CN104836808B - Based on the SM2 signature algorithm security verification methods for improving difference fault analysis - Google Patents

Based on the SM2 signature algorithm security verification methods for improving difference fault analysis Download PDF

Info

Publication number
CN104836808B
CN104836808B CN201510239497.7A CN201510239497A CN104836808B CN 104836808 B CN104836808 B CN 104836808B CN 201510239497 A CN201510239497 A CN 201510239497A CN 104836808 B CN104836808 B CN 104836808B
Authority
CN
China
Prior art keywords
signature
wheel
mistake
median
iteration
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201510239497.7A
Other languages
Chinese (zh)
Other versions
CN104836808A (en
Inventor
冯婧怡
陈华
曹伟琼
韩绪仓
李大为
罗鹏
郑晓光
李国友
高顺贤
朱少峰
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
COMMERCIAL PASSWORDS INSPECTION CENTER OF STATE CRYPTOGRAPHY ADMINISTRATION
Institute of Software of CAS
Beijing CEC Huada Electronic Design Co Ltd
Original Assignee
COMMERCIAL PASSWORDS INSPECTION CENTER OF STATE CRYPTOGRAPHY ADMINISTRATION
Institute of Software of CAS
Beijing CEC Huada Electronic Design Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by COMMERCIAL PASSWORDS INSPECTION CENTER OF STATE CRYPTOGRAPHY ADMINISTRATION, Institute of Software of CAS, Beijing CEC Huada Electronic Design Co Ltd filed Critical COMMERCIAL PASSWORDS INSPECTION CENTER OF STATE CRYPTOGRAPHY ADMINISTRATION
Priority to CN201510239497.7A priority Critical patent/CN104836808B/en
Publication of CN104836808A publication Critical patent/CN104836808A/en
Application granted granted Critical
Publication of CN104836808B publication Critical patent/CN104836808B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H04L9/3252—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures using DSA or related signature schemes, e.g. elliptic based signatures, ElGamal or Schnorr schemes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities

Abstract

The invention discloses a kind of based on the SM2 signature algorithm security verification methods for improving difference fault analysis.This method is：1) message M is signed using SM2 signature algorithms, injects mistake when the random number k of generation and the elliptic curve basic point G scalar multiplication iteration of SM2 signature algorithms proceed to the i-th wheel, change the partial bit value of the i-th wheel median y-coordinate；2) the signature result obtained using step 1), and sign test public key PAThe consecutive bit values of random number k are recovered with message M Hash Values e；3) using the consecutive bit values and error signature result construction HNP problems, private key is gone out using lattice attack analysis, then judges whether current SM2 signature algorithms are safe according to the private key.The present invention can be easier injection mistake, more comprehensively analyze the security capabilities of SM2 signature algorithms resistance attack.

