WO2016019670A1

WO2016019670A1 - Anti-attack encryption and decryption method and device of block cipher

Info

Publication number: WO2016019670A1
Application number: PCT/CN2014/093472
Authority: WO
Inventors: 赵东艳; 杜新纲; 于艳艳; 胡晓波; 李娜; 甘杰
Original assignee: 国家电网公司; 北京南瑞智芯微电子科技有限公司
Priority date: 2014-08-06
Filing date: 2014-12-10
Publication date: 2016-02-11
Also published as: CN105376046B; CN105376046A

Abstract

Disclosed are an anti-attack encryption and decryption method and device of a block cipher, the encryption method comprising: receiving a plaintext P requiring encryption, conducting normal encryption calculations on the plaintext P twice, and outputting a correct encryption result for input into an F function; when conducting the normal encryption calculations, inserting a fault during the normal encryption calculation process once or twice, and outputting a wrong encryption result; and after inputting the wrong encryption result into the F function, outputting an invalid result unusable by an attacker. An embodiment of the present invention is inserted with the fault during a first and/or second normal encryption calculations, and inputs into the F function two output encryption results, eliminating the step of comparing the two normal encryption calculation results, and the F function outputs the invalid result unusable by the attacker, thus effectively resisting a double-point attack on a block cipher algorithm, and improving the security of the encryption process of the block cipher algorithm.

Description

Method and device for encrypting and decrypting block cipher against attack

Technical field

The present invention relates to the technical field of information security in the communication field, in particular to a method and device for encryption and decryption of block ciphers against attacks.

Background technique

With the development of computer and communication technology, users have increasingly strong demands for the safe storage, safe processing and safe transmission of information. In particular, with the widespread use of the Internet, information security issues become more and more important. One of the effective means to solve the above-mentioned problems is to use modern cryptographic technology, and various cryptographic algorithms continue to appear. Block cipher algorithm is one of the most commonly used encryption methods. Block cipher algorithm has the characteristics of fast speed, easy standardization and easy implementation of software and hardware. It is usually the core cipher algorithm for data encryption, message authentication and authentication in information security. At present, the more popular block cipher algorithms include DES algorithm, AES algorithm and so on.

As the issue of information security has received increasing attention from people, various analysis and attack methods of cryptographic algorithms have continued to appear. Fault attack is a powerful attack method that has emerged in recent years. Its basic principle is to place the cryptographic chip in a strong magnetic field, or change the power supply voltage, operating frequency, temperature, etc. of the chip, so that the registers and memory in the cryptographic chip generate random errors during the encryption and decryption process, and some output bits are changed from the original The 0 becomes 1 or 1 becomes 0. By comparing the difference between the correct password output and the wrong password output, after theoretical analysis, the password data information inside the chip can be obtained.

Common methods for preventing failure attacks in block ciphers include: performing multiple operations on the same data and comparing the results of multiple operations to see if the results are consistent; after performing normal operations on certain data, perform inverse operations on the results of the operations, and compare the results of the inverse operations with the original input Whether the data is consistent.

As shown in Figure 1, if the attacker injects a fault during the first normal operation of the plaintext P, then the output result C of the first normal operation is the wrong result. When the second normal operation is performed on the plaintext P The output result C'is the correct result, at this time C≠C'; then the result C is compared with the result C', that is, it is determined whether C and C'are equal, and the fault is injected again when the result is compared. Injection, there is a possibility of attacking "C≠C'" into "C=C'". If the injection fault attacks "C≠C'" into "C=C'", the comparison result is output as the wrong result C. The attacker obtains the erroneous result C, plus the correct result C'obtained before, to obtain useful fault information, thereby obtaining sensitive information. To

Similarly, if the attacker does not inject a fault during the first normal operation of the plaintext P, and injects a fault during the second normal operation of the plaintext P, similar to the above situation, the attacker can still obtain the wrong result C', With the addition of the correct result C that has been obtained before, useful fault information can be obtained, and thus sensitive information can be obtained.

Summary of the invention

The present invention is to overcome the defect of low security of block cipher in preventing attacks in the prior art. According to one aspect of the present invention, a block cipher anti-attack encryption method is proposed.

The encryption method for block cipher attack prevention according to the embodiment of the present invention includes:

Receive the plaintext P to be encrypted, perform two normal encryption operations on the plaintext P, and output the encryption result for the input F function;

During the normal encryption operation, when the normal encryption operation process is injected into the fault once or twice, the wrong encryption result will be output;

When the wrong encryption result is input to the F function, the invalid result that the attacker cannot use is output; when the two normal encryption operations are not injected with faults, the F function outputs the correct encryption operation result.

