CN102571331A - Cryptographic algorithm realization protecting method used for defending energy analysis attacks - Google Patents

Abstract

The invention discloses a cryptographic algorithm realization protection method for defending against energy analysis attacks, belonging to the field of information technology security. This method completes the protection of the intermediate value of the cryptographic algorithm by adding appropriate encoding and decoding steps to the execution process of the cryptographic algorithm. First, before the algorithm starts, all the data participating in the operation, including plaintext, key and possible initial vectors, are processed. Encoding operation; then use the encoded data and corresponding operations during the operation of the algorithm, perform cryptographic calculations according to the steps of the cryptographic algorithm, and complete the encryption and decryption process; at the end of the algorithm, decode the encoded result data to obtain the algorithm normal output. This method only encodes the intermediate value of the cryptographic algorithm to ensure that it does not leak information, does not change the input and output of the algorithm, and ensures the correct operation result of the algorithm; at the same time, it can obtain higher security and performance overhead than mask defense measures Also smaller.

Description

A Cryptographic Algorithm Implementation Protection Method for Defending Energy Analysis Attacks

technical field

The invention relates to a protection method for implementing a cryptographic algorithm, in particular to a protection method for implementing a cryptographic algorithm for defending against energy analysis attacks, and belongs to the field of information technology security.

Background technique

Energy analysis attack is a new method of cryptanalysis. Energy analysis attacks use the correlation between the energy consumption of cryptographic equipment to perform cryptographic operations and the operations performed by the equipment or the data processed to implement password cracking. It has the characteristics of low attack cost and high cracking efficiency. It has already attacked smart cards, RFID, etc. The security of embedded cryptographic devices poses serious real-world threats. Lightweight block ciphers are a class of block ciphers that are widely used in resource-constrained environments. The biggest feature of lightweight block ciphers is that the block length and key length are relatively short, which makes them more vulnerable to energy analysis attacks.

The block cipher is to divide the plaintext message sequence into groups of length n, and each group is transformed into an output sequence of equal length under the control of the key. Block ciphers are widely used in fields such as electronic payment, pay TV, and electronic passports. In these fields, block ciphers are mostly implemented based on embedded cryptographic devices such as smart cards and RFIDs. Embedded cryptographic devices have strict limitations in computing power and storage space, and are generally referred to as resource-constrained working environments. The difference between a lightweight block cipher and other non-lightweight block cipher algorithms is that its block length is relatively small and its key length is relatively short, so its encryption/decryption process has low requirements for storage space and computing power. It can be seen that lightweight block ciphers are a class of block cipher algorithms that are especially suitable for resource-constrained working environments.

In recent years, side-channel attack, as a new type of cryptanalysis method, has attracted extensive attention from the industry and academia, and has developed rapidly. Traditional cryptanalysis regards the cipher implementation as a black box, and only uses its input and output to implement password cracking; while the side-channel attack is different from the traditional cryptanalysis method in that it not only considers the input and output of the cipher implementation, but simultaneously Use passwords to realize physical information such as time information, energy consumption information, or electromagnetic radiation information leaked during password calculations, and assist in password cracking.

Energy analysis attack is a side-channel attack method that utilizes the energy consumption information of cryptographic devices to implement key recovery. Since Kocher et al. proposed differential power analysis (Differential Power Analysis) in 1998, a large number of effective energy analysis attack methods have been proposed one after another, including template attack (Template Attack), correlation coefficient analysis (CPA, Correlation Power Analysis), Stochastic Model, Mutual Information Analysis, Variance Power Analysis, etc. These attack methods constitute a serious threat to the actual security of embedded cryptographic devices.

In view of the huge threat energy analysis attacks pose to smart cards, RFID and other embedded cryptographic devices, academia and industry have proposed a large number of defensive countermeasures against energy analysis attacks. The defense countermeasure based on the software method has the advantages of short design cycle and low deployment cost because it does not need to redesign the embedded device itself. Software defense countermeasures generally use coding technology (or information sharing technology) to represent the intermediate value that is vulnerable to energy analysis attacks as a value that has no statistical correlation with it (that is, masking technology), or randomly disturb The execution flow of the cryptographic algorithm, these methods can effectively reduce the correlation between energy consumption and the target intermediate value, thus playing a role in defending against energy analysis attacks.

The key length of the lightweight block cipher is short and its host embedded device (such as smart card, RFID tag, etc.) often does not have a high-level security access control mechanism. Therefore, it is very vulnerable to energy analysis attacks and must be given special protection . Existing defense countermeasures are less applicable to lightweight block ciphers. For example, the implementation of the masking technique requires a large time and space overhead, which is unrealistic for resource-constrained application environments. However, some more efficient hardware countermeasures, such as dual-rail precharge logic (Dual-rail Precharge Logic), have high design and deployment costs and difficulties in application.