Description

Based on the SM2 signature algorithm security verification methods for improving difference fault analysis
Technical field
The invention belongs to elliptic curve cryptography (ECC) analysis and fault analysis field, and in particular to one kind is based on changing Enter the SM2 signature algorithm security verification methods of difference fault analysis, belong to field of information security technology.
Background technology
Since in the 1980s, elliptic curve is introduced cryptography, and Lenstra propositions by Miller and Koblitz Since carrying out factorising algorithm using elliptic curve, effect of the elliptic curve in cryptography be increasing.ECC is to be based on Finite field elliptic curves discrete logarithm problem (ECDLP)：In a circled addition group, G is generation member, and G rank is n, Know Q=kG and G, seek k value, wherein Q=kG is the scalar multiplication in finite field, the algebraic operation specially in finite field.
If F is finite field, at least contain two elements, and an addition "+" and multiplication " " computing be present, it is full The following condition of foot：
1) (F ,+) it is an abelian group；
2) (F/ { 0 }) is an abelian group；
3) associative law is met：(ab) c=a (bc) additions and multiplication meet distributive law, i.e., to any a, b, c ∈ R, a (b+c)=ab+ac, (b+c) a=ab+ac.
The most frequently used finite field includes in cipher application：Prime field and the extension field (binary expansion domain) for being characterized as 2, lead here Introduce prime field.If p is prime number, F={ 0,1,2 ..., p-1 } is on mod p+and the finite field formed, note For Fp, referred to as prime field (Galois domains), Fp *=FP/ { 0 } is FpThe multiplicative group that all non-zero entries are formed in, due to Fp *It is to follow Ring group, so in FpIn an element g at least be present so that FpIn any non-zero entry can be shown by a g square power table, claim g For Fp *Generation it is first (or primitive element), i.e. Fp *=＜ g ＞, rank p-1.
If in prime field FpElliptic curve equation on (p is greater than 3 prime number) is：
y2=x3+ax+b mod p,a、b∈Fp, and (4a3+27b2)mod p≠0
Then finite field FpUpper elliptic curve point set E (Fp) be defined as：
E(Fp)={ (x, y) | x, y ∈ Fp,y2=x3+ ax+b mod p } ∪ { O }, wherein, O is infinite point.
If point G ∈ E (Fp), and G rank n is prime number, then cyclic group ＜ G ＞={ O, G, 2G, 3G ... the, (n- generated by G 1) G } it is E (Fp) cyclic subgroup.Elliptic curve point set E (Fp) element number #E (Fp) represent, referred to as elliptic curve E (Fp) rank.In ECC cryptographic systems, prime number p, domain FpElliptic curve equation, basic point G and its rank n be disclosed domain ginseng Count, optional private key d ∈ [1, n-1], then corresponding public key P=dG.
The point defined on elliptic curve has used string tangent rule with dot summation operation, then E (Fp) it is addition abelian group, nothing Poor far point O is that unit is first, P (x, y)+P (x ,-y)=O.To E (Fp) upper 2 points P, Q sum P+Q, if P ≠ Q, connection P, Q's is straight Line hands over E, and in point R', then R' is P+Q sums on the symmetric points R of x-axis, referred to as point add operation (A).As shown in Figure 1.
If P=Q, the tangent line for doing P points hands over E in point R', then R' is then 2P, referred to as Point Double Operation on the symmetric points R of x-axis (D).As shown in Figure 2.
Added by the point on elliptic curve and put geometric meaning again, can be inferred that E (Fp) operation method under affine coordinate Then, it is specific as follows：
Point adds:Make P=(x1,y1)∈E(Fp), Q=(x2,y2)∈E(Fp), and P ≠ Q, then R (x3,y3)=P+Q, wherein,
Point times:Make P=(x1,y1)∈E(Fp), P ≠-P, then R (x3,y3)=2P, wherein,
Therefore, it is actually k identical point G sum for the scalar multiplication Q=kG in ECC, by multiple points times Combined with point add operation, kG is basic operation related to key in ECC, and fault analysis and side Multiple Channel Analysis enter generally directed to kG OK.KG have it is a variety of realize algorithm, wherein most basic is radix-2 algorithm, if k=(km-1,…,k1,k0)2, below with from the right side Illustrate kG binary arithmetic operation exemplified by computing to the left：
1.Q=O, H=G
2.i=0 to n-1, repeat
If 2.1 ki=1, then Q=Q+H
2.2H=2H
3. return (Q)
Due to elliptic curve parameter b being not used in scalar multiplication computing, for not in elliptic curve E (Fp) on point P '= (x1′,y1'), curve is E ' (F where can settingp)={ (x, y) | x, y ∈ Fp,y2=x3+ ax+b ' mod p } ∪ { O }, whereinSo P ' is in E ' (Fp) under algorithm with virgin curve E (Fp) on it is identical, it is fixed Justice is " pseudo-addition " and " pseudo- multiplication ".Pseudo operation is widely used in the attack of ECC systems.
ECC is as public key algorithm, relatively traditional RSA public key algorithms, under identical security, ECC algorithm key Length is short, calculating data volume is small, arithmetic speed is fast, flexibility is good, in the case of no coprocessor, is easy to real in the chips It is existing.In addition, there is presently no the efficient algorithm for finding solution ECDLP problems, therefore it is higher than RSA calculations on algorithm security Method.ECC cryptographic algorithms are based on its own feature, just gradually instead of traditional RSA Algorithm in numerous applications, are extensively used.
ECC Digital Signature Algorithms are one of widest algorithms in being applied in ECC public key algorithms, are mainly used in identity and test Card, data are produced with digital signature by a signer, and the reliability of signature is verified by a verifier.Each signer has One public key and a private key, wherein private key are used to produce signature, the public key verifications signature of verifier's signer.
SM2 signature algorithms are a kind of ECC Digital Signature Algorithms, by national Password Management office in the mark issued in 2010 Standard, include signature and sign test two parts altogether.
In signature process (as shown in Figure 3), if message to be signed is M, in order to obtain message M digital signature (r, S), signer A public and private key is respectively PA、dA, the hash algorithm used in algorithm is equally by the issue of national Password Management office SM3 hash algorithms, then signer A should realize following calculation step：
1. orderWherein, ZA=Hv(ENTLA||IDA),IDAMark, ENTL are distinguished for signer AAFor IDABit length, by two byte representations, Hv() is the hash function of SM3 algorithms；