The present invention is to overcome the defect of low security of block ciphers in preventing attacks in the prior art. According to another aspect of the present invention, an encryption device for block ciphers against attacks is proposed.

The block cipher anti-attack encryption device according to the embodiment of the present invention includes:

Encryption operation module, used to receive the plaintext P to be encrypted, perform two normal encryption operations on the plaintext P, and output the encryption result for the input F function;

The fault receiving module is used to receive the faults injected once or twice during the normal encryption operation during the normal encryption operation, and instruct the encryption operation module to output the wrong encryption result;

The result output module is used to output the invalid result that the attacker cannot use after the wrong encryption result is input into the F function; when the two normal encryption operations are not injected with faults, the correct encryption operation result is output.

The embodiment of the invention discloses a block cipher anti-attack encryption method and device, which are injected with faults during the first and/or second normal encryption operation, and the encryption result output by the first normal encryption operation is compared with The encryption result output by the second normal encryption operation is input into the F function, which reduces the steps of comparing the results of the two normal encryption operations. Finally, the F function outputs invalid results that cannot be used by the attacker, effectively resisting block ciphers. The double-point attack of the algorithm improves the security of the encryption process of the block cipher algorithm. To

The present invention is to overcome the defect of low security of block cipher in preventing attacks in the prior art. According to one aspect of the present invention, a decryption method for block cipher to prevent attacks is proposed.

The decryption method for block cipher attack prevention according to the embodiment of the present invention includes:

Receive the ciphertext P to be decrypted, perform two normal decryption operations on the ciphertext P, and output the decryption result for the input F function;

During the normal decryption operation, when the normal decryption operation process is injected into the fault once or twice, the wrong decryption result will be output;

When the wrong decryption result is input into the F function, the invalid result that the attacker cannot use is output; when the two normal decryption operations are not injected with faults, the F function outputs the correct decryption operation result.

The present invention is to overcome the defect of low security of block ciphers in preventing attacks in the prior art. According to one aspect of the present invention, a decryption device for block ciphers against attacks is proposed.

The decryption device for preventing block cipher attack according to the embodiment of the present invention includes:

The decryption operation module is used to receive the ciphertext P to be decrypted, perform two normal decryption operations on the ciphertext P, and output the decryption result for the input F function;

The fault receiving module is used to receive the faults injected once or twice during the normal decryption operation during the normal decryption operation, and instruct the decryption operation module to output the wrong decryption result;

The result output module is used to output an invalid result that cannot be used by the attacker after the wrong decryption result is input into the F function; when no fault is injected into the two normal decryption operations, the correct decryption operation result is output.

The embodiment of the present invention discloses a decryption method and device for preventing block ciphers from attacking. A fault is injected during the first and/or second normal decryption operation, and the decryption result output by the first normal decryption operation is compared with The decryption result output by the second normal decryption operation is input into the F function, which reduces the steps of comparing the results of the two normal decryption operations. Finally, the F function outputs invalid results that the attacker cannot use, effectively resisting block ciphers. The double-point attack of the algorithm improves the security of the decryption process of the block cipher algorithm.

Other features and advantages of the present invention will be described in the following description, and partly become obvious from the description, or understood by implementing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings.

The technical solutions of the present invention will be further described in detail below through the accompanying drawings and embodiments. To

Description of the drawings

The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention, and do not constitute a limitation to the present invention. In the attached picture:

FIG. 1 is a schematic diagram of the flow of the failure attack on the block cipher in the prior art;

2 is a flowchart of Embodiment 1 of an encryption method for preventing block cipher attacks according to the present invention;

FIG. 3 is a flowchart of Embodiment 2 of the encryption method for block cipher attack prevention according to the present invention;

4 is a flowchart of Embodiment 3 of an encryption method for preventing block cipher attacks according to the present invention;

FIG. 5 is a flowchart of Embodiment 4 of an encryption method for preventing block cipher attacks according to the present invention;

6 is a flowchart of Embodiment 1 of the decryption method for preventing block cipher attacks according to the present invention;

FIG. 7 is a flowchart of Embodiment 2 of the decryption method for preventing block cipher attacks according to the present invention;

FIG. 8 is a flowchart of Embodiment 3 of the decryption method for preventing the block cipher from attacking according to the present invention;

9 is a flowchart of Embodiment 4 of the decryption method for block cipher anti-attack according to the present invention;

10 is a structural diagram of an embodiment of an encryption device for preventing block cipher attacks according to the present invention;

Fig. 11 is a structural diagram of an embodiment of a decryption device for preventing block cipher attacks according to the present invention.