Contents of the invention

Based on the above-mentioned technical requirements and difficulties, the purpose of the present invention is to provide a cryptographic algorithm protection method for defending against energy analysis attacks. A security solution to improve the physical security of lightweight block ciphers under energy analysis attacks. It should be pointed out that this method is not only applicable to lightweight block ciphers, it is also valid for other non-lightweight block ciphers, but this method has better applicability to lightweight block ciphers.

Energy analysis attacks use the correlation between the intermediate value of the algorithm and its corresponding energy consumption to implement key recovery. The attacker guesses the key of the device and calculates the guess intermediate value based on the known plaintext or ciphertext. Afterwards, statistical methods are used to analyze the guessed intermediate value and the energy consumption of the attacker's observation record to verify the correctness of the key guess. Once the correlation between the intermediate value and the device's energy consumption is broken, an attacker cannot use this correlation to recover the key. The main idea of this method is to break the statistical correlation between the intermediate value of the algorithm and the energy consumption of the device, so that the energy consumption of the device corresponding to different intermediate values is basically equal, so that the attacker cannot use this correlation to recover the key of the device.

Technical scheme of the present invention is:

A cryptographic algorithm protection method for defending against energy analysis attacks, the steps of which are as follows:

1) Bit-balanced encoding is performed on the input value of the cryptographic algorithm that needs to be protected: the data bit with a bit value of 0 in the input data stream is encoded as bit 01, and the data bit with a bit value of 1 is encoded as bit 10;

2) Utilize the data after the bit-balanced coding to carry out cryptographic operations, and set the cryptographic algorithm as an n-bit block cipher algorithm; where:

a) For the bit XOR operation in cryptographic operations, first perform XOR operation on Encode(A _n ) and a bit string (01) ₁ ... (01) _n , and then combine the obtained XOR value with Encode(B _n ) Exclusive OR operation; Encode(A _n ) is the value of n-bit data A after bit-balanced encoding, and Encode(B _n ) is the value of n-bit data B after bit-balanced encoding;

b) For the bit permutation operation in the cryptographic operation, the 2i, 2i+1 two bits after the bit balance encoding are replaced with the 2j, 2j+1 two bits; wherein, i, j are the replacements before encoding The i, j bits of ;

c) For the bit cyclic shift operation in the cryptographic operation, carry out 2m bit cyclic shifts to the data after the bit balance encoding, wherein, m is the number of bit cyclic shifts to be carried out before encoding;

3) Decoding the output value of the step 2) operation, that is, the two bits output in sequence form a group, and the value of the previous bit of each group is taken as the output value.

The method according to claim 1, characterized in that the sequence of cryptographic operations to be protected is M, and the input value is an intermediate value of the cryptographic operations of the Nth round in the cryptographic algorithm.

A cryptographic algorithm protection method for defending against energy analysis attacks, the steps of which are as follows:

1) Carry out bit-balanced encoding to the input value of the cryptographic algorithm that needs protection, encode the data with a bit value of 0 in the input data stream into bit 10, and encode the data with a ratio characteristic value of 1 into bit 01;

2) Utilize the data after the bit-balanced coding to carry out cryptographic operations, and set the cryptographic algorithm as an n-bit block cipher algorithm; where:

a) For the bit XOR operation in cryptographic operations, first perform XOR operation with Encode(A _n ) and a bit string (10) ₁ ... (10) _n , and then combine the obtained XOR value with Encode(B _n ) Exclusive OR operation; Encode(A _n ) is the value of n-bit data A after bit-balanced encoding, and Encode(B _n ) is the value of n-bit data B after bit-balanced encoding;

b) For the bit permutation operation in the cryptographic operation, replace the encoded 2i, 2i+1 bits with the 2j, 2j+1 bits; where, i and j are respectively the first bits that need to be replaced before encoding i, j bit;

c) For the bit cyclic shift operation in the cryptographic operation, carry out 2m bit cyclic shifts to the data after the bit balance encoding, wherein, m is the number of bit cyclic shifts to be carried out before encoding;

3) Decoding the output value of the operation in step 2), that is, the two bits output in sequence form a group, and the value of the last bit of each group is taken as the output value.

Further, it is assumed that the round sequence of cryptographic operations to be protected is M, and the input value is an intermediate value of cryptographic operations of the Nth round in the cryptographic algorithm.

Further, for the S-box substitution operation in cryptographic operations, if the data input into the S-box is bit-balanced coded, the S-box lookup table is first transformed to generate a new S-box lookup table S′, so that S′[Encode (A _n )]=Encode(S[A _n ]); Then, according to the input data lookup table S', the output data of the S-box substitution operation is obtained; wherein, Encode represents the operation of bit-balanced encoding of the data, and S[A _n ] represents the output of the S-box substitution operation with _An as input, and _An represents n-bit unencoded data.