2. calculate
3. produce random number k ∈ [1, n-1] with randomizer；
4. calculate elliptic curve point (x1,y1)=kG；
5. calculate r=(e+x1) mod n, return to 3 if r=0 or r+k=n；
6. calculate s=(1+dA)-1(k-rdA) mod n, 3 are returned if s=0；
7. output message M signature (r, s).
Signature result (r, s) and message M are sent to sign test person B by signer, it is known that signer A's distinguishes mark IDA, Z can be obtained by hash computing BA=Hv(ENTLA||IDA), and using A public key PASign test (as shown in Figure 4) is carried out, specifically such as Under：
1. examining whether r ∈ [1, n-1], s ∈ [1, n-1] set up, sign test fails if invalid；
2. order
3. calculate
4. t=(r+s) mod n are calculated, if t=0, sign test failure；
5. calculate elliptic curve point (x1,y1)=sG+tPA；
6. calculate R=(e+x1) mod n, sign test fails if R ≠ r, otherwise sign test success.
In view of the application importance of SM2 signature algorithms, it is necessary to analyze its security, typically examined by the method for attack Whether it is safe.From the foregoing, it will be observed that due to private key dAUsed only in signature, therefore, attack and protection typically to SM2 are all Analyze private key d in signature processASecurity.Most of attack methods to other ECC signature algorithms are used equally for SM2 to sign Algorithm, such as to scalar multiplication, ECDSA side channel and fault analysis method.At present, existing document is proposed to sign to SM2 and calculated The fault analysis method of method, mainly including weak curve, the fault analysis to private key and the fault analysis based on lattice.Weak curve mistake Attack is to inject some bit-errors to basic point G in scalar multiplication kG computings to become point G', and scalar multiplication result Q=kG is then changed into Q' =kG', G' be not on virgin curve, and on a new weak curve, and the relatively original rank n of rank n's of the G' on new curve will It is much smaller, if n' largest prime divisor qCalculating is feasible, then can obtain k value by solving Q'=kG', and then Private key d can be derivedA.Fault analysis to private key is to utilize rd in signatureAMod n modular multiplication, to the private in the computing Key injects mistake, it the mistake of a byte is occurred, and private key d is determined by guessingAValue.Fault analysis method based on lattice Mistake usually is injected in scalar multiplication, the partial bit of random number k is obtained by analyzing, carries out n times error signature, generation Enter to sign result s=(1+dA)-1(k-rdA) in mod n, an equation group can be generated, the d of private key is can determine that using lattice attackA Value.
Lattice are m dimension real number spaces RmDiscrete subgroup L, its element β ∈ L are N number of linearly independent vector αi∈L(i∈{0, 1 ..., N-1 }) linear combination,ai∈ Z, Z are integer field, then α0,…,αN-1For Lattice L one group of base, B=[α0,…,αN-1]TFor basic matrix.
Two famous double linear problems of difficulty for solving, respectively minimum Vector Problem (SVP) and nearest Vector Problem in lattice be present (CVP)。
SVP：Known lattice L one group of base B, its most short non-vanishing vector v ∈ L is found in lattice so that | | v | |=min | | u | | | u ∈ L }, wherein | | | | it is two norms, the problem can determine v approximate solution by LLL algorithms.
CVP:Known lattice L one group of base B, any vectorial u ∈ Rm, the vector v ∈ L nearest away from u is found in lattice, is met | | V-u | |=min | | t-u | | | t ∈ L }.CVP can obtain its approximate solution by LLL algorithms and Babai algorithms in polynomial time.
If implementing lattice attack to SM2 signature algorithms, number problem (HNP) is hidden with regard to needing to change into first.If ti∈ZnBe with Machine is equally distributed, i ∈ { 1,2 ..., N }, ui∈Zn, 0 ＜ l ＜ log2N, find a α ∈ Zn, make its satisfaction | α ti-ui|n≤ n/2l, wherein | x |n=min | x-bn | | x ∈ Zn, b ∈ Z }, above-mentioned is HNP.In fact, above-mentioned inequality is equivalent to | α ti- ui+hin|≤n/2l, wherein hiIt is so that the minimum value that above-mentioned inequality is set up.
HNP can change into the CVP in lattice, structure (N+1) dimension lattice L, then basal orientation moment matrix is
Make object vector u=(u1,u2,…,uN, 0), x=(h1,h2,…,hN,dA), then v=xM is vectorial in lattice L, and v =(α t1+nh1,…,αtN+nhN,α/2l), it can be obtained by HNP inequality groupsFor CVP problems, ask Solution CVP can obtain v, and α value is can determine that by v.
For SM2 signature algorithms, if having carried out n times signature computing, pass through the wrong induction means such as electromagnetism, laser There is mistake in signature computing each time, so as to get random number k respectivelyiMinimum l positions bit value ai, i ∈ { 1,2 ..., N }, And obtain the signature result (r of mistakei,si), corresponding HNP can be constructed.Make ki=bi2l+ai, wherein bi＜ n/2lFor unknown-value. By kiThe 6th step s=(1+d substituted into signatureA)-1(k-rdA) mod n can obtain following formula：
2-l(si+ri)dA-2-l(ai-si)=bi mod n
Make ti=2-l(si+ri)mod n、ui=2-l(ai-si) mod n, so as to：
|tidA+hin-ui| ＜ n/2l
Wherein, hiIt is so that the minimum value that above-mentioned inequality is set up.
Above formula is HNP problems, converts thereof into CVP, can solve to obtain dAValue.For the signature algorithm of m positions, at present If the l bits for thering is document to prove known k, need the signature of m/l bar mistakes, you can obtain correct dA.SM2 such as 256 Signature algorithm, if known k 8 bits, 32 signatures are typically about needed successfully to obtain private key, this is very in actual experiment Feasible.
Attacked compared to weaker curve and directly to the fault analysis of private key, the fault analysis arithmetic speed based on lattice is fast, mould Type is simple, has become the Main Means for examining ECC signature algorithm securities.At present to fault analysis of the signature algorithm based on lattice The error injection mode of method predominantly ignores some points times and point add operation in scalar multiplication, and this method is to wrong class Type, mistake are higher to injection length and status requirement, therefore, it is relatively low to error injection precise requirements based on lattice to need some badly The fault analysis method of attack is come the security that reappraises and define algorithm.
