CN101866401A - Method for resisting side channel attacks by evolutive S boxes - Google Patents

Abstract

The invention relates to the technical field of password security application, in particular to a method for resisting side channel attacks by evolutive S boxes, which comprises the following steps: using a random number generator to generate random numbers; determining which component in a constant multiplication conversation component, a one-plus conversation component and an inverse conversation component the content of a buffer memory can be sent into according to the value of the random values; sending the content into the buffer memory after the conversation; sending the content into the constant multiplication conversation component, the one-plus conversation component and the inverse conversation component at a next beat; simultaneously sending the content into an arbiter to judge whether the indexes of the box are qualified or not; carrying out zero clearing on a counter if the box is a qualified box; adding 1 to the counter if the box is not qualified; and resetting the content of the buffer memory into identical permutation if the value of the counter reaches a threshold value. Through the proper frequency change, the invention finally reaches the goal that the complexity required by the attacks reaches or exceeds the exhaustivity level, and the effect of the evolutive S boxes and dynamic S boxes on the side channel attacks such as standard DPA and the like is obvious.

Description

The method that evolution S box antagonism bypass type is attacked

Technical field

The present invention relates to the cipher safety applied technical field, relate in particular to the method that a kind of S of evolution box antagonism bypass type is attacked.

Background technology

Password is the key point of information security, and how the password application system of design safety is the emphasis that cryptography is studied.Cryptographic algorithm can be divided into symmetric cryptography and asymmetric cryptography, and symmetric cryptography can be divided into stream cipher, block cipher, hash algorithm again.The S box all has the important safety effect in the design of symmetric cryptographies such as stream cipher, block cipher and hash function, be main or unique nonlinear transformation parts.Dynamic S box method for designing is applied to resist a series of bypass types attacks such as DPA, can make and attack the horizontal exponentially level lifting of complexity, the result is, by suitable frequency shift, the final required complexity of attack that makes meets or exceeds exhaustive rank, and then reaches immunity.

Bypass type is attacked and is comprised a series of attack methods such as TA, DFA, DPA, SPA, and the main cause of generation is the separation between security mechanism and its realization.

DPA (Differential Power Analysis) is that differential power consumption is attacked, and most modern password equipment are realized by the logic semiconductor door, more precisely, are made of transistor.When the logic gate charge and discharge, electron stream flows through siliceous substrate, consumed energy (power consumption), generation electromagnetic radiation.Use specific statistical function, still can be used for attacking cryptographic system.The energy attack scope is wide, and is easy to implement and cost is low, do not need manual intervention, makes it be difficult to be detected.The specifying information that does not need chip to realize; Be not only theory, also do not limit to and smart card (successful attack nearly 50 kinds of different products).

DFA (Differential Fault Analysis) is the abbreviation that difference mistake (fault) is attacked or difference mistake (fault) is analyzed, compare with cryptography mistake correct, thereby separate out the key of secret Tibetan, microprocessor in the smart card requires to work under stable voltage, and the interruption of energy supply just looks like unexpected impact program run or reset circuit.Yet, a weak point and pulse cleverly can cause the program error of single step and microprocessor still can continue executive routine.

Bypass attack has characteristics such as more practical, more hidden, quicker than other attack pattern.In the password application, particularly in the cryptographic algorithm hardware implementation method, the effect that bypass type is attacked is comparatively obvious, since proposing, the security of a lot of cryptographic systems has been constituted serious threat.At present, many Secure Application and main Valuation Standard all should increase the bypass attack prevention methods.Domestic relevant product is fewer at present, and such attack is especially obvious for the effect in fields such as smart card.In case attack equipment flows into domestic, its consequence will be very serious.

Summary of the invention

At the technical matters of above-mentioned existence, the purpose of this invention is to provide the method that a kind of S of evolution box antagonism bypass type is attacked, attack the potential safety hazard that cryptographic system is brought with the antagonism bypass type.

For achieving the above object, the present invention adopts following technical scheme:

Utilize randomizer to produce random number;

According to the value of random number, the content of decision buffer is sent into constant multiplication transform component, is added 1 transform component, which parts in the inverse transformation parts;

Through after the above-mentioned conversion, send into buffer;

Send into constant multiplication transform component at next beat, add 1 transform component, the inverse transformation parts, whether and it is qualified with the index of judging box to send into arbiter simultaneously;

If a qualified box, then counter O reset, if box is defective, then counter adds 1, if the value of counter reaches a certain threshold value, the content of the buffer of then resetting is identical permutation.