Further, if the data of the input S box is unencoded data, then first calculate the new S box lookup table S ", so that S" [An]=Encode (S [An]), and then carry out the S box according to S " Lookup operation.

Further, the data A and B may be of any bit length.

The method completes the protection of the intermediate value of the encryption algorithm by adding appropriate encoding and decoding steps to the execution process of the encryption algorithm. First, before the algorithm starts, encode all the data involved in the operation, including plaintext, key and possible initial vector. Then, during the operation of the algorithm, the encoded data and corresponding operations are used to perform cryptographic calculations according to the steps of the cryptographic algorithm to complete the encryption and decryption process. At the end of the algorithm, decode the encoded result data to get the normal output of the algorithm. This method only encodes the intermediate value of the cryptographic algorithm to ensure that it does not leak information, does not change the input and output of the algorithm, and ensures that the operation result of the algorithm is correct. The codec method used in this method is bit-balanced coding.

bit-balanced coding

Bit-balanced encoding, that is, by encoding the intermediate values of the algorithm, so that different intermediate values have the same Hamming weight. The specific method is to use two complementary bits to encode each bit of the intermediate value of the algorithm, that is, use 10 two bits to encode bit 1, and use 01 two bits to encode bit 0. See Table 1 for the encoding table of one bit data. Use V to represent the n-bit algorithmic intermediate value, V[i] represents the i-th bit of the intermediate value V, V' represents the encoded intermediate value, and V'[j] represents the j-th bit of the encoded intermediate value. The encoding rules and Hamming weight changes are expressed as follows:

V＝V[0]||V[1]||V[2]||...||V[n-2]||V[n-1]

${\mathrm{<span\; class="notranslate">\; V</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; V</span>}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\stackrel{<span\; class="notranslate">\; ~</span>}{\mathrm{<span\; class="notranslate">\; V</span>}}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; V</span>}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\stackrel{<span\; class="notranslate">\; ~</span>}{\mathrm{<span\; class="notranslate">\; V</span>}}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; V</span>}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\stackrel{<span\; class="notranslate">\; ~</span>}{\mathrm{<span\; class="notranslate">\; V</span>}}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; V</span>}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\stackrel{<span\; class="notranslate">\; ~</span>}{\mathrm{<span\; class="notranslate">\; V</span>}}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; V</span>}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\stackrel{<span\; class="notranslate">\; ~</span>}{\mathrm{<span\; class="notranslate">\; V</span>}}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ]</span>$

HW(V)＝V[0]+V[1]+V[2]+...|V[n-2]+V[n-1]

$\mathrm{<span\; class="notranslate">\; HW</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; V</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; V</span>}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; +</span>\stackrel{<span\; class="notranslate">\; ~</span>}{\mathrm{<span\; class="notranslate">\; V</span>}}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; V</span>}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; +</span>\stackrel{<span\; class="notranslate">\; ~</span>}{\mathrm{<span\; class="notranslate">\; V</span>}}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; V</span>}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; +</span>\stackrel{<span\; class="notranslate">\; ~</span>}{\mathrm{<span\; class="notranslate">\; V</span>}}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; +</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; V</span>}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; +</span>\stackrel{<span\; class="notranslate">\; ~</span>}{\mathrm{<span\; class="notranslate">\; V</span>}}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; V</span>}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; +</span>\stackrel{<span\; class="notranslate">\; ~</span>}{\mathrm{<span\; class="notranslate">\; V</span>}}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ]</span>$

表示V[i]的补)。(

represents the complement of V[i]).

For any i in the above formula, are equal to 1, so the Hamming weight of V' is only related to the bit length of V. The Hamming weight of any uncoded intermediate value V with a bit length of n is equal to n after encoding. In particular, if the bit length of the intermediate value V is 4, then the Hamming weight of all encoded intermediate values V′ equal to 4. Bit-balanced coding makes any cryptographic device that leaks the intermediate value Hamming weight have almost the same energy leakage when processing different intermediate values, so that the attacker cannot exploit the energy leakage of the device.

Table 1 Bit balance coding table

original after encoding 0 01 1 10

Bit-balanced coding has high applicability in lightweight block ciphers. This is because typical application scenarios of lightweight block ciphers are embedded cryptographic devices with limited resources, and most of these devices use 8-bit microprocessors. At the same time, a large number of operations in units of 4 bits are used in the lightweight block key, such as replacement in units of 4 bits, S-box replacement in units of 4 bits, etc., while data in an 8-bit microprocessor The transmission and calculation are performed in units of 8 bits, so there are 4 unused bits. The biggest advantage of the bit-balanced encoding method is that it utilizes 4 idle bits, and obtains a greater security improvement with a smaller calculation cost.