Traditional ECC difference fault analysis is, it is necessary to two for binary system scalar multiplication computing kG in ECC AESs Secondary input value identical computing, once-through operation are correctly obtained Q, another median Q to the i-th wheel iterationi=[(ki-1,..., k0)2] P coordinate values storage region injection single-bit error obtain Qi', complete to mark followed by " pseudo-addition " and " pseudo- multiplication " Amount multiplication obtain error result Q '=(... ((Qi′+ki2iG)+ki+12i+1G)+...)+km-12m-1G.Attacker passes through conjecture (km-1,...,ki)2Possibility be worth toGuess that the position of bit-errors obtains againPush away Calculate error resultIf the error result calculatedWith it is true Real error result Q' is consistent, then what explanation was guessed is correct, i.e., attacker successfully recovers scalar k high-order successive bits.
But in SM2 signs computing, random number k is arbitrarily chosen, and can not possibly substantially occur inputting the deutero-albumose of identical two Measure multiplication.In addition, scalar multiplication result Q' whole coordinates can not be recovered using signature result.But because bit-errors can pass through Laser irradiation memory block obtains, and it is small that the mistake than ignoring some points times and point add operation obtains difficulty, it is possible to it is poor to improve ECC Misclassification misses, and it is applied to the situation that signature algorithm and multi-bit errors inject, and can attack and be applied in combination with dative.
The content of the invention
In order to improve examine and assess SM2 signature algorithms whether the efficiency of safety, the present invention proposes a kind of based on improving The SM2 signature algorithm security verification methods of difference fault analysis.The safety that this method passes through difference fault analysis check algorithm Property, the requirement to ill-formalness is relatively low, as long as injection mistake causes the median of certain wheel iteration in scalar multiplication to occur to be less than certain The bit-errors of threshold value, then without knowing which specific bit makes a mistake, and any bit value of unknown random number, still may be used Lattice attack is carried out to algorithm and obtains private key dA.Whole fault analysis method (as shown in Figure 5) includes three parts altogether, and 1) in SM2 label Name scalar multiplication i-th, which takes turns iteration injection mistake, makes the partial bit value of median y-coordinate change (in SM2 DSSs Recommendation curve on, scalar multiplication computing carry out 256 wheel, inverse the 10th wheel nearby injection mistake.To other curves, if iteration Wheel number is n, then suggests injecting mistake close to a certain wheel before inverse log n wheels.)；2) it is extensive using error signature result The consecutive bit values for random number k of appearing again；3) consecutive bit values and error signature result the construction HNP recovered using step 2 is asked Topic, goes out private key using lattice attack analysis, if consistent with correct private key, judges that current signature algorithm is dangerous.It is specific as follows：
1) taking turns iteration injection mistake in SM2 signature scalars multiplication i-th changes the partial bit value of median y-coordinate. In the intelligent card chip that one realizes SM2 signature algorithms, message is inputted, carries out signature computing, its chips need to be to random Number k=(km-1,…,k1,k0)2The elliptic curve basic point G of ∈ [1, n-1] and SM2 signature algorithms carries out scalar multiplication computing kG, base Point G rank is n.In binary system scalar multiplication computing from right to left, chip k in sequence0,k1,…,km-1Carry out one by one a little Again, point add operation, because there is Point Double Operation in each round iteration, therefore it can infer certain for the moment by counting a point times energy mark The iteration wheel number at quarter.In addition, point under affine coordinate system times, point add operation calculate the x of median successively, y-coordinate, as long as therefore As soon as wheel iteration will at the end of to the memory of y-coordinate using laser injection mistake, median y-coordinate partial bit can be made Change, the bit number Δ y of change (the threshold in known threshold value N can be controlled by weakening laser exposure intensity or irradiation time The upper bound of value can be derived by probability and be obtained, and threshold value is smaller then higher to the success rate of current signature algorithm attack.It is recommended that use Threshold value less than 32), the energy mark of collection is checked after attack can filter out the satisfactory signature of injection length.Therefore marking Measure the median using laser to the i-th wheel iteration in multiplicationY-coordinate memory block Mistake is injected in domain, obtains wrong medianThe bit number Δ y ＜ N of change.Continue computing, obtain the mark of mistake Measure multiplication resultAnd obtain error signature (r,s)。
2) consecutive bit values of random number k are recovered using error signature result.The signature of known error As a result (r, s), A public key P is utilizedAThe correct result of scalar multiplication computing can be recovered with message Hash Value eAnd error resultAbscissaIfThenAlso it is candidate's abscissa, wherein p is elliptic curve modulus, is public data. Guess random-number portion successive bits k(i)=(km-1,…,ki)2Probable valueScope is [0,2m-i- 1], and calculate with The unimplanted wrong median of corresponding i-th wheelWillIn all bitsIt is converted into PointAfterwards, wherein t ∈ [i, m-1], according to binary system scalar multiplication algorithm from right to left, with the centre of the i-th wheel mistake Value, will for initial pointF is carried out successively according to the orders of t from small to largep" pseudo-addition " computing under the affine coordinate system of domain, Obtain equationCaused by after injection mistake Abscissa, the candidate's abscissa of error resultIt is represented by wrong median coordinateIn FpUnitary high order on domain Multinomial, bring intoPolynomial equation is solved to obtainBy taking i=m-1 as an example, to conjecture valueCarry out " pseudo- to add Method " computingIfSo exist on unknown numberQuadratic equation with one unknownSolve equation to obtain one or twoSolution.If in the presence ofMake Hamming distance Function meetsThen determineFor k(i), otherwise guess againIt is if allDo not comply with requirement, Then give up the signature.