Detailed ways

The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings, but it should be understood that the protection scope of the present invention is not limited by the specific embodiments.

The inventor of the present invention found in the analysis and research of the above-mentioned prior art that in the process of running a block cipher algorithm for encryption or decryption, if a faulty injection is detected, the chip should not output the wrong calculation result, otherwise the attacker can use it. Incorrect calculation results are used for differential fault attacks. The embodiment of the present invention provides a block cipher anti-attack method. When a fault is injected in the operation process, an incorrect operation result is not output, but an invalid result that cannot be used by an attacker is output.

If the fault is not injected into the first normal operation and the fault is injected into the second normal operation, the invalid result is the correct first normal operation result C and the wrong second normal operation result C'(that is, the second error encryption Result) The result of the operation processed by a certain F function.

If the fault is injected into the first normal operation, and the fault is not injected into the second normal operation, the invalid result is the wrong first normal operation result C (that is, the first wrong encryption result) and correct To The second normal operation result C'is the result of the operation after being processed by a certain F function.

If a fault is injected into the first normal operation and a fault is injected into the second normal operation, the invalid result is the wrong first normal operation result C (that is, the first wrong encryption result) and the wrong second normal operation result C'(that is, the second wrong encryption result) is the result of the operation after being processed by a certain F function.

As shown in Figure 2, the embodiment of the present invention discloses a block cipher anti-attack encryption method, including:

Step 201: The plaintext P is input into the encryption module, and the first normal encryption operation is performed. At the same time, the fault is injected into this step, so the output is the wrong encryption result C;

Step 203: The same plaintext P is input into the encryption module again, and the second normal encryption operation is performed, and the output is the correct encryption result C';

Step 205: Input the wrong encryption result C in step 201 and the correct encryption result C'in step 203 into the F function, and the output of this function is Y; the input of the F function contains the wrong encryption result C, so the output operation result is an attack Invalid results that cannot be used by the person;

For different grouping algorithms, the expression of the F function is different.

Taking the DES algorithm as an example, the encryption result C consists of two parts L and R, and the encryption result C'consists of two parts L'and R', namely C=L||R, C'=L'||R', then The F function can be defined as:

F(C,C’)=C’⊕L⊕L’⊕R⊕R’

In step 205, the F function may or may not be injected into the fault. Due to the existence of the above-mentioned F function, no matter whether a fault is injected or not, the operation result output by the above-mentioned F function is an invalid result that cannot be used by an attacker.

Step 207: Perform an encryption operation on the plaintext P, and output an invalid result Y that the attacker cannot use.

The embodiment of Figure 2 discloses a block cipher anti-attack encryption method. A fault is injected during the first normal encryption operation, and the error encryption result output by the first normal encryption operation and the second time The correct encryption result output by the normal encryption operation is input into the F function, which reduces the steps of comparing the results of the two normal encryption operations. Finally, the F function outputs invalid results that cannot be used by the attacker, effectively resisting the block cipher algorithm. The double-point attack improves the security of the encryption process of the block cipher algorithm. To

As shown in Figure 3, the embodiment of the present invention discloses another block cipher anti-attack encryption method, including:

Step 301: The plaintext P is input into the encryption module, and the first normal encryption operation is performed, and the output is the correct encryption result C;

Step 303: The same plaintext P is input into the encryption module again, and the second normal encryption operation is performed. At the same time, a fault is injected into this step, so the output is the wrong encryption result C';

Step 305: Input the correct encryption result C in step 301 and the incorrect encryption result C'in step 303 into the F function, and the output of this function is Y; the input of the F function contains the incorrect encryption result C', so the output operation result is Invalid results that cannot be exploited by the attacker;

F(C,C’)=C’⊕L⊕L’⊕R⊕R’

In step 305, the F function may or may not be injected into a fault. Due to the existence of the above-mentioned F function, no matter whether a fault is injected or not, the operation result output by the above-mentioned F function is an invalid result that an attacker cannot use.

Step 307: Perform an encryption operation on the plaintext P, and output an invalid result Y that the attacker cannot use.