The present invention has the following advantages and good effect:

1) attacks for a series of bypass types such as DPA with dynamic S box design, can make and attack complexity lifting at double;

2) by suitable frequency shift, the final required complexity of attack that makes meets or exceeds exhaustive rank, promptly reaches the effect of attacking immunity;

3) evolution S box and dynamic S-box are apparent in view for the effect of bypass types such as standard DPA attack.

Description of drawings

Fig. 1 is the overall construction drawing of the S box rapid evolution algorithm that proposes of the present invention.

Fig. 2 is the process flow diagram of evolution S box antagonism bypass type that the present invention the proposes method of attacking.

Fig. 3 is the structural representation that utilizes the method that evolution S box antagonism bypass type that the present invention proposes attacks in AES.

Embodiment

The invention will be further described in conjunction with the accompanying drawings with specific embodiment below:

The method that the evolution S box antagonism bypass type that the present invention proposes is attacked, specifically by the following technical solutions, as shown in Figure 1:

Accompanying drawing 1 is the overall construction drawing of S box rapid evolution algorithm.Parts 11 are stochastic sources, generate random number 0,1,2 at random; Parts 12 are the conversion of constant multiplication, and constant is a primitive element of corresponding field; Parts 13 are to add 1 conversion; Parts 14 are inverse transformations; Parts 15 are arbiters, are used for calculating the cryptography index of box, and according to preset threshold box are accepted or rejected; Parts 16 are buffers, are used for the S box that buffer memory generates, and also are the initialization parts;

Accompanying drawing 2 is process flow diagrams of evolution S box antagonism bypass type that the present invention the proposes method of attacking, and concrete steps are as follows:

Step 1: parts 11 produce random number, and according to the value of random number, the content of decision buffer parts 16 is sent into parts 12,13 or 14.

Step 2: according to the value of random number, the content of decision buffer is sent into and is taken advantage of transform component, adds transform component, and parts in the inverse transformation parts are sent into buffer memory parts 16 afterwards.

Step 3: send into transform component 12 at next beat, 13 or 14, and send into parts 15 simultaneously and carry out the calculating of cryptography character and judge whether the index of box is qualified, if qualified box, then counter O reset, if box is defective, then counter adds 1, if the value of counter reaches a certain threshold value, the content of the buffer of then resetting is identical permutation.

The cryptographic property of S box has a lot, and these cryptographic properties are described the ability of the anti-various cryptographic attacks of this S box from different levels, different angles.Specifically, these cryptographic properties have orthogonality, nonlinearity, autocorrelation, algebraic degree, algebraic expression item number, difference homogeneity, robust degree etc.

1. orthogonality:

This cryptographic property is used to portray the distribution of S box output, general property or harmony such as is also referred to as, and the S box in the password network structures such as SP type must quadrature, otherwise used S box is just not unique during deciphering.Usually, when the S box satisfied n＞=m, the S box of strong cipher character must possess orthogonality, otherwise at random evenly under the input, some output vector of S box will frequently occur, and cryptanalysis person can utilize this unbalancedness to attack cipher system based on this S box.But, meaningful when obviously this definition has only n＞=m, concerning the S box of cast class cryptographic algorithm, orthogonality is undefined.

2. nonlinearity:

The nonlinearity of S box is used to portray anti-linear attacking ability, and its definition is that the nonlinearity according to Boolean function draws, and the nonlinearity of Boolean function is relevant with its circulation Walsh spectrum.

N * m (n advance m go out) S box F=(f ₁, f ₂..., f _m) nonlinearity be:

$\mathrm{NL}\left(S_{n\×m}\right)=\min \left\{\mathrm{NL}(\mathrm{\β}\·F)\right|\mathrm{\β}\≠0.\mathrm{\β}\∈{\mathrm{GF}}_{2n}\}$

$=2^{n-1}-2^{-1}\underset{i}{\max }\underset{x}{\max }\left|W_{\left(g_i\right)}\left(x\right)\right|$

The span of this character is 0～2 ^N-1-2 ^[n/2]-1([] is for rounding symbol), and the anti-linear attacking ability of the big more then S box of value is strong more, but in the S of quadrature, maximal value can not reach, because nonlinearity is 0～2 ^N-1-2 ^[n/2]-1The Boolean function imbalance, the S box of being made up of these Boolean functions is non-orthogonal certainly, so the S box of quadrature is necessarily less than 0～2 ^N-1-2 ^[n/2]-1, and when n＞=2, be even number.