3) HNP problems are constructed, private key is gone out using lattice attack analysis.The signature result (r, s) of known error and random number k Continuous high order bit k(i), then random number is represented by k=k(i)2i+k(i), wherein k(i)For remaining known bits, s can be obtained =(1+dA)-1(k-rdA)mod n.By k(i)Bring into, (r+s) d can be obtainedA+s-k(i)2i=k(i)mod n.By | k(i)| ＜ 2i, can structure Make HNP problems：|(r+s)dA+s-k(i)2i+ nh | ＜ 2i, wherein h is the minimum positive number for setting up inequality.In H different messages Signature computing injection mistake, attacker obtain H mistake signature result, recover correspondence k(i)Afterwards, H data can be constructed Hide problem (HNP problems).H HNP problem is converted into CVP problems, using LLL (A.K.Lenstra, H.W.Lenstra, Jr.and L.Lovász,Factoring polynomials with rational coefficients, Mathematische Ann., Vol.261 (1982) pp.513-534) and Babai algorithms (L.Babai, OnLov á szlatticereductionandthe nearestlatticepointproblem,Combinatorica,Vol.6(1986) Pp.1-13.) solve, analyze private key dA.If the private key d analyzedACorrectly, then from the perspective of algorithm security, SM2 label Name algorithm is unsafe.
Compared to the prior art, the present invention has following advantage：
1. the present invention innovatively proposes a kind of difference fault analysis security verification method based on lattice, the present invention is used The new method of proposition can be easier injection mistake, more comprehensively analyze the security capabilities of SM2 signature algorithms resistance attack；
2. the present invention is different from the attack method based on lattice in the past, former lattice attack method requirement injection ignore a little again, The mistake of point add operation is very high to attacker's Prerequisite and horizontal requirement.And present invention only requires fast in each round iteration At the end of mistake is injected to median y-coordinate storage region, low is required to attack time precision, and can be examined by energy mark Look into whether the attack moment meets the requirements；
3. the present invention is different from the wrong method based on difference in the past, the requirement of former difference fault analysis method is as far as possible Single bit number is set to make a mistake, to ensure that scalar bit recovers to have feasible complexity.And the present invention is then hardly by mistake Bit number constrains, and can be removed in the case of error bit number is more than threshold value with Automatic sieve.For bit length be 256 with Machine number, as long as being made a mistake less than 32 bits, it is possible to recover random-number portion bit with high probability, this improvement is non- Often be advantageous to error injection experiment；
4. the present invention is different from the wrong method based on difference in the past, former difference fault analysis method is on ECC Encryption, it is necessary to input the complete scalar multiplication result of identical.And the present invention only needs a signature in random number Restoration stage, And do not know the y-coordinate of wrong scalar multiplication result, this improvement matches with SM2 signature algorithms.
Brief description of the drawings
Fig. 1 is that Point on Elliptic Curve adds computing geometric representation figure；
Fig. 2 is Point on Elliptic Curve times computing geometric representation figure；
Fig. 3 is SM2 signature product process figures；
Fig. 4 is SM2 sign test flow charts；
Fig. 5 is the attack flow chart to SM2 signature algorithms in the present invention.
Embodiment
The present invention will be further described in detail with an example below in conjunction with the accompanying drawings, but does not limit this in any way The scope of invention.In embodiment, by the experiment for carrying out lattice attack to SM2 signature algorithms in the fault analysis method of the present invention Exemplified by illustrate effectiveness of the invention.
1) taking turns iteration injection mistake in SM2 signature scalars multiplication i-th changes the partial bit value of median y-coordinate. SM2 (F are realized at onep- 256) signed in 32 chips of signature algorithm, in binary system scalar multiplication from right to left 248 wheel Point Double Operations of method iteration close to an end the moment and (the energy mark of mistake can be injected into by checking, filters out and meets mistake Inject the signature of moment requirement), to storing wheel Point Double Operation result Q248Y-coordinate where chip area injection mistake, can Obtain wrong median Q '248, meetContinue computing, obtain the scalar multiplication knot of mistake Fruit Q '256=(... (Q '248+k2482248G)+...)+k2552255G, and obtain error signature (r, s).
2) consecutive bit values of random number k are recovered using error signature result.Utilize public key PAIt is extensive with message Hash Value e The correct result Q of multiple scalar multiplication256=(es-1mod n)G+(rs-1mod n)PA, and error result Q '256AbscissaIf (Also it is abscissa).Guess random-number portion Bit k(248)=(k255,....,k248)2Probable valueThe 248th correct median of wheel corresponding to calculatingByIn FpUnder the affine coordinate system of domain " pseudo-addition " operational criterion handleBe expressed as onUnitary high-order moment, solve equation obtainIfThenOtherwise guess again(through calculating, the conjecture for mistakeMakeProbability be almost 0).It is if allRequirement is not complyed with, then gives up the signature.
3) HNP problems are constructed, private key is gone out using lattice attack analysis.Construct HNP problems：|(r+s)dA+s-k(248)2248+nh| ＜ 2248.Said process is repeated to multiple SM2 signature computings, construction at least 38 HNP problems carry out lattice attack, obtain private key.
4) it is whether correct according to obtained private key, verify the security of current signature algorithm.
The specific embodiment of detailed description above has been used for the purpose of to understand what the present invention used more preferable, and the present invention is not This is confined to, persons skilled in the art can be according to the disclosure, using other numerous embodiments come real The present invention is applied, it is every using design structure and thinking of the invention, the conversion of right and replacement are not being departed from, all Belong to protection scope of the present invention.