The embodiment of Figure 3 discloses a block cipher anti-attack encryption method. A fault is injected during the second normal encryption operation, and the wrong encryption result output by the second normal encryption operation in which the fault is injected is compared with that of the first normal encryption operation. The correct encryption result output by the normal encryption operation is input into the F function, which reduces the steps of comparing the results of the two normal encryption operations. Finally, the F function outputs invalid results that cannot be used by the attacker, effectively resisting the block cipher algorithm. The double-point attack improves the security of the encryption process of the block cipher algorithm.

As shown in Figure 4, the embodiment of the present invention discloses a third block cipher anti-attack encryption method, including:

Step 401: The plaintext P is input into the encryption module, and the first normal encryption operation is performed. At the same time, the fault is injected into this step, so the wrong encryption result C is output;

Step 403: The same plaintext P is input into the encryption module again, and the second normal encryption is performed To At the same time, the fault is injected into this step, so the output is also the wrong encryption result C’;

Step 405: Input the wrong encryption result C in step 401 and the wrong encryption result C'in step 403 into the F function, and the output of this function is Y; the input of the F function contains the wrong encryption results C and C', so the output operation The result is an invalid result that cannot be exploited by the attacker;

F(C,C’)=C’⊕L⊕L’⊕R⊕R’

In step 405, the F function may or may not be injected into a fault. Due to the existence of the above-mentioned F function, no matter whether a fault is injected or not, the operation result output by the above-mentioned F function is an invalid result that an attacker cannot use.

Step 407: Perform an encryption operation on the plaintext P, and output an invalid result Y that the attacker cannot use.

The embodiment of Fig. 4 discloses a third block cipher anti-attack encryption method. Faults are injected during the first and second normal encryption operations, and errors are injected into the output of the first normal encryption operation. The encryption result and the wrong encryption result output from the second normal encryption operation that is also injected with the fault are input into the F function, which reduces the steps of comparing the results of the two normal encryption operations, and finally the F function outputs the invalidity that cannot be exploited by the attacker. As a result, the double-point attack on the block cipher algorithm is effectively resisted, and the security of the encryption process of the block cipher algorithm is improved.

As shown in Figure 5, the embodiment of the present invention discloses a fourth block cipher anti-attack encryption method, including:

Step 501: The plaintext P is input into the encryption module, and the first normal encryption operation is performed, and the output is the correct encryption result C;

Step 503: The same plaintext P is input into the encryption module again, and the second normal encryption operation is performed, and the output is also the correct encryption result C';

Step 505: Input the correct encryption result C in step 501 and the correct encryption result C'in step 503 into the F function, and the output of the function is Y; the input of the F function is the correct encryption result, so the output operation result is correct The result of encryption operation;

In step 505, the F function may or may not be injected into a fault. Such as To If the F function is not injected with a fault, the operation result output by the F function is the correct encryption operation result. If the F function is injected with a fault, as in the above embodiment, the F function will also output an invalid result that cannot be used by an attacker.

Step 507: Perform an encryption operation on the plaintext P, and output a correct encryption operation result.

The embodiment of Figure 5 discloses a block cipher anti-attack encryption method. No fault is injected during two normal encryption operations, and the correct encryption results of the two normal encryption operations are input into the F function, which is determined by the F function. Output the correct encryption operation result, effectively resist the double-point attack on the block cipher algorithm, and improve the security of the encryption process of the block cipher algorithm.

As shown in Figure 6, an embodiment of the present invention discloses a decryption method for block cipher attack prevention, including:

Step 601: The ciphertext P is input into the decryption module, and the first normal decryption operation is performed. At the same time, the fault is injected into this step, so the wrong decryption result C is output;

Step 603: The same ciphertext P is input into the decryption module again, and the second normal decryption operation is performed, and the output is the correct decryption result C';

Step 605: Input the wrong decryption result C in step 601 and the correct decryption result C'in step 603 into the F function, and the output of this function is Y; the input of the F function contains the wrong decryption result C, so the output operation result is an attack Invalid results that cannot be used by the person;

Taking the DES algorithm as an example, the decryption result C consists of two parts L and R, and the decryption result C'consists of two parts L'and R', namely C=L||R, C'=L'||R', then The F function can be defined as:

F(C,C’)=C’⊕L⊕L’⊕R⊕R’

In step 605, the F function may or may not be injected into the fault. Due to the existence of the above-mentioned F function, no matter whether a fault is injected or not, the operation result output by the above-mentioned F function is an invalid result that cannot be used by an attacker.

Step 607: Perform a decryption operation on the ciphertext P, and output an invalid result Y that the attacker cannot use.

The embodiment of Fig. 6 discloses a decryption method for block ciphers against attacks. A fault is injected during the first normal decryption operation, and the error decryption result output by the first normal decryption operation and the second decryption result of the injected fault are compared with the second normal decryption operation. The correct decryption result output by the normal decryption operation is input to the F function To It reduces the steps of comparing the results of two normal decryption operations. Finally, the F function outputs invalid results that cannot be used by the attacker. This effectively resists the double-point attack on the block cipher algorithm and improves the decryption process of the block cipher algorithm. safety.

As shown in Figure 7, the embodiment of the present invention discloses another method for decrypting block ciphers against attacks, including:

Step 701: The ciphertext P is input into the decryption module, the first normal decryption operation is performed, and the correct decryption result C is output;

Step 703: The same ciphertext P is input into the decryption module again, and the second normal decryption operation is performed. At the same time, a fault is injected into this step, so the wrong decryption result C'is output;

Step 705: Input the correct decryption result C in step 701 and the incorrect decryption result C'in step 703 into the F function, and the output of this function is Y; the input of the F function contains the wrong decryption result C', so the output operation result is Invalid results that cannot be exploited by the attacker;

F(C,C’)=C’⊕L⊕L’⊕R⊕R’

In step 705, the F function may or may not be injected into a fault. Due to the existence of the above-mentioned F function, no matter whether a fault is injected or not, the operation result output by the above-mentioned F function is an invalid result that cannot be used by an attacker.

Step 707: Perform a decryption operation on the ciphertext P, and output an invalid result Y that the attacker cannot use.

The embodiment of FIG. 7 discloses a decryption method for block cipher attack prevention. A fault is injected during the second normal decryption operation, and the error decryption result output by the second normal decryption operation of the injected fault is compared with the first normal decryption operation. The correct decryption result output by the normal decryption operation is input into the F function, which reduces the steps of comparing the results of the two normal decryption operations. Finally, the F function outputs invalid results that the attacker cannot use, effectively resisting the block cipher algorithm. The double-point attack improves the security of the decryption process of the block cipher algorithm.

As shown in Figure 8, the embodiment of the present invention discloses a third method for decrypting block ciphers against attacks, including: To

Step 801: The ciphertext P is input into the decryption module, and the first normal decryption operation is performed. At the same time, the fault is injected into this step, so the output is the wrong decryption result C;

Step 803: The same ciphertext P is input into the decryption module again, and the second normal decryption operation is performed. At the same time, a fault is injected into this step, so the wrong decryption result C'is output;

Step 805: Input the wrong decryption result C in step 801 and the wrong decryption result C in step 803 into the F function, and the output of this function is Y; the input of the F function contains the wrong decryption results C and C', so the output operation The result is an invalid result that cannot be exploited by the attacker;

F(C,C’)=C’⊕L⊕L’⊕R⊕R’

In step 805, the F function may or may not be injected into the fault. Due to the existence of the above-mentioned F function, no matter whether a fault is injected or not, the operation result output by the above-mentioned F function is an invalid result that cannot be used by an attacker.

Step 807: Perform a decryption operation on the plaintext P, and output an invalid result Y that the attacker cannot use.

The embodiment of Figure 8 discloses a third block cipher anti-attack decryption method. Faults are injected during the first and second normal decryption operations, and errors are injected into the first normal decryption operation. The decryption result and the wrong decryption result output from the second normal decryption operation that is also injected into the fault are input into the F function, which reduces the steps of comparing the results of the two normal decryption operations. Finally, the F function outputs the invalidity that the attacker cannot use. As a result, the double-point attack on the block cipher algorithm is effectively resisted, and the security of the decryption process of the block cipher algorithm is improved.

As shown in Figure 9, the embodiment of the present invention discloses a fourth block cipher anti-attack decryption method, including:

Step 901: The ciphertext P is input into the decryption module, and the first normal decryption operation is performed, and the correct decryption result C is output;

Step 903: The same ciphertext P is input into the decryption module again, and the second normal decryption operation is performed, and the output is also the correct decryption result C';

Step 905: Decrypt the correct decryption result C in step 901 and the correct decryption in step 903 To Result C’ inputs the F function, and the output of the function is Y; the input of the F function is the correct decryption result, so the output operation result is the correct decryption operation result;

F(C,C’)=C’⊕L⊕L’⊕R⊕R’

In step 905, the F function may or may not be injected into a fault. If the F function is not injected with a fault, the operation result output by the F function is the correct decryption operation result. If the F function is injected with a fault, as in the above embodiment, the F function will also output an invalid result that the attacker cannot use.