The bit-balanced encoding method is also applicable to non-lightweight block ciphers. For example, for the AES algorithm implemented on 16-bit processing, the use of bit-balanced coding can also play a high protective role without causing excessive performance degradation.

Protection for Essential Operations

Bit-balanced coding can protect the input intermediate value and output intermediate value of different operations in cryptographic algorithms, such as bit XOR operation, bit permutation operation, S-box substitution operation and bit rotation operation.

√Bit XOR operation

In the bit XOR operation, the result obtained by directly performing the bit XOR operation on the two encoded input data does not conform to the encoding rules. It is necessary to use a constant to perform the bit XOR operation with the result again to obtain the correct value. Encoded output.

√ Bit permutation operation

In the bit permutation operation, when operating unencoded data, the permutation is performed in units of 1 bit; when operating encoded data, it is necessary to perform permutation in units of two bits, so as to ensure that the resulting data is also correctly encoded data .

√S box replacement operation

The S-box replacement operation is usually implemented using the S-box lookup table, so using bit-balanced coding to protect the S-box replacement operation requires changes to the S-box lookup table. According to whether the input data of the S-box replacement operation is coded, there are two ways to establish a new S-box lookup table. If the input data of the S-box substitution operation is not encoded, then only the data in the S-box lookup table needs to be encoded. If the input data of the S-box replacement operation is encoded, that is, the bit length is doubled, then the size of the S-box lookup table will be enlarged, and the number of elements in the new lookup table is the number of elements in the unencoded lookup table square. The output of both methods is encoded data.

√Bit rotation operation

The bit rotation operation includes rotation left and rotation right. The difference between the two lies in the direction of the shift, and this difference has no effect on the encoding operation. Therefore, taking cyclic left shift as an example, the protection of bit cyclic shift operation by bit balance coding is briefly introduced. In bit rotate left operation, the most basic operation is to rotate one bit. Shift one bit to the left to the end of the bitstring, and shift the remaining bits one bit to the left. For encoded data, the two bits on the left need to be shifted to the end of the bit string, and the other bits are shifted two bits to the left.

Compared with prior art, technical effect of the present invention is:

LBlock is a lightweight block cipher proposed in 2011. The block length of LBlock is 64 bits, the key length is 80 bits, and the Feistel structure is adopted, in which the input and output of the S box are both 4 bits. The following uses this algorithm as an example to describe the protection effect of the bit-balanced coding method on the lightweight block cipher.

This method is mainly protected by a bit-balanced coding method, so the protection using this method is called bit-balanced coding implementation in the following. The mask implementation is a typical and effective energy analysis attack defense method. Using this method to compare with the mask defense method can objectively reflect the effect of this method. The three curves drawn in Figure 5 correspond to the success rate of attacking the mask implementation and the method implementation using the first-order and second-order CPA respectively. It can be clearly seen from the figure that for the CPA attack realized by the mask, the success rate of the bit-balanced coding implementation under the CPA attack is higher. This illustrates two things:

-The implementation of bit-balanced encoding makes the CPA attack the lowest success rate, which is always around 0.065, which is the probability of randomly guessing the correct key for the 4-bit wheel key. In other words, the bit-balanced encoding method makes the algorithm The success rate of attacking to obtain the key is very close to the success rate of random guessing to obtain the key.

- The second-order attack success rate achieved for bit-balanced coding is basically the same as the first-order attack success rate. The first-order CPA attack uses information leakage at one moment, and the second-order CPA attack uses information leakage at two different moments, and the first-order and second-order attacks have basically the same success rate. This shows that attacking bit-balanced encoding implementations with two time instants is nearly as effective as attacking them with one time instant. In other words, the implementation of bit-balanced coding has a certain resistance to second-order attack methods.

To sum up, the implementation of bit-balanced coding has a strong protective effect on the physical security of lightweight block ciphers under energy analysis attacks. A bit-balanced encoding implementation can achieve higher security than an unprotected and masked implementation.

Table 2 Time and Space Consumption

(Note: The percentage in parentheses indicates the increase in the item compared to the unprotected implementation)

Figure 5 depicts the improvement of the security of the bit-balanced encoding method, and the impact of the bit-balanced encoding method on performance (program running time and space requirements) is analyzed through Table 2 and Figure 6 below. Table 2 lists the storage space of the three different implementation methods and the comparison table of the time consumed for encryption (excluding key arrangement, because the key arrangement time used by the three implementation methods is the same). Figure 6 is a comparison of three items of bit-balanced encoding implementation and mask implementation compared with unprotected implementation on program running time (Execution Time), storage space (Memory) and code volume (ROM).