Claims (7)

  1. It is 1. a kind of based on the SM2 signature algorithm security verification methods for improving difference fault analysis, it is characterised in that methods described Including step：
    1) message M is signed using SM2 signature algorithms, when the random number k of generation and the elliptic curve base of SM2 signature algorithms Point G scalar multiplication iteration injects mistake when proceeding to the i-th wheel, changes the partial bit value of the i-th wheel median y-coordinate；
    2) the signature result obtained using step 1), and sign test public key PAThe continuous of random number k is recovered with message M Hash Values e Bit value；
    3) number problem is hidden using the consecutive bit values and error signature result construction, private key is gone out using lattice attack analysis, so Judge whether current SM2 signature algorithms are safe according to the private key afterwards.
  2. 2. the method as described in claim 1, it is characterised in that the i-th wheel iteration injection mistake, sit the i-th wheel median y Target partial bit value change method be：
    1) SM2 signature algorithms carry out scalar multiplication iteration fortune to the random number k of generation and the elliptic curve basic point G of SM2 signature algorithms Calculate kG；Wherein, k=(km-1,…,k1,k0)2∈ [1, n-1], n are basic point G rank, and m is the bit length of random number k；
    2) rule of thumb the i-th wheel iteration of energy mark estimation setting goes out current moment in current SM2 signs computing, the of estimation I wheels iteration will at the end of mistake is injected to the memory of median y-coordinate, make the partial bit value changes of median y-coordinate； Continue interative computation, obtain final signature result；The error injection moment of present energy mark is checked, if error injection is I wheel iteration will at the end of, then retain the signature, otherwise give up the signature.
  3. 3. method as claimed in claim 2, it is characterised in that irradiate the memory using laser and realize injection mistake；It is logical Cross adjustment laser exposure intensity or irradiation time so that bit number Δ y the ＜ N, N of change are the threshold value of setting.
  4. 4. method as claimed in claim 3, it is characterised in that the threshold value N is less than 32.
  5. 5. method as claimed in claim 2 or claim 3, it is characterised in that the method for the consecutive bit values for recovering random number k For：
    1) first with the signature result, public key PAThe correct result of scalar multiplication computing is recovered with message M Hash Values e, and The abscissa of caused wrong scalar multiplication result after injection mistake；
    2) set random number k part successive bits probable value asCalculate withThe unimplanted wrong median of corresponding i-th wheel；
    3) willIn all bitsIt is converted into a littleAfterwards, wherein t ∈ [i, m-1]；According to binary system mark from right to left Multiplication rule is measured, will using the median of the i-th wheel mistake as initial pointPuppet is carried out successively according to the orders of t from small to large Add operation, then obtained according to the abscissa of caused wrong scalar multiplication result after the pseudo-addition operational formula and injection mistake To the wrong median coordinate of the i-th wheel iterationIf Hamming distance functionThen determineTo be described Consecutive bit values k(i), otherwise return to step 2) resetWherein,For in the i-th unimplanted wrong median of wheel Coordinate；It is if allRequirement is not complyed with, then gives up the signature.
  6. 6. method as claimed in claim 5, it is characterised in that the method for analyzing the private key is：Tied according to the signature Fruit and the consecutive bit values k determined(i)Construction hides number problem, is then converted into hiding several problems of construction recently Vector Problem, using based on lattice reductive algorithm and the solution of nearest Plat algorithm, analyze private key dA。
  7. 7. the method as described in claim 1, it is characterised in that injected in a certain wheel iteration before inverse logn wheels wrong By mistake, wherein, iteration wheel number is n.
CN201510239497.7A 2015-05-12 2015-05-12 Based on the SM2 signature algorithm security verification methods for improving difference fault analysis Active CN104836808B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201510239497.7A CN104836808B (en) 2015-05-12 2015-05-12 Based on the SM2 signature algorithm security verification methods for improving difference fault analysis