Step 907: Perform a decryption operation on the ciphertext P, and output a correct decryption operation result.

The embodiment of Fig. 9 discloses a decryption method for block ciphers against attacks. No fault is injected during two normal decryption operations, and the correct decryption results of the two normal decryption operations are input into the F function, which is determined by the F function. Output the correct decryption operation result, effectively resist the double-point attack on the block cipher algorithm, and improve the security of the decryption process of the block cipher algorithm.

As shown in Figure 10, a block cipher anti-attack encryption device is disclosed, including:

The encryption operation module 10 is used to receive the plaintext P to be encrypted, perform two normal encryption operations on the plaintext P, and output the correct encryption result;

The fault receiving module 20 is used to receive the faults injected once or twice during the normal encryption operation during the normal encryption operation, and instruct the encryption operation module 10 to output the wrong encryption result;

The result output module 30 is used to output an invalid result that cannot be used by an attacker after the wrong encryption result is input into the F function; when no fault is injected into the two normal encryption operation processes, output the correct encryption operation result.

Among them: in the two normal encryption operations of the encryption operation module 10, the encryption result of the first normal encryption operation is C, and the encryption result of the second normal encryption operation is C'. C is composed of two parts, L and R, and C 'It is composed of two parts: L'and R', namely C=L||R, C'=L'||R', the F function in the result output module 30 is defined as: F(C,C')=C' ⊕L⊕L'⊕R⊕R'.

Wherein: the fault receiving module 20 is specifically used to receive the fault injected into the normal encryption operation for the first time when the plaintext P is subjected to the first normal encryption operation, and output the wrong encryption result; To

When the second normal encryption operation is performed on the plaintext P, the correct encryption result is output.

Wherein: the fault receiving module 20 is specifically used to output the correct encryption result when the plaintext P is subjected to the first normal encryption operation;

When the second normal encryption operation is performed on the plaintext P, the fault injected into this normal encryption operation is received, and the wrong encryption result is output.

Wherein: the fault receiving module 20 is also specifically used for,

When performing the first normal encryption operation on the plaintext P, receive the fault injected in this normal encryption operation, and output the wrong encryption result;

The embodiment of FIG. 10 discloses a block cipher anti-attack encryption device, which is injected with a fault during the first and/or second normal encryption operation, and combines the encryption result output by the first normal encryption operation with the second The encryption result output by the normal encryption operation is input into the F function, which reduces the steps of comparing the results of the two normal encryption operations. Finally, the F function outputs invalid results that cannot be used by the attacker, effectively resisting the block cipher algorithm. The double-point attack improves the security of the encryption process of the block cipher algorithm.

As shown in Figure 11, a decryption device for block cipher attack prevention is disclosed, including:

The decryption operation module 40 is used to receive the ciphertext P to be decrypted, perform two normal decryption operations on the ciphertext P, and output the correct decryption result;

The fault receiving module 50 is configured to receive the faults injected once or twice during the normal decryption operation during the normal decryption operation, and instruct the decryption operation module 40 to output the wrong decryption result;

The result output module 60 is used to output an invalid result that cannot be used by an attacker after the wrong decryption result is input into the F function; when no fault is injected into the two normal decryption operations, output the correct decryption operation result.

Among them: in the two normal decryption operations of the decryption operation module 40, the decryption result of the first normal decryption operation is C, and the decryption result of the second normal decryption operation is C'. C is composed of two parts, L and R, and C 'Consists of L'and R', namely C=L||R, C'=L'||R', the F function in the result output module 60 is defined as: F(C,C')=C' ⊕L⊕L'⊕R⊕R'.

Wherein: the fault receiving module 50 is specifically configured to receive the fault injected into the normal decryption operation this time when performing the first normal decryption operation on the ciphertext P, and output the wrong decryption result; To

When the second normal decryption operation is performed on the ciphertext P, the correct decryption result is output.

Wherein: the fault receiving module 50 is also specifically used to output the correct decryption result when performing the first normal decryption operation on the ciphertext P;

When the second normal decryption operation is performed on the ciphertext P, the fault injected into this normal decryption operation is received, and the wrong decryption result is output.