From Table 2 and Figure 6, it can be found that the increased storage space of bit-balanced coding is smaller than that of mask implementation, and the time increase is also less than that of mask implementation.

Based on the above comparison of security and implementation performance, bit-balanced coding can obtain higher security than mask defense measures, and its performance overhead is also smaller.

Description of drawings

The application of Fig. 1 bit-balanced coding in bit XOR operation;

The application of Fig. 2 bit-balanced coding in bit permutation;

The application of Fig. 3 bit-balanced encoding in the S-box substitution operation;

The application of Fig. 4 bit-balanced coding in bit cyclic shift;

Figure 5 The success rate of using CPA to attack the two protection implementation methods;

Figure 6 Comparison of two implementations of bit-balanced coding and masking;

(a) memory consumption comparison, (b) execution time comparison, (c) code size comparison.

Detailed ways

In the specific application of this defense method, abnormal data may be encountered, that is, data that does not conform to the coding rules, and this situation becomes an abnormal situation. It corresponds to the normal situation. The specific implementation of the defended method is introduced for the normal situation and the abnormal situation respectively.

normal circumstances

This defense measure provides protection for the intermediate value of the cryptographic algorithm, and protects all or part of the intermediate value in the operation process according to the security requirements. For example, under low security requirements, only the intermediate values of the first several rounds and the last several rounds of the algorithm can be protected, and the remaining intermediate values are not protected. Under higher security requirements, the intermediate value of each round of the algorithm can be protected. The defense method encodes the input data before the operation of the algorithm, and then performs operations according to the steps of the cryptographic algorithm. It should be noted that when performing operations according to the steps of the cryptographic algorithm, it is necessary to use the operations proposed in the previous section to process encoded data to replace the corresponding original operations to calculate the encoded data. The encoded intermediate value can be decoded when needed, and the operation on the decoded intermediate value needs to use the original operation instead of the corresponding operation for processing the encoded data until the data is encoded or output again. In the case of only protecting the beginning and the last n rounds of the algorithm, it needs to be decoded after the end of the nth round. The decoding method is: output two bits in sequence as a group. If bit 0 is encoded as 01 and 1 is encoded as 10, then take the value of the previous bit of each group as the output value, if bit 0 is coded as 10, and 1 is coded as 01, then take the value of the last bit of each group as the output value, and then perform normal cryptographic operations; and The last n rounds are re-encoded to use this method for protection in the last n rounds. If the intermediate value of each round of operation of the algorithm is protected, then only one decoding operation is required to obtain the output of the algorithm after all the cryptographic operations are completed. The following specifically introduces the protection of this defense method for specific operations. It should be noted that if it is not specifically indicated that the implementation of a certain operation is for a certain encoding method of encoding 0 as 01 or encoding 0 as 10, then the description of the operation is applicable to both encoding methods.

The specific method of bit-balanced encoding to protect different operations is to use two complementary bits to encode each bit of the input and output of the operation so that the input and output of the operation have the same Hamming weight, thereby reducing the information leakage of the operation as much as possible quantity. For some operations (such as the S-box replacement operation), due to performance reasons, unencoded original data may be used as the input of the operation. The four operations of bit XOR, bit permutation, S-box substitution and cyclic shift are the basic operations widely used in lightweight block ciphers (such as PRESENT, LBlock, etc.). Therefore, the specific implementation methods of bit-balanced coding in these four basic operations are described below.

Bit XOR operation

The application of bit-balanced coding in the bit XOR operation is shown in Figure 1. For the intermediate value that has not been encoded, the bit XOR operation directly XORs each bit in the corresponding position. The truth table of the single-bit XOR operation is shown in Table 3 and the coded XOR operation is shown in Table 4. A _n and B _n represent n-bit intermediate values, respectively.

Table 3 XOR operation truth table

Table 4 Bit Balanced Encoding Truth Table

与两个2比特编码中间值的异或(即

)存在以下关系，其中C₂表示两比特的常量01b(注：01串最后的b表示该序列是二进制序列)。 $\mathrm{Encode}(A_1\&CirclePlus;B_1)=\mathrm{Encode}\left(A_1\right)\&CirclePlus;(\mathrm{Encode}\left(B_1\right)\&CirclePlus;C_2).$ 对于任意n比特的中间值A_n、B_n存在如下关系：Encode(x) in Table 4 indicates that bit-balanced encoding is performed on the intermediate value x. It can be found from Table 4 that if the bit XOR operation is directly performed on the encoded intermediate value (the fifth line of Table 4), four illegal encoded values will be obtained. Illegal here refers to four numbers that have no meaning under this encoding method. This encoding method uses two complementary bits to encode each bit of the original intermediate value, and the two bits of each data in the fourth row are the same, so for the bit XOR operation, the encoded Data is manipulated directly. The sixth line of Table 4 represents the correct coded data that should be obtained after the XOR operation. It is observed that the XOR of the wrong result and the correct result is equal to 01. In other words, the encoding of the XOR result of two 1-bit unencoded intermediate values

XOR with two 2-bit coded intermediate values (i.e.