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201510239497.7A CN104836808B (en) 2015-05-12 2015-05-12 Based on the SM2 signature algorithm security verification methods for improving difference fault analysis

Publications (2)

Publication Number Publication Date
CN104836808A CN104836808A (en) 2015-08-12
CN104836808B true CN104836808B (en) 2017-12-15

Family

ID=53814444

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201510239497.7A Active CN104836808B (en) 2015-05-12 2015-05-12 Based on the SM2 signature algorithm security verification methods for improving difference fault analysis

Country Status (1)

Country Link
CN (1) CN104836808B (en)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106656459A (en) * 2016-11-17 2017-05-10 大唐微电子技术有限公司 Side channel energy analysis method and device for SM3-HMAC
CN106888088B (en) * 2017-03-29 2019-08-13 中国人民解放军信息工程大学 Elliptic curve cipher Fast implementation and its device
CN109921896A (en) * 2019-03-11 2019-06-21 郑州师范学院 A kind of label decryption method, system, equipment and computer readable storage medium
CN111835518B (en) * 2020-07-10 2024-02-23 中金金融认证中心有限公司 Error injection method and system in elliptic curve public key cryptographic algorithm security assessment
CN113037495B (en) * 2021-03-03 2022-05-24 中国科学院软件研究所 Safety evaluation method of elliptic curve signature algorithm
CN113381989B (en) * 2021-04-27 2022-06-28 中国科学院软件研究所 Protection capability verification method for laser injection attack