Wherein: the fault receiving module 50 is also specifically used to receive the fault injected into the normal decryption operation this time when performing the first normal decryption operation on the ciphertext P, and output the wrong decryption result;

The embodiment of Figure 11 discloses a block cipher anti-attack decryption device, which is injected with a fault during the first and/or second normal decryption operation, and combines the decryption result output from the first normal decryption operation with the second normal decryption operation. The decryption result output by the normal decryption operation is input into the F function, which reduces the steps of comparing the results of the two normal decryption operations. Finally, the F function outputs invalid results that cannot be used by the attacker, effectively resisting the block cipher algorithm. The double-point attack improves the security of the decryption process of the block cipher algorithm.

The present invention can have a variety of specific implementations in different forms. Above, the technical solutions of the present invention are illustrated by taking Figures 2-11 as examples in conjunction with the accompanying drawings. This does not mean that the specific examples applied by the present invention can only be limited to In a specific process or example structure, those of ordinary skill in the art should understand that the specific implementations provided above are just some examples of a variety of preferred usages, and any implementations that embody the claims of the present invention should be included in the present invention. Within the scope of protection required by the technical solution.

Finally, it should be noted that the above descriptions are only preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, it is still for those skilled in the art. The technical solutions described in the foregoing embodiments may be modified, or some of the technical features may be equivalently replaced. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention. To

Claims

A block cipher anti-attack encryption method, which is characterized in that it includes:

Receiving the plaintext P to be encrypted, performing two normal encryption operations on the plaintext P, and outputting the encryption result for the input F function;

When performing the normal encryption operation, when the normal encryption operation process is injected into a fault once or twice, output an error encryption result;

When the wrong encryption result is input into the F function, an invalid result that cannot be used by an attacker is output; when no fault is injected into the normal encryption operation process twice, the F function outputs the correct encryption operation result.
The method according to claim 1, wherein in the two normal encryption operations, the encryption result of the first normal encryption operation is C, and the encryption result of the second normal encryption operation is C', and the C is composed of L and R. The C'is composed of L'and R', namely C=L||R, C'=L'||R', and the F function is defined as:
The method according to claim 1 or 2, characterized in that, during the normal encryption operation, the normal encryption operation process is injected into a fault once or twice, and the step of outputting the wrong encryption result specifically includes:

When performing the first normal encryption operation on the plaintext P, this normal encryption operation is injected with a fault, and the first incorrect encryption result is output;

When the second normal encryption operation is performed on the plaintext P, the correct encryption result is output.
The method according to claim 1 or 2, characterized in that, during the normal encryption operation, the normal encryption operation process is injected into a fault once or twice, and the step of outputting the wrong encryption result specifically further comprises:

When performing the first normal encryption operation on the plaintext P, output the correct encryption result;

When the second normal encryption operation is performed on the plaintext P, a fault is injected into the normal encryption operation this time, and a second incorrect encryption result is output. To
The method according to claim 1 or 2, characterized in that, during the normal encryption operation, the normal encryption operation process is injected into a fault once or twice, and the step of outputting the wrong encryption result specifically further comprises:

When performing the first normal encryption operation on the plaintext P, this normal encryption operation is injected with a fault, and the first incorrect encryption result is output;

When the second normal encryption operation is performed on the plaintext P, a fault is injected into the normal encryption operation this time, and a second incorrect encryption result is output.
A method for decrypting block cipher against attacks, which is characterized in that it comprises:

Receive the ciphertext P to be decrypted, perform two normal decryption operations on the ciphertext P, and output the decryption result for the input F function;

When the normal decryption operation is performed, when the normal decryption operation process is injected into a fault once or twice, an error decryption result is output;

When the wrong decryption result is input into the F function, an invalid result that cannot be used by an attacker is output; when no fault is injected into the normal decryption operation process twice, the F function outputs the correct decryption operation result.
The method according to claim 6, wherein in the two normal decryption operations, the decryption result of the first normal decryption operation is C, and the decryption result of the second normal decryption operation is C', and C is composed of L and R. The C'is composed of L'and R', namely C=L||R, C'=L'||R', and the F function is defined as:
The method according to claim 6 or 7, characterized in that, during the normal decryption operation, the normal decryption operation process is injected into a fault once or twice, and the step of outputting the wrong decryption result specifically includes:

When the first normal decryption operation is performed on the ciphertext P, this normal decryption operation is injected into a fault, and the first incorrect decryption result is output;