3. autocorrelation:

S box autocorrelation is once more by the description feature of Boolean function, and it is mainly used in portrayal resisting differential attacking ability.

S _{N * m}Box F=(f ₁, f ₂..., f _m) autocorrelation be:

$C\left(S_{n\×m}\right)=\underset{i}{\max }\underset{x.x\≠0}{\max }\left|C_{g_i}\left(x\right)\right|$

Wherein, g _i=a _i(f ₁, f ₂..., f _m), a _i=(a ₁, a ₂..., a _m), | wherein component is not 0 entirely, and is the 0-1 variable, f ₁, f ₂..., f _mBe m Boolean function of S box correspondence, || refer to take absolute value.The span of this quantized value is 0～2 ⁿ, show that then S box resisting differential attacking ability is strong more but its value is more little.

4. algebraic degree:

Algebraic degree is the one side that is used to portray the anti-linear attacking ability of S box.The cryptographic property of top S box calculates and all is based on the truth table of Boolean function, and will calculate algebraic degree, then must represent by means of the algebraically normal type of Boolean function.

5. algebraic expression item number:

The algebraic expression item number of S box is mainly portrayed anti-interpolation attacking ability.Previously defined algebraic degree is the minimum value of the algebraic expression number of times of the Boolean function in the S box, and being meant the S box, said algebraic expression makes as a whole input/output relation here, the algebraic expression that is called the S box, usually, ask for this algebraic expression and can adopt Lagrange's interpolation, and this method requires the input size to equal output, and therefore, the definition here is only meaningful to the displacement box.

6. difference homogeneity:

The difference homogeneity of S box is an important cryptographic property of S box, is used to portray the resisting differential attacking ability.

S _{N * m}Box F (x)=(f ₁(x) ..., f _m(x)) difference homogeneity is defined as:

The span of this character is 2 ^N-m～2 ⁿ(n 〉=m), the more little then S of value box resisting differential attacking ability is strong more.

7. robust degree:

The robust degree of S box is used to portray the anti-higher difference attacking ability of S box.

Given S _{N * m}Difference profile matrix A (F)=(λ of box _n) and difference uniformity coefficient δ (F), note

And

Then remember

Be S _{N * m}The robust degree of box.

Following table is main cryptography property list:

Accompanying drawing 3 is the structural drawing of taking turns the AES encryption method.Total Addroundkey, Sbox, Shiftrow, four parts of Mixcolumn and four registers.Input, output and key are 128bit.

Addroundkey promptly encloses key and adds conversion;

Sbox (conversion of S box) is unique nonlinear transformation of AES, is the key of AES safety.In original AES, use 16 identical Sbox, in the present invention, use the Sbox that dynamically generates to replace the Sbox of former AES kind;

Shiftrow (row displacement) carries out ring shift to the row of state, and the row shift transformation belongs to displacement, and essence is data are upset rearrangement;

Mixcolumn (row are obscured) conversion is considered as polynomial expression a (x) on the GF (28) to the row of state, multiply by a fixing polynomial expression c (x), and mould x4+1.

The course of work is as follows: the Sbox that will dynamically generate replaces the Sbox among the former AES, can adopt online updating or off-line to upgrade dual mode renewal hardware design circuit during specific implementation, and this dual mode all is that the chip development merchant supports at present.

Above-mentioned example is used for the present invention that explains, rather than limits the invention, and in the protection domain of spirit of the present invention and claim, the present invention is made any modification and change, all falls into protection scope of the present invention.

Claims (1)

1. the method that the S box antagonism bypass type that develops is attacked is characterized in that, may further comprise the steps:

Utilize randomizer to produce random number;

According to the value of random number, the content of decision buffer is sent into constant multiplication transform component, is added 1 transform component, which parts in the inverse transformation parts;

Through after the above-mentioned conversion, send into buffer;

Send into constant multiplication transform component at next beat, add 1 transform component, the inverse transformation parts, whether and it is qualified with the index of judging box to send into arbiter simultaneously;

If a qualified box, then counter O reset, if box is defective, then counter adds 1, if the value of counter reaches a certain threshold value, the content of the buffer of then resetting is identical permutation.

Images