) has the following relationship, wherein C ₂ represents a two-bit constant 01b (note: the last b of the 01 string indicates that the sequence is a binary sequence). $\mathrm{Encode}(A_1\&CirclePlus;B_1)=\mathrm{Encode}\left(A_1\right)\&CirclePlus;(\mathrm{Encode}\left(B_1\right)\&CirclePlus;C_2).$ For any n-bit intermediate values A _n and B _n, there is the following relationship:

$\mathrm{<span\; class="notranslate">\; Ebcode</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; A</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; \&CirclePlus;</span>{\mathrm{<span\; class="notranslate">\; B</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; Encode</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; A</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&CirclePlus;</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; Encode</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; B</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&CirclePlus;</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; .</span>$

是秘密的，因此通常先将Encode(B_n)与常量异或，之后再与Encode(A_n)进行异或，防止

的结果与常量进行异或操作时泄露

where C _2n represents a constant of 2n bits. It should be noted that it is usually necessary to XOR a value in AB with a constant first, and then XOR with another value to prevent the XOR result of A and B from being leaked. When Encode(0b)=01b, that is, bit 0 is encoded as bit 01, C _2n =(01) ₁ ||(01) ₂ ||(01) ₃ ||...||(01) _n-1 ( 01) _n , where || represents the operation of concatenating two bit strings, and (01) _i represents the i-th group of 01 bits. In other words, C _2n is equal to repeatedly connecting 01 n times to obtain a constant bit string with a length of 2n bits. For example, for a 4-bit uncoded intermediate value, when using two encoded 8-bit intermediate values to perform a bit-exclusive OR operation, firstly perform a bit-exclusive OR operation on the encoded two 8-bit intermediate values; then , perform the bit-exclusive OR operation on the result of the bit-exclusive OR operation and the constant C ₈ again, where C ₈ is equal to 0x55 (01010101b), and the correct coded XOR result is obtained, namely $\mathrm{Encode}(A_4\&CirclePlus;B_4)=\mathrm{Encode}\left(A_4\right)\&CirclePlus;\mathrm{Encode}\left(B_4\right)\&CirclePlus;0x55.$ Usually during cryptographic calculations,

is secret, so Encode(B _n ) is usually XORed with a constant first, and then XORed with Encode(A _n ) to prevent

Leaked when the result of the XOR operation with a constant

的公式仍然是 $\mathrm{Encode}(A_n\&CirclePlus;B_n)=\mathrm{Encode}\left(A_n\right)\&CirclePlus;(\mathrm{Encode}\left(B_n\right)\&CirclePlus;C_{2n}).$ 但是，其中的常量C_2n等于将10连接n次得到的长度为2n的比特串。The above is applicable to the case where 0 is coded as 01 and 1 is coded as 10. In actual use, 0 can be coded as 10 and 1 can be coded as 01 according to requirements. In this case, calculate

The formula is still $\mathrm{Encode}(A_{\mathrm{no}}\&CirclePlus;B_{\mathrm{no}})=\mathrm{Encode}\left(A_{\mathrm{no}}\right)\&CirclePlus;(\mathrm{Encode}\left(B_{\mathrm{no}}\right)\&CirclePlus;C_{2\mathrm{no}}).$ However, the constant C _2n is equal to the bit string of length 2n obtained by concatenating 10 n times.

bit permutation

The application of bit-balanced coding in bit permutation is shown in Figure 2; for uncoded intermediate values, the bit permutation operation is to permute n-bit intermediate values in units of 1 bit. After encoding, the bit length of the intermediate value is doubled to 2n bits. Therefore, the bit permutation operation becomes a permutation operation in units of 2 bits. For example, replace the i-th bit and the j-th bit of n-bit unencoded data, and for the encoded data, it is necessary to replace the two bits 2i, 2i+1 and the two bits 2j, 2j+1 replacement.

S box replacement operation

The application of bit-balanced coding in the S-box replacement operation is shown in Figure 3. Using the bit-balanced coding method to protect the S-box replacement operation, the S-box lookup table must be transformed first to generate a new S-box lookup table S′, Such that S'[A _n ]=Encode(S[A _n ]), i.e. encode only the S-box input (or S'[Encode(A _n )]=Encode(S[A _n ]), i.e. encode the S-box input at the same time and output), where Encode represents the operation of performing bit-balanced encoding on data, S[A _n ] represents the output of the S-box substitution operation obtained with _An as input, and the bit length of S[A _n ] is 2n. In other words, the output of the encoded S-box (ie, S') is obtained by encoding the output of the original S-box with the intermediate value _An . Depending on whether the input data of the S-box lookup table is coded, different processing methods are adopted. For an n-bit S-box, if the input data of the operation is coded, in other words, the input of the S-box lookup table is expanded from n bits to 2n bits, then the size of the S-box lookup table is correspondingly expanded from 2 ⁿ elements to 2 ²ⁿ elements. Among the 2 ²ⁿ possible inputs of the S-box lookup table after encoding, only 2 ⁿ conform to the encoding rules, and only the 2 ⁿ outputs corresponding to these 2 ⁿ inputs are correct, and the other 2 ²ⁿ -2 ⁿ words section is meaningless illegal data. This processing method ensures that the Hamming weights of the input and output data of the S-box substitution operation are constant, but it will cause the storage space of each S-box lookup table to increase by 2 ⁿ times of the original. It may not be available in the application environment. In another implementation, the input data of the S-box replacement operation is not encoded, and only the output data is encoded. At this time, the storage space of the S-box lookup table is the same as that of the unprotected S-box lookup table. The difference between these two processing methods lies only in whether the input data is encoded, and the output is an encoded 2n-bit intermediate value.

These two methods correspond to different security requirements and application scenarios. When the use environment of the cryptographic device is relatively safe or the hardware resources are insufficient, a more space-saving implementation solution may be adopted. On the contrary, if you want to obtain higher security, then you need more sufficient hardware resources to realize the input coded S-box replacement operation. Therefore, which implementation method to use in the specific implementation process needs to comprehensively consider the security of the use environment, the security requirements for implementation, and the resource conditions of the equipment used. There is usually a trade-off between security and implementation cost.

bit rotation operation

The application of bit-balanced coding in bit cyclic shift is shown in Figure 4. The cyclic shift operation changes the arrangement order of the bits of the intermediate value, but does not change the number of bits 0 and 1. When the cyclic shift operation is performed on the unencoded intermediate value, the number of shifted bits is a multiple of 1; since one bit is encoded as two bits in bit-balanced encoding, the cyclic shift is performed on the encoded intermediate value , the number of bits moved each time is a multiple of 2. The following formula describes the cyclic shift operation in the two cases of not adopting the defense measure of bit-balanced coding and adopting the defense measure of bit-balanced coding.

- Rotate operation without bit-balanced coding

V _n <<< m＝V[m]||V[m+1]||...||V[L-1]||V[0]||...||V[m-1 ]

- Rotate operation after encoding with bit balance

${\mathrm{<span\; class="notranslate">\; V</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; <</span><span\; class="notranslate">\; <</span><span\; class="notranslate">\; <</span>\mathrm{<span\; class="notranslate">\; 2</span>}\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; V</span>}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\stackrel{<span\; class="notranslate">\; ~</span>}{\mathrm{<span\; class="notranslate">\; V</span>}}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; V</span>}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\stackrel{<span\; class="notranslate">\; ~</span>}{\mathrm{<span\; class="notranslate">\; V</span>}}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; V</span>}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; L</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\stackrel{<span\; class="notranslate">\; ~</span>}{\mathrm{<span\; class="notranslate">\; V</span>}}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; L</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; V</span>}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\stackrel{<span\; class="notranslate">\; ~</span>}{\mathrm{<span\; class="notranslate">\; V</span>}}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; V</span>}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\stackrel{<span\; class="notranslate">\; ~</span>}{\mathrm{<span\; class="notranslate">\; V</span>}}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ]</span>$

Wherein, V _2n =Encode(V _n ). It can be found from the difference between the two implementations of the shift operation whether to use bit-balanced coding, that the coded cyclic shift output can be obtained only by doubling the number of shifts. In other words, if an m-bit cyclic shift operation is to be performed on the n-bit uncoded intermediate value, then a 2m-bit cyclic shift operation needs to be performed on the encoded 2n-bit intermediate value, 0<m<n, where m and n are Natural number.

abnormal situation

Bit-balanced coding is one bit represented by two complementary bits, when two identical bits such as 00 or 11 represent one bit, it is regarded as illegal coded data. To a large extent, it means that the cryptographic device has been disturbed or attacked, resulting in an error in its internal operation, resulting in illegal coding, and the cryptographic device is in an abnormal state at this time. Therefore, during the cryptographic operation, if an illegal code is encountered, the operation should be stopped immediately and a corresponding error should be reported to ensure that the cryptographic device will not output wrong calculation results.

