CN105703896A - Method for detecting resistance of HAS-160 algorithm to differential fault attack - Google Patents

Abstract

The invention relates to a method for detecting resistance of an HAS-160 algorithm to a differential fault attack. The method includes the steps of: randomly generating a plaintext message to be processed; utilizing the HAS-160 algorithm to process the plaintext message to obtain correct output and error output; calculating difference values of the correct output and the error output; and analyzing the difference values, judging whether the HAS-160 algorithm is influenced by a differential fault attack, deriving the position of fault import, and analyzing validity of the position. The method provided by the invention can assess the capability of the HAS-160 algorithm of resisting the differential fault attack.

Description

A kind of method that the HAS-160 of detection algorithm resists differential fault attack

Technical field

The present invention relates to cryptographic algorithm security fields, particularly relate to a kind of method that the HAS-160 of detection algorithm resists differential fault attack。

Background technology

From ancient times to the present, information security issue is always up the object that people pay close attention to, and along with popularizing of digital management, information security issue has been amplified into the problem of algorithm security in cryptography。HAS-160 algorithm is the hash function used in Korea S's DSS, and it is similar to that SHA-1 algorithm, has done some changes increasing algorithm intensity on the basis of SHA-1。HAS-160 algorithm does not circulate when expansion is expressly so that algorithm security is greatly increased, but the block cipher characteristic of HAS-160 algorithm, cause it can not escape from the threat of differential fault attack。

The characteristic of the differential fault attack structure for block cipher and round function, fault attacks is in conjunction with difference analysis, by many experiments, imports fault when algorithm performs, and analyzing it affects ciphertext, calculates possible key, finally obtains key。There is presently no disclosed report review HAS-160 algorithm and resist the ability of differential fault attack, this leaves potential safety hazard to the product being currently in use HAS-160 algorithm packaging。

Symbol description:

M: clear-text message；

Correct output after C: under normal condition, HAS-160 algorithm process message；

C^*: import the mistake output of fault during HAS-160 algorithm for encryption；

Δ C: correct output C exports C with mistake^*Between difference value；

XOR；

A, B, C, D, E: buffer registers, each size is 32bit；

ΔC₀、ΔC₁、ΔC₂、ΔC₃、ΔC₄: represent in buffer area last difference taking turns output result respectively；

A_i,B_i,C_i,D_i,E_i: the value in the i-th step buffer area, i ∈ [0,79]。

Summary of the invention

The technical problem to be solved is to provide a kind of method that the HAS-160 of detection algorithm resists differential fault attack, it is possible to evaluates HAS-160 algorithm and resists the ability of differential fault attack。

The technical solution adopted for the present invention to solve the technical problems is: a kind of method providing the HAS-160 of detection algorithm to resist differential fault attack, comprises the following steps:

(1) stochastic generation clear-text message to be processed；

(2) utilize clear-text message described in HAS-160 algorithm process, obtain correct output and mistake output；

(3) difference value of correct output and mistake output is calculated；

(4) difference value is analyzed, it is judged that whether HAS-160 algorithm is subject to the impact of differential fault attack, and derives the position that fault imports, and analyzes its effectiveness。

Described step (4) is specific as follows: make difference value Δ C=(Δ C₀, Δ C₁, Δ C₂, Δ C₃, Δ C₄), it is stored in the buffer area of 160 bits, the buffer area depositor (Α, Β, C, D, E) of 5 32 bit long represents, wherein, Δ C₀, Δ C₁, Δ C₂,ΔC₃With Δ C₄It is 32 bits, represents in buffer area last difference taking turns output result respectively；Wherein, the efficiency analysis of abort situation is as follows:

Effective fault:

I) as Δ C₀、ΔC₁、ΔC₂、ΔC₃When ≠ 0, the position that fault imports is A₇₇；

Ii) as Δ C₀、ΔC₁、ΔC₂、ΔC₄When ≠ 0, the position that fault imports is B₇₇；

Iii) as Δ C₀、ΔC₁、ΔC₂、ΔC₃、ΔC₄In when being all not 0, the position that fault imports is A₇₆And A₇₆Any position before；

Invalid failures:

I) as difference value Δ C=0, illustrating that the fault value imported is equal to the initial value on current location, is equivalently employed without importing fault, fault is invalid；

II) when difference value Δ C ≠ 0:

I) as Δ C₀、ΔC₁、ΔC₂、ΔC₃、ΔC₄In have and only have one when being not 0,

A) as Δ C₀When ≠ 0, the position that fault imports is A₈₀Or E₇₉；

B) as Δ C₁When ≠ 0, the position that fault imports is B₈₀；

C) as Δ C₂When ≠ 0, the position that fault imports is C₈₀；

D) as Δ C₃When ≠ 0, the position that fault imports is D₈₀；

E) as Δ C₄When ≠ 0, the position that fault imports is E₈₀；

Ii) as Δ C₀、ΔC₁、ΔC₂、ΔC₃、ΔC₄In only two while when being not 0,

A) as Δ C₀≠ 0 and Δ C₁When ≠ 0, the position that fault imports is A₇₉；

B) as Δ C₀≠ 0 and Δ C₂When ≠ 0, the position that fault imports is B₇₉；

C) as Δ C₀≠ 0 and Δ C₃When ≠ 0, the position that fault imports is C₇₉；

D) as Δ C₀≠ 0 and Δ C₄When ≠ 0, the position that fault imports is D₇₉；

Iii) as Δ C₀、ΔC₁、ΔC₂、ΔC₃、ΔC₄In only three while when being not 0,

A) as Δ C₀、ΔC₁With Δ C₂When ≠ 0, the position that fault imports is A₇₈；

B) as Δ C₀、ΔC₁With Δ C₃When ≠ 0, the position that fault imports is B₇₈；

C) as Δ C₀、ΔC₁With Δ C₄When ≠ 0, the position that fault imports is C₇₈。

Described step (2) specifically includes following sub-step:

(21) input clear-text message, Control release environment is not by the interference of other any uncorrelated things so that HAS-160 algorithm can correctly carry out, thus obtaining correct output result, is designated as correct output；

(22) re-entering clear-text message, again with HAS-160 algorithm, it is processed, change running environment by physical equipment simultaneously, induction produces fault and disturbs the processing procedure of HAS-160 algorithm, and output result is designated as mistake output。

Described step (22) changes clock, voltage, humidity, radiation, pressure, light and/or vortex flow by physical equipment fault is imported randomly HAS-160 algorithm process flow process, to obtain the output result of mistake。

Beneficial effect

Owing to have employed above-mentioned technical scheme, the present invention is compared with prior art, have the following advantages that and good effect: method provided by the invention is accurate and simple, it is easily achieved, it is possible not only to the assessment HAS-160 algorithm resistivity to differential fault attack, the position of differential fault attack can also be derived, provide theoretical foundation to the safety determination of the product using HAS-160 algorithm packaging。

Accompanying drawing explanation

Fig. 1 is the flow chart of the present invention；

Fig. 2 is the differential fault analysis figure of HAS-160 algorithm；

Fig. 3 is the experimental situation schematic diagram of this programme。

Detailed description of the invention

Below in conjunction with specific embodiment, the present invention is expanded on further。Should be understood that these embodiments are merely to illustrate the present invention rather than restriction the scope of the present invention。In addition, it is to be understood that after having read the content that the present invention lectures, the present invention can be made various changes or modifications by those skilled in the art, and these equivalent form of values fall within the application appended claims limited range equally。

When using HAS-160 algorithm to use same key to process for same message M, if experimental situation (such as clock, voltage, humidity, radiation, pressure, light and vortex flow etc.) is different, assailant can obtain correct output C and mistake output C respectively^*, by calculating the output difference value of the two value (namely), key message can be derived。Assailant can run induced failure during HAS-160 algorithm at the equipment of process and occur, but do not know particular location that fault occurs and concrete improper value。Deriving the position that fault imports under given conditions from difference delta C, the fault now imported is called effective fault。On the contrary, in time importing fault and be invalid failures, the fault of this importing offers help to analysis key, namely can not obtain important information by Δ C。

Fig. 1 is the flow chart that detection HAS-160 algorithm provided by the invention resists the method for differential fault attack, and described detection HAS-160 algorithm is resisted the method for differential fault attack and comprised the steps:

Step 1: the current message to be processed of stochastic generation, is designated as M；

Step 2: process message M, obtains correct output and mistake output, is designated as C and C respectively^*；

Step 3: calculate correct ciphertext C and mistake ciphertext C^*Difference value, result is designated as Δ C；

Step 4: analyze Δ C, infers importing position, and whether judge to import fault effective。

For step 2, with HAS-160 algorithm to M process, in experimentation, running environment is implemented control two kinds different, it may be assumed that

(1) input message M, Control release environment is not by the interference of other any uncorrelated things so that HAS-160 algorithm can correctly carry out, thus obtaining correct output result, is designated as C；

(2) re-entering message M, again with HAS-160 algorithm, it is processed, change running environment by other physical equipments simultaneously, induction produces fault and disturbs the processing procedure of HAS-160 algorithm, and output result is designated as C^*。

Wherein, the method that in step (2), induced failure produces includes: change clock, voltage, humidity, radiation, pressure, light and vortex flow etc.；

For step 3, calculate differenceWhereinRepresenting XOR, Δ C is 160 bits, makes Δ C=(Δ C₀, Δ C₁, Δ C₂, Δ C₃, Δ C₄), it is stored in the buffer area of 160 bits, the buffer area depositor (Α, Β, C, D, E) of 5 32 bit long represents, makes Δ C=(Δ C₀, Δ C₁, Δ C₂, Δ C₃, Δ C₄), Δ C₀, Δ C₁, Δ C₂,ΔC₃With