When the second normal decryption operation is performed on the ciphertext P, the correct decryption result is output. To
The method according to claim 6 or 7, characterized in that, when the normal decryption operation is performed, the normal decryption operation process is injected into a fault once or twice, and the step of outputting the wrong decryption result specifically further comprises:

When performing the first normal decryption operation on the ciphertext P, output a correct decryption result;

When the second normal decryption operation is performed on the ciphertext P, this normal decryption operation is injected into a fault, and a second incorrect decryption result is output.
The method according to claim 6 or 7, characterized in that, when the normal decryption operation is performed, the normal decryption operation process is injected into a fault once or twice, and the step of outputting the wrong decryption result specifically further comprises:

When the first normal decryption operation is performed on the ciphertext P, this normal decryption operation is injected into a fault, and the first incorrect decryption result is output;

When the second normal decryption operation is performed on the ciphertext P, this normal decryption operation is injected into a fault, and a second incorrect decryption result is output.
A block cipher anti-attack encryption device, which is characterized in that it comprises:

The encryption operation module is used to receive the plaintext P to be encrypted, perform two normal encryption operations on the plaintext P, and output the encryption result used to input the F function;

The fault receiving module is configured to receive the faults injected once or twice during the normal encryption operation during the normal encryption operation, and instruct the encryption operation module to output an incorrect encryption result;

The result output module is used to output an invalid result that cannot be used by an attacker after the wrong encryption result is input into the F function; when no fault is injected into the normal encryption operation process twice, output the correct encryption operation result.
The device according to claim 11, wherein in the two normal encryption operations of the encryption operation module, the encryption result of the first normal encryption operation is C, and the encryption result of the second normal encryption operation is C ', the C is composed of two parts, L and R, the C'is composed of two parts, L'and R', namely C=L||R, C'=L'||R', the result output module The F function in is defined as: To
The device according to claim 11 or 12, wherein the fault receiving module is specifically configured to receive the fault injected in the normal encryption operation for the first time when the plaintext P is subjected to the first normal encryption operation, Output the first wrong encryption result;

When the second normal encryption operation is performed on the plaintext P, the correct encryption result is output.
The device according to claim 11 or 12, wherein the failure receiving module is further configured to output a correct encryption result when performing the first normal encryption operation on the plaintext P;

When the second normal encryption operation is performed on the plaintext P, the fault injected into this normal encryption operation is received, and the second incorrect encryption result is output.
The device according to claim 11 or 12, wherein the fault receiving module is further configured to:

When performing the first normal encryption operation on the plaintext P, receive the fault injected in this normal encryption operation, and output the first incorrect encryption result;

When the second normal encryption operation is performed on the plaintext P, the fault injected into this normal encryption operation is received, and the second incorrect encryption result is output.
An anti-attack decryption device for block ciphers, which is characterized in that it comprises:

The decryption operation module is used to receive the ciphertext P to be decrypted, perform two normal decryption operations on the ciphertext P, and output the decryption result for the input F function;

The fault receiving module is configured to receive faults injected once or twice during the normal decryption operation during the normal decryption operation, and instruct the decryption operation module to output an error decryption result;

The result output module is used to output the invalid result that the attacker cannot use after the wrong decryption result is input into the F function; when no fault is injected into the normal decryption operation process twice, the correct decryption operation result is output.
The device according to claim 16, wherein in the two normal decryption operations of the decryption operation module, the decryption result of the first normal decryption operation is C, and the decryption result of the second normal decryption operation is C ', the C is composed of two parts, L and R, the C'is composed of two parts, L'and R', namely C=L||R, C'=L'||R', the result output module The F function in is defined as:
The device according to claim 16 or 17, wherein the fault receiving module is specifically configured to receive the fault injected into the ciphertext P during the first normal decryption operation. , Output the first error decryption result;

When the second normal decryption operation is performed on the ciphertext P, the correct decryption result is output.
The device according to claim 16 or 17, wherein the failure receiving module is specifically further configured to output a correct decryption result when performing the first normal decryption operation on the ciphertext P;

When the second normal decryption operation is performed on the ciphertext P, the fault injected into this normal decryption operation is received, and the second wrong decryption result is output.
The device according to claim 16 or 17, wherein the fault receiving module is further configured to receive the information injected into the ciphertext P during the first normal decryption operation. Failure, output the first error decryption result;

When the second normal decryption operation is performed on the ciphertext P, the fault injected into this normal decryption operation is received, and the second wrong decryption result is output. To