Claims (10)

1. a cryptographic algorithm that is used to defend energy spectrometer to attack is realized guard method, the steps include:

1) input value of the cryptographic algorithm that needs protection is carried out the bit balance code: with bit value in the input traffic is that 0 data bit is encoded to bit 01, is that 1 data bit is encoded to bit 10 with bit value;

2) utilize the data behind the bit balance code to carry out crypto-operation, establishing cryptographic algorithm is n bit groupings cryptographic algorithm; Wherein:

A) for the bit xor operation in the crypto-operation, at first with Encode (A _n) and a Bit String (01) ₁(01) _nCarry out xor operation, then with XOR value that obtains and Encode (B _n) carry out xor operation; Encode (A _n) be the value of n Bit data A behind the bit balance code, Encode (B _n) be the value of n Bit data B behind the bit balance code;

B) for the operation of the bit permutation in the crypto-operation, with the 2i behind the bit balance code, two bits of 2i+1 and 2j, two bits of 2j+1 are replaced; Wherein, i, j are respectively i, the j bit that need replace before the coding;

C) for the bit circulative shift operation in the crypto-operation, the data behind the bit balance code are carried out 2m bit cyclic shift, wherein, the bit cyclic shift number of m for carrying out before encoding;

3) to step 2) output valve of computing decodes, and promptly the dibit with order output is one group, and the value of getting every group of last bit is as output valve.

2. the method for claim 1, it is characterized in that establishing the crypto-operation wheel sequence that needs protection is M, said input value is the crypto-operation median of N wheel in the cryptographic algorithm.

3. according to claim 1 or claim 2 method; It is characterized in that if the data of input S box are the bit balance codes, then at first S box look-up table being carried out conversion for the replacement of the S box in crypto-operation operation; Generate new S box look-up table S ', make S ' [Encode (A _n)]=Encode (S [A _n]); According to input data look-up table S ', obtain S box replacement operation dateout then; Wherein, Encode representes data are carried out the operation of bit balance code, S [A _n] represent with A _nThe output that the S box that obtains as input replaces and operates, A _nThe data of expression n bit un-encoded.

4. according to claim 1 or claim 2 method is characterized in that then at first calculating new S box look-up table S if importing the data of S box is not pass through coded data ", make S " [A _n]=Encode (S [A _n]), " carry out S box table lookup operation afterwards according to S.

5. the method for claim 1 is characterized in that said data A, B can be any bit length.

6. a cryptographic algorithm that is used to defend energy spectrometer to attack is realized guard method, the steps include:

1) input value of the cryptographic algorithm that needs protection being carried out the bit balance code, is that 0 digital coding is a bit 10 with bit value in the input traffic, will be that 1 digital coding is a bit 01 than characteristic value;

2) utilize the data behind the bit balance code to carry out crypto-operation, establishing cryptographic algorithm is n bit groupings cryptographic algorithm; Wherein:

A) for the bit xor operation in the crypto-operation, at first with Encode (A _n) and a Bit String (10) ₁(10) _nCarry out xor operation, then with XOR value that obtains and Encode (B _n) carry out xor operation; Encode (A _n) be the value of n Bit data A behind the bit balance code, Encode (B _n) be the value of n Bit data B behind the bit balance code;

B) for the operation of the bit permutation in the crypto-operation, with the 2i behind the coding, two bits of 2i+1 and 2j, two bits of 2j+1 are replaced; Wherein, i, j are respectively i, the j bit that need replace before the coding;

C) for the bit circulative shift operation in the crypto-operation, the data behind the bit balance code are carried out 2m bit cyclic shift, wherein, the bit cyclic shift number of m for carrying out before encoding;

3) to step 2) output valve of computing decodes, and promptly the dibit with order output is one group, and the value of getting a bit after every group is as output valve.

7. method as claimed in claim 6, it is characterized in that establishing the crypto-operation wheel sequence that needs protection is M, said input value is the crypto-operation median of N wheel in the cryptographic algorithm.

8. like claim 6 or 7 described methods; It is characterized in that if the data of input S box are the bit balance codes, then at first S box look-up table being carried out conversion for the replacement of the S box in crypto-operation operation; Generate new S box look-up table S ', make S ' [Encode (A _n)]=Encode (S [A _n]); According to input data look-up table S ', obtain S box replacement operation dateout then; Wherein, Encode representes data are carried out the operation of bit balance code, S [A _n] represent with A _nThe output that the S box that obtains as input replaces and operates, A _nThe data of expression n bit un-encoded.

9. like claim 6 or 7 described methods, it is characterized in that then at first calculating new S box look-up table S if importing the data of S box is not pass through coded data ", " [An]=Encode (S [An]) " carries out S box table lookup operation afterwards according to S to make S.

10. method as claimed in claim 6 is characterized in that said data A, B can be any bit length.

Images