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101925875A (en) * 2008-01-23 2010-12-22 英赛康特雷斯公司 Countermeasure method and devices for asymmetric cryptography
CN102790673A (en) * 2011-05-17 2012-11-21 上海华虹集成电路有限责任公司 Method for resisting error attacks applicable for ECC (Error Correction Code) algorithm
CN103997402A (en) * 2014-05-30 2014-08-20 中国科学院深圳先进技术研究院 Encryption chip safety performance testing method and device

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR2862454A1 (en) * 2003-11-18 2005-05-20 Atmel Corp RANDOM MODULAR REDUCTION METHOD AND EQUIPMENT THEREFOR
KR20080012634A (en) * 2006-08-04 2008-02-12 삼성전자주식회사 Method and apparatus of adding points in binary finite field for implementation of fault detecting operation used in fast montgomery power ladder algorithm

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101925875A (en) * 2008-01-23 2010-12-22 英赛康特雷斯公司 Countermeasure method and devices for asymmetric cryptography
CN102790673A (en) * 2011-05-17 2012-11-21 上海华虹集成电路有限责任公司 Method for resisting error attacks applicable for ECC (Error Correction Code) algorithm
CN103997402A (en) * 2014-05-30 2014-08-20 中国科学院深圳先进技术研究院 Encryption chip safety performance testing method and device

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
Partially Known Nonces and Fault Injection Attacks on SM2 Signature Algorithm;mingjie liu et al;《Lecture Notes in Computer Science-Information Security and Cryptography.Springer International Publishing》;20141230;第343-358页 *
对称加密算法ＡＥＳ和ＤＥＳ的差分错误分析;孙维东等;《复旦学报（自然科学版）》;20130630;第297-302页 *

Also Published As

Publication number Publication date
CN104836808A (en) 2015-08-12

Similar Documents

Publication Publication Date Title
CN104836808B (en) Based on the SM2 signature algorithm security verification methods for improving difference fault analysis
CN104836670B (en) A kind of SM2 signature algorithm security verification method unknown based on random number
CN104852805B (en) A kind of SM2 signature algorithm means of defence for resisting the fault analysis based on lattice
EP3069249B1 (en) Authenticatable device
CN103414569B (en) A kind of method of the public key cryptography setting up attack resistance
Yan Quantum attacks on public-key cryptosystems
CN105991292A (en) Systems and methods for operating secure elliptic curve cryptosystems
US20110274271A1 (en) Countermeasure method and devices for asymmetric encryption
US20110170685A1 (en) Countermeasure method and devices for asymmetric encryption with signature scheme
Campos et al. Trouble at the CSIDH: protecting CSIDH with dummy-operations against fault injection attacks
Ngo et al. Side-channel attacks on lattice-based KEMs are not prevented by higher-order masking
Barenghi et al. A novel fault attack against ECDSA
CN112887096B (en) Prime order elliptic curve generation method and system for signature and key exchange
Mathew et al. On the design of different concurrent EDC schemes for s-box and gf (p)
Le et al. On double exponentiation for securing RSA against fault analysis
Бессалов et al. Randomization of CSIDH algorithm on quadratic and twisted Edwards curves
Kim et al. Bit-flip faults on elliptic curve base fields, revisited
Wang et al. Single-Trace Side-Channel Attacks on CRYSTALS-Dilithium: Myth or Reality?
Barenghi et al. Fault attack to the elliptic curve digital signature algorithm with multiple bit faults
Jager Black-Box Models of Computation
CN113037495B (en) Safety evaluation method of elliptic curve signature algorithm
CN102902897A (en) Infinity point attack resisting method applicable to ECC (elliptic curve cryptography) point multiplication algorithm
Kara-Ivaniov et al. Attacks on authentication and signature schemes involving corruption of public key (modulus)
Jyotiyana et al. Fault attack for scalar multiplication over finite field (E (F q)) on Elliptic Curve Digital Signature Algorithm
Nofriansyah et al. Efficiency of 128-bit Encryption and Decryption Process in Elgamal Method Using Elliptic Curve Cryptography (ECC)

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
EXSB Decision made by sipo to initiate substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant