding to the i-th round, combined with the table lookup result of the i-th round S-box and the input data group X included in the i-th round operation input data i , perform a scrambling operation on the i-th round output data called by T to generate the ciphertext data. Further, the scrambling operation is performed on the S-box generated in the i-th round by using the derived key corresponding to the i-th round to obtain the table lookup result of the S-box in the i-th round, including: According to the derived key pkey corresponding to the i-th round i1 , generate array P i

[0032] =pkey i1 +Rnd i , Rnd i It is a 256-bit random number generated in real time; According to the array, generate the reversible matrix E ij =P i [8j,8j+1,...,8j+7], j=0,1,2,3; Using the reversible matrix E ij For the j S-boxes S generated in round i ij The scrambled S-box is represented by S` ij =E ij ·S ij ; Let the output of the j S-boxes after the scrambling in the i-th round be Z, then the result of the S-box lookup in the i-th round is V i =(Q i ·L)Z T , Q i L is the reversible matrix Q i Combined with the linear transformation L, T Represents the matrix transpose symbol. Furthermore, the derived key corresponding to the i-th round is used to perform a scrambling operation on the i-th round operation input data X called by T. After the scrambling, the i-th round input called by T is expressed by the formula: Where M i+j =P i+j -1 ·E ij -1 , A i+j is a reversible matrix, pkey i2 is the derived key corresponding to the i-th round, A i+j =pkey i2 [4j,4j+1,4j+2,4j+3],E ij is a reversible matrix, αi is a constant, For XOR operation, j=0,1,2,3. Further, the derived key corresponding to the i-th round is used to combine the table lookup result of the i-th round S-box with the input data group X included in the i-th round operation input data. i , performing a scrambling operation on the output data of the i-th round called by T to generate the ciphertext data, including: Perform a reversible affine transformation on the table lookup result of the i-th round S-box and get Perform a reversible affine transformation on the i-th round input of T call after scrambling, and get Perform scrambling operation on the output data of the i-th round called by T to obtain the scrambled output data As the white box cryptographic program code; Among them, V i is the table lookup result of the i-th round S-box, Q i is a reversible matrix, α i ` and α i `` is a constant, P i+4 and P i is an array and is uniformly sorted and crossed in the round transformation, It is an XOR operation. In addition, the present invention also proposes a device for enhancing the white box SM4 cryptographic algorithm using a derived key, the device comprising: A key acquisition module, used to acquire a working key and a transformation key, and generate a first round key and a second round key based on the working key and the transformation key respectively; A key derivation module, used to derive the second round key of each round to generate a derived key corresponding to each round; An encryption module, configured to obtain the i-th round input called by T in the encryption operation of the SM4 algorithm based on the i-th round operation input data and the first round key corresponding to the i-th round, and generate the i-th round S-box integrating the first round key; The scrambling module is used to use the derived key corresponding to the i-th round to perform scrambling operations on the S-box generated in the i-th round, the i-th round operation input data called by T, and the i-th round output data called by T to generate ciphertext data. In addition, the present invention also proposes a white-box cryptographic program code security distribution system, the system includes a quantum key distribution network, each quantum network node in the quantum key distribution network is connected to a corresponding device that adopts a derived key to enhance the white-box SM4 cryptographic algorithm, the white-box cryptographic program code stored in the device that adopts the derived key to enhance the white-box SM4 cryptographic algorithm is generated by the method of adopting the derived key to enhance the white-box SM4 cryptographic algorithm as described above, each device that adopts the derived key to enhance the white-box SM4 cryptographic algorithm is connected to a corresponding communication participant via a secure storage medium to charge the white-box cryptographic program code for the communication participant, and the communication participant adopts the white-box cryptographic program code to perform data encryption and decryption communication. The advantages of the present invention are: (1) In the present invention, a transformation key is added and the second-round key generated by the transformation key is derived to generate a sufficient number of derived keys with forward and backward security. The derived key is used to randomly transform the parameters in the S-box input and output transformation process, rather than just transforming the content of the S-box. This improves the difficulty of cracking the key in the white-box cryptographic algorithm from the perspective of complexity and information redundancy, and increases the redundancy, complexity and security of the white-box cryptography. In addition, the derived key is independent of the first-round key used for encryption, and each round must be derived based on the round key generated based on the derived key. The key derived in each round is used in the white-box encryption process, and the randomness is enhanced. (2) Through quantum key distribution (QKD) and white box code generation point The cross-domain remote white-box cryptographic algorithm is now securely distributed, which improves the security of the white-box cryptographic distribution process and reduces the complexity and resource consumption of the code distribution process. Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS FIG1 is a flow chart of a method for enhancing a white-box SM4 cryptographic algorithm using a derived key according to an embodiment of the present invention; 2 is a schematic diagram of the structure of a device that uses a derived key to enhance the white-box SM4 cryptographic algorithm according to an embodiment of the present invention; 3 is a schematic diagram of the structure of a white-box cryptographic program code security distribution system proposed in one embodiment of the present invention; FIG. 4 is a schematic diagram of the workflow of a white-box cryptographic program code security distribution system according to an embodiment of the present invention. DETAILED DESCRIPTION In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in combination with the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. As shown in FIG1 , the first embodiment of the present invention proposes a method for enhancing the white-box SM4 cryptographic algorithm using a derived key, the method comprising the following steps: S10, obtaining a working key and a transformation key, and generating a first round key and a second round key based on the working key and the transformation key respectively; S20, deriving the second round key of each round to generate a derived key corresponding to each round; S30, based on the operation input data of the i-th round and the first round key corresponding to the i-th round, obtain the i-th round input called by T in the encryption operation of the SM4 algorithm, and generate the i-th round S box that incorporates the first round key; S40, using the derived key corresponding to the i-th round, scrambling operations are performed on the S-box generated in the i-th round, the i-th round operation input data called by T, and the i-th round output data called by T, respectively, to generate ciphertext data. In the process of encrypting plaintext data using the white-box SM4 algorithm in this embodiment, a transformation key is added, and the second-round key generated by the transformation key is derived to generate a sufficient number of derived keys with forward and backward security as parameters of the S-box and input-output transformation. By combining variables in the transformation of the S-box, the difficulty of cracking the key in the white-box cryptographic algorithm is improved in terms of complexity and information redundancy, thereby increasing the redundancy, complexity and security of the white-box cryptography. In one embodiment, the working key and the transformation key are both generated by a quantum key distribution network and synchronized across the entire domain. Specifically, the working key K1 and transformation key K2 in this embodiment are two 128-bit fresh keys generated by the quantum key distribution network QKD. Each 128-bit key consists of four 32-bit sub-keys and is transmitted to each quantum network node in the quantum key distribution network QKD, and then transmitted by the quantum network node to the white box code generation point to which it is connected, and the white box cryptographic program code is generated by the white box code generation point. In one embodiment, in the step S20, generating a first round key and a second round key based on the working key and the transformed key respectively includes: The working key is expanded by using the round key generation algorithm of the SM4 algorithm to generate the first round key corresponding to each round; the transformation key is expanded by using the round key generation algorithm of the SM4 algorithm to generate the second round key corresponding to each round. In this embodiment, a 32-bit first round key rk is generated based on K1 and K2. i1 and the second round key rk i2 , i=0,1,2,…,31, the round key generation method adopts the national standard GB / T 32907-2016 "Information Security Technology SM4 Block Cipher Algorithm". In one embodiment, the step S20: deriving the second round key of each round to generate a derived key corresponding to each round specifically includes: The second round key corresponding to each round is derived based on the random number preset in each round to generate the derived key corresponding to each round. The formula is expressed as: pkey i1 =HMAC_SM3(rk i2 ,salt i1 ||i||"parmeter derivation"); pkey i2 =HMAC_SM3(pkey i1 ,salt i2 ||i||"parmeter derivation"||0); In the formula, salt i1 、salt i2 The random number preset for round i, pkey i1 、pkey i2 is the derived key corresponding to the i-th round generated by the SM3 cryptographic hash algorithm, rk i2 is the second round key corresponding to the i-th round, || indicates concatenation, “parmeter derivation” is a fixed string involved in the transformation, and HMAC_SM3 indicates the use of the SM3 algorithm for keyed hashing HMAC. The transformed round key in this embodiment uses a sufficient number of derived keys with forward and backward security generated based on the SM3 cryptographic hash algorithm as the parameters of the S-box and input-output transformation, pkey i1 、pkey i2 It is a 256-bit output using the SM3 keyed hashing algorithm. In one embodiment, the step S30: obtaining the i-th round input called by T in the encryption operation of the SM4 algorithm based on the i-th round operation input data and the first round key corresponding to the i-th round, and generating the i-th round S box integrating the first round key, specifically includes: Assume that the input of each round of operation is (X i ,X i+1 ,X i+2 ,X i+3 ), the output is X i+4 ,by As the input of T in the encryption operation of SM4 algorithm, let rk i1 =(k i0 , k i1 , k i2 , k i3 ), i=0,1,2,…,31, then: The S-box generated for the i-th round that incorporates the first-round key is: i=0,1,2,…,31, j=0,1,2,3; In the formula, X is the operation input data, X i+1 , X i+2 , X i+3 The input data set included in the input data of the i-th round of operation, is an XOR operation, a0, a1, a2, a3 are four 8-bit components that make up the 32-bit X; rk i1 is the first round key corresponding to the i-th round, k i0 , k i1 , k i2 , k i3 are the four subkeys included in the first round key corresponding to the i-th round; T() is a synthetic permutation function, which is composed of a linear transformation L and a nonlinear transformation τ; Sbox() represents a standard S box; x represents one of the four 8-bit components a that constitute the i-th round 32-bit X. j (j=0,1,2,3), k ij k is one of the four subkeys in round i ij (j=0,1,2,3). It should be noted that the encryption operation of each round of the SM4 algorithm adopts the national standard GB / T 32907-2016 "Information Security Technology SM4 Block Cipher Algorithm". In this embodiment, the S box of each round is related to the key. Each round of 4 8-bit sub-keys corresponds to 4 S boxes, forming a total of 32×4 S boxes that merge the round keys. In one embodiment, the step S40: using the derived key corresponding to the i-th round to perform scrambling operations on the S-box generated in the i-th round, the i-th round operation input data called by T, and the i-th round output data called by T, respectively, to generate ciphertext data, includes: S41, using the derived key corresponding to the i-th round to perform a scrambling operation on the S-box generated in the i-th round, to obtain a table lookup result of the S-box in the i-th round; S42, using the derived key corresponding to the i-th round to perform a scrambling operation on the i-th round operation input data X called by T, to obtain the i-th round input called by T after scrambling; S43, using the derived key corresponding to the i-th round, combining the table lookup result of the i-th round S-box and the input data group X included in the i-th round operation input data i , perform scrambling operation on the output data of the i-th round called by T to generate ciphertext data. In one embodiment, the step S41: using the derived key corresponding to the i-th round to perform a scrambling operation on the S-box generated in the i-th round to obtain a table lookup result of the i-th round S-box specifically includes the following steps: According to the derived key pkey corresponding to the i-th round i1 , generate array P i =pkey i1 +Rnd i , Rnd i It is a 256-bit random number generated in real time; According to the array, generate the reversible matrix E ij =P i [8j,8j+1,...,8j+7], j=0,1,2,3; Using the reversible matrix E ij For the j S-boxes S generated in round i ij The scrambled S-box is represented by S` ij =E ij ·S ij ; Let the output of the j S-boxes after the scrambling in the i-th round be Z, then the result of the S-box lookup in the i-th round is V i =(Q i ·L)Z T , Q i L is the reversible matrix Q i Combined with the linear transformation L, T Represents the matrix transpose symbol. Specifically, this embodiment performs the following operations on the four S-boxes S in the i-th round: ij (i=0,1,2,…,31,j=0,1,2,3) the scrambling operation is: Let Eij =diag(E i0 ,E i1 ,E i2 ,E i3 ), E ij is an 8×8 bit reversible matrix of the finite field GF(2), P i =pkey i1 +Rnd i , Rnd i is a 256-bit random number generated in real time, P i

[0032] is a 32×8 bit array obtained by sequentially separating 256 bits, E ij =P i [8j,8j+1,...,8j+7], then the scrambled S-box S` ij =E ij ·S ij , randomly construct a GF(2) 32×32 random bit reversible matrix Q i And combined with L transformation to Q i ·L, let the output of the 4 S-boxes after table lookup in round i be Z = (z i0 ,z i1 ,z i2 ,z i3 ),but The result is the XOR of the four subtables, the four S-box lookups and the Q i The L change is unified into a lookup of the four sub-tables and an XOR of the lookup results. In one embodiment, the step S42: using the derived key corresponding to the i-th round to perform a scrambling operation on the i-th round operation input data X called by T, the i-th round input called by T after scrambling is expressed by the formula: Where M i+j =P i+j -1 ·E ij -1 , A i+j is a 32×32 bit reversible matrix of GF(2), pkey i2 is the derived key corresponding to the i-th round, represented by a 32×8 bit array obtained by sequentially separating 256 bits, A i+j =pkey i2 [4j,4j+1,4j+2,4j+3],α i is a 32-bit constant, E ij is a reversible matrix, For XOR operation, j=0,1,2,3. In one embodiment, the step S43: using the derived key corresponding to the i-th round, combining the table lookup result of the i-th round S-box and the input data group X included in the i-th round operation input data i , perform scrambling operation on the output data of the i-th round called by T to generate ciphertext data, specifically including the following steps: Perform a reversible affine transformation on the table lookup result of the i-th round S-box and get Perform a reversible affine transformation on the i-th round input of T call after scrambling, and get Perform scrambling operation on the output data of the i-th round called by T to obtain the scrambled output data As the generated ciphertext data; Among them, V i is the table lookup result of the i-th round S-box, Q i is a 32×32 bit reversible matrix, α i ` and α i `` is a 32-bit constant, P i+4 and P i With P i+j The structure is the same and they are uniformly sorted and crossed in the round transformation, so that the input and output P i+j Can cancel each other out, It is an XOR operation. This embodiment is based on the algorithm standard implementation process described in the national standard GB / T 32907-2016 "Information Security Technology SM4 Block Cipher Algorithm", and adds relevant transformations combined with the working key and the transformation key to achieve HMAC derived key enhancement. The white-box SM4 cryptographic algorithm with strong security is used, and the code for implementing the algorithm is stored in the white-box library of the code generation point. The algorithm code is securely charged and locally imported for communication participants using secure storage media such as secure SIM cards, secure TF cards or secure U-shields. In addition, cross-domain remote white-box cryptographic algorithm security distribution is achieved through the quantum key distribution network QKD and the white-box code generation point, which improves the security of the white-box cryptographic distribution process and reduces the complexity and resource consumption of the code distribution process. As shown in FIG2 , the second embodiment of the present invention proposes a device for enhancing the white-box SM4 cryptographic algorithm using a derived key, the device comprising: A key acquisition module 10, used to acquire a working key and a transformation key, and generate a first round key and a second round key based on the working key and the transformation key respectively; A key derivation module 20, configured to derive the second round key of each round to generate a derived key corresponding to each round; The encryption module 30 is used to obtain the i-th round input called by T in the encryption operation of the SM4 algorithm based on the i-th round operation input data and the first round key corresponding to the i-th round, and generate the i-th round S box integrating the first round key; The scrambling module 40 is used to use the derived key corresponding to the i-th round to perform scrambling operations on the S-box generated in the i-th round, the i-th round operation input data called by T, and the i-th round output data called by T, respectively, to generate ciphertext data. The device proposed in this embodiment uses a derived key to enhance the white-box SM4 cryptographic algorithm. By adding a transformation key and deriving the second-round key generated by the transformation key, a sufficient number of derived keys with forward and backward security are generated as parameters of the S-box and input-output transformation. By combining variables in the transformation of the S-box, the difficulty of cracking the key in the white-box cryptographic algorithm is improved in terms of complexity and information redundancy, thereby increasing the redundancy, complexity and security of the white-box cryptography. In one embodiment, the working key and the transformation key are two 128-bit fresh keys generated through a quantum key distribution network QKD and synchronized in the global domain. In one embodiment, the key acquisition module 10 includes: A first expansion unit, configured to expand the working key by adopting a round key generation algorithm of an SM4 algorithm to generate the first round key corresponding to each round; The second expansion unit is used to expand the transformation key by adopting the round key generation algorithm of the SM4 algorithm to generate the second round key corresponding to each round. In one embodiment, the key derivation module 20 is specifically used to: The second round key corresponding to each round is derived based on the random number preset in each round to generate the derived key corresponding to each round. The formula is expressed as: pkey i1 =HMAC_SM3(rk i2 ,salt i1 ||i||"parmeter derivation"); pkey i2 =HMAC_SM3(pkey i1 ,salt i2 ||i||"parmeter derivation"||0); In the formula, salt i1 、salt i2 The random number preset for round i, pkey i1、pkey i2 is the derived key corresponding to the i-th round generated by the SM3 cryptographic hash algorithm, rk i2 is the second round key corresponding to the i-th round, || indicates concatenation, “parmeter derivation” is a fixed string involved in the transformation, and HMAC_SM3 indicates the use of the SM3 algorithm for keyed hashing HMAC. In one embodiment, the encryption module 30 is specifically used for: by As the input of T in the encryption operation of SM4 algorithm, let rk i1 =(k i0 , k i1 , k i2 , k i3 ), then: The S-box generated for the i-th round that incorporates the first-round key is: In the formula, X is the operation input data, X i+1 , X i+2 , X i+3 The input data set included in the input data of the i-th round of operation, is an XOR operation, a0, a1, a2, a3 are four 8-bit components that make up the 32-bit X; rk i1 is the first round key corresponding to the i-th round, k i0 , k i1 , k i2 , k i3 are the four subkeys included in the first round key corresponding to the i-th round; T() is a synthetic permutation function, which is composed of a linear transformation L and a nonlinear transformation τ; Sbox() represents a standard S box; x represents one of the four 8-bit components a that constitute the i-th round 32-bit X. j (j=0,1,2,3), k ij k is one of the four subkeys in round i ij (j=0,1,2,3). In one embodiment, the scrambling module 40 includes: A first scrambling unit, configured to perform a scrambling operation on the S-box generated in the i-th round using the derived key corresponding to the i-th round, to obtain a table lookup result of the S-box in the i-th round; A second scrambling unit is used to perform a scrambling operation on the i-th round operation input data called by T using the derived key corresponding to the i-th round, and scramble the i-th round input called by T; The third scrambling unit is used to use the derived key corresponding to the i-th round, combine the table lookup result of the i-th round S-box and the input data group X included in the i-th round operation input data i , perform scrambling operation on the i-th round output data called by T to generate the white box cryptographic program code. In one embodiment, the first scrambling unit is specifically configured to: According to the derived key pkey corresponding to the i-th round i1 , generate array P i =pkey i1 +Rnd i , Rnd i It is a 256-bit random number generated in real time; According to the array, generate the reversible matrix E ij =P i [8j,8j+1,...,8j+7], j=0,1,2,3; Using the reversible matrix E ij For the j S-boxes S generated in round i ij The scrambled S-box is represented by S` ij =E ij ·S ij ; Let the output of the j S-boxes after the scrambling in the i-th round be Z, then the result of the S-box lookup in the i-th round is V i =(Q i ·L)Z T , Q i ·L is the reversible matrix Q i Combined with the linear transformation L, T Represents the matrix transpose symbol. In one embodiment, the second scrambling unit is specifically configured to: The derived key corresponding to the i-th round is used to perform a scrambling operation on the i-th round operation input data called by T. After scrambling, the i-th round input called by T is expressed as follows: Where M i+j =P i+j -1 ·E ij -1 , A i+j is a reversible matrix, pkey i2 is the derived key corresponding to the i-th round, A i+j =pkey i2 [4j,4j+1,4j+2,4j+3],E ijis a reversible matrix, α i is a constant, For XOR operation, j=0,1,2,3. In one embodiment, the third scrambling unit is specifically configured to: Perform a reversible affine transformation on the table lookup result of the i-th round S-box and get Perform a reversible affine transformation on the i-th round input of T call after scrambling, and get Perform scrambling operation on the output data of the i-th round called by T to obtain the scrambled output data As the white box cryptographic program code; Among them, V i is the table lookup result of the i-th round S-box, Q i is a reversible matrix, α i ` and α i `` is a constant, P i+4 and P i is an array and is uniformly sorted and crossed in the round transformation, It is an XOR operation. It should be noted that other embodiments of the device for enhancing the white-box SM4 cryptographic algorithm using a derived key or implementation methods described in the present invention can refer to the above-mentioned method embodiments, which will not be repeated here. As shown in Figure 3, the third embodiment of the present invention proposes a white-box cryptographic program code security distribution system, the system includes a quantum key distribution network 1, each quantum network node in the quantum key distribution network 1 is connected to a corresponding code generation point 2, the code generation point 2 stores the white-box cryptographic program code generated by the method of using the derived key enhanced white-box SM4 cryptographic algorithm as described above, each code generation point 2 is connected to a corresponding communication participant 3, and the communication participant 3 uses the white-box cryptographic program code to perform data encryption and decryption communication. Specifically, the communication participants include the communication initiator and the communication receiver, which are software and hardware nodes used to participate in encrypted communication using the white box cryptographic algorithm. The white box SM4 cryptographic algorithm code in the corresponding white box code generation point is filled and imported into the local storage and running space using secure storage media such as a secure SIM card, a secure TF card or a secure U shield. The white box code generation point is used to generate different white box cryptographic program codes according to different keys, and after compression, the white box code is injected or distributed to the communication participants via a secure storage medium. The quantum key distribution network includes quantum network nodes and quantum network link control centers, which realize services such as quantum key generation and distribution, quantum key relay, and quantum key provision. The quantum network nodes are used to store the generated quantum keys. Receive key applications from key agents, provide keys to key agents or directly provide key injection and key distribution services; quantum network link control center, used to establish quantum key distribution and relay links between nodes according to quantum network node IDs. Furthermore, the system is also provided with a key agent for providing agent functions of key injection and key distribution when the communication participants cannot directly perform key injection and key distribution at the nodes of the quantum key distribution network. In one embodiment, as shown in FIG4 , the workflow of the white-box cryptographic program code security distribution system proposed in this embodiment is as follows: (1) Two 128-bit working keys K1 and transformation keys K2 are generated and synchronized across the entire domain through the quantum key distribution network QKD and transmitted to the white box code generation device connected to each QKD node. (2) The white-box code generation device generates a 32-bit round key rk based on K1 and K2 i1 and RK i2 , i = 0, 1, 2, ..., 31, and the round key rk of each round i2 Make a derivation. (3) In each round of encryption operation of the SM4 algorithm, i=0,1,2,…,31,j=0,1,2,3, that is, the S-box of each round is related to the key, and 4 8-bit sub-keys of each round correspond to 4 S-boxes, forming a total of 32×4 S-boxes that merge the round keys. (4) For the four S-boxes S in round i ij Perform scrambling operation to obtain the table lookup result of the i-th round S-box. (5) Perform an input scrambling operation on the i-th round input data called by T to obtain the i-th round input called by T after scrambling. (6) Perform output scrambling operation on the output data of the i-th round called by T, output This embodiment realizes cross-domain remote white-box cryptographic algorithm security distribution through a quantum key distribution network QKD and a white-box code generation point, thereby improving the security of the white-box cryptographic distribution process and reducing the complexity and resource consumption of the code distribution process; and by using a keyed hash operation based on the SM3 algorithm on the transformed round key to generate a sufficient number of derived keys with forward and backward security as parameters for the S-box input and output transformation, the difficulty of cracking the key in the white-box cryptographic algorithm is improved in terms of complexity and information redundancy. In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, for example Two, three, etc., unless otherwise expressly specified. Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A method for enhancing a white-box SM4 cryptographic algorithm using a derived key, characterized in that: The method comprises: Obtaining a working key and a transformation key, and generating a first round key and a second round key based on the working key and the transformation key respectively; Deriving the second round key of each round to generate a derived key corresponding to each round; Based on the operation input data of the i-th round and the first round key corresponding to the i-th round, obtain the i-th round input called by T in the encryption operation of the SM4 algorithm, and generate the i-th round S box that incorporates the first round key; The derived key corresponding to the i-th round is used to perform scrambling operations on the S-box generated in the i-th round, the i-th round operation input data called by T, and the i-th round output data called by T to generate ciphertext data.

2. The method of enhancing the white-box SM4 cryptographic algorithm using a derived key as claimed in claim 1, characterized in that: The working key and the transformation key are both generated by a quantum key distribution network.

3. The method for enhancing the white-box SM4 cryptographic algorithm using a derived key as claimed in claim 1, characterized in that: The generating of the first round key and the second round key based on the working key and the transformation key respectively comprises: The working key is expanded using the round key generation algorithm of the SM4 algorithm to generate the first round key corresponding to each round; The round key generation algorithm of the SM4 algorithm is used to expand the transformation key to generate the second round key corresponding to each round.

4. The method of enhancing the white-box SM4 cryptographic algorithm using a derived key as claimed in claim 1, characterized in that: The deriving the second round key of each round to generate a derived key corresponding to each round includes: The second round key corresponding to each round is derived based on the random number preset in each round to generate the derived key corresponding to each round. The formula is expressed as: pkey i1 =HMAC_SM3(rk i2 ,salt i1 ||i||"parmeter derivation”); pkey i2 =HMAC_SM3(pkey i1 ,salt i2 ||i||"parmeter derivation”||0); In the formula, salt i1 、salt i2 The random number preset for round i, pkey i1 、pkey i2 is the derived key corresponding to the i-th round generated by the SM3 cryptographic hash algorithm, rk i2 is the second round key corresponding to the i-th round, || indicates concatenation, "parmeter derivation" is a fixed string involved in the transformation, and HMAC_SM3 indicates the use of the SM3 algorithm to perform a keyed hash operation HMAC.

5. The method of enhancing the white-box SM4 cryptographic algorithm using a derived key as claimed in claim 1, characterized in that: The method of obtaining the i-th round input called by T in the encryption operation of the SM4 algorithm based on the i-th round operation input data and the first round key corresponding to the i-th round, and generating the i-th round S box integrating the first round key includes: by As the input of T in the encryption operation of SM4 algorithm, let rk i1 =(k i0 , k i1 , k i2 , k i3 ), then: The S-box generated for the i-th round that incorporates the first-round key is: In the formula, X is the operation input data, X i+1 , X i+2 , X i+3 The input data set included in the input data of the i-th round of operation, is an XOR operation, a0, a1, a2, a3 are four 8-bit components that make up the 32-bit X; rk i1 is the first round key corresponding to the i-th round, k i0 , k i1 , k i2 , k i3 are the four subkeys included in the first round key corresponding to the i-th round; T() is a synthetic permutation function, which is composed of a linear transformation L and a nonlinear transformation τ; Sbox() represents a standard S box; x represents one of the four 8-bit components a that constitute the i-th round 32-bit X. j , k ij It is one of the four subkeys in the i-th round, j = 0, 1, 2, 3.

6. The method of enhancing the white-box SM4 cryptographic algorithm using a derived key as claimed in claim 1, characterized in that: The method of using the derived key corresponding to the i-th round to perform scrambling operations on the S-box generated in the i-th round, the i-th round operation input data called by T, and the i-th round output data called by T to generate ciphertext data includes: Using the derived key corresponding to the i-th round to perform a scrambling operation on the S-box generated in the i-th round, to obtain a table lookup result of the i-th round S-box; Using the derived key corresponding to the i-th round, a scrambling operation is performed on the i-th round operation input data X called by T to obtain the scrambled i-th round input called by T; Using the derived key corresponding to the i-th round, combined with the table lookup result of the i-th round S-box and the input data group X included in the i-th round operation input data i , perform a scrambling operation on the i-th round output data called by T to generate the ciphertext data.

7. The method of enhancing the white-box SM4 cryptographic algorithm using a derived key as claimed in claim 6, characterized in that: The scrambling operation is performed on the S-box generated in the i-th round by using the derived key corresponding to the i-th round to obtain the table lookup result of the S-box in the i-th round, including: According to the derived key pkey corresponding to the i-th round i1 , generate array P i [32] = pkey i1 +Rnd i , Rnd i It is a 256-bit random number generated in real time; According to the array, generate the reversible matrix E ij =P i [8j,8j+1,...,8j+7], j=0,1,2,3; Using the reversible matrix E ij For the j S-boxes S generated in round i ij The scrambled S-box is represented by S` ij =E ij ·S ij ; Let the output of the j S-boxes after the scrambling in the i-th round be Z, then the result of the S-box lookup in the i-th round is V i =(Q i ·L)Z T , Q i L is the reversible matrix Q i Combined with the linear transformation L, T Represents the transpose symbol.

8. The method of enhancing the white-box SM4 cryptographic algorithm using a derived key as claimed in claim 6, characterized in that: The derived key corresponding to the i-th round is used to perform a scrambling operation on the i-th round operation input data X called by T. After scrambling, the i-th round input called by T is expressed as: Where M i+j =P i+j -1 ·E ij -1 , A i+j is a reversible matrix, pkey i2 is the derived key corresponding to the i-th round, A i+j =pkey i2 [4j,4j+1,4j+2,4j+3],α i is a constant, E ij is a reversible matrix, For XOR operation, j=0,1,2,3.

9. The method of enhancing the white-box SM4 cryptographic algorithm using a derived key as claimed in claim 6, characterized in that: The derived key corresponding to the i-th round is used to combine the table lookup result of the i-th round S-box with the input data group X included in the i-th round operation input data. i , performing a scrambling operation on the output data of the i-th round called by T to generate the ciphertext data, including: Perform a reversible affine transformation on the table lookup result of the i-th round S-box and get Perform a reversible affine transformation on the i-th round input of T call after scrambling, and get Perform scrambling operation on the output data of the i-th round called by T to obtain the scrambled output data As the white box cryptographic program code; Among them, V i is the table lookup result of the i-th round S-box, Q i is a reversible matrix, α i ` and α i `` is a constant, P i+4 and P i is an array and is uniformly sorted and crossed in the round transformation, It is an XOR operation.

10. A device for enhancing the white-box SM4 cryptographic algorithm using a derived key, characterized in that: include: A key acquisition module, used to acquire a working key and a transformation key, and generate a first round key and a second round key based on the working key and the transformation key respectively; A key derivation module, used to derive the second round key of each round to generate a derived key corresponding to each round; An encryption module, configured to obtain the i-th round input called by T in the encryption operation of the SM4 algorithm based on the i-th round operation input data and the first round key corresponding to the i-th round, and generate the i-th round S-box integrating the first round key; The scrambling module is used to use the derived key corresponding to the i-th round to perform scrambling operations on the S-box generated in the i-th round, the i-th round operation input data called by T, and the i-th round output data called by T to generate ciphertext data.

11. A white box cryptographic program code security distribution system, characterized in that: The system includes a quantum key distribution network, each quantum network node in the quantum key distribution network is connected to a corresponding code generation point, the code generation point stores a white box cryptographic program code generated by the method of enhancing the white box SM4 cryptographic algorithm using a derived key as described in any one of claims 1 to 9, each code generation point is connected to a corresponding communication participant via a secure storage medium for charging the white box cryptographic program code for the communication participant, and the communication participant uses the white box cryptographic program code to perform data encryption and decryption communication.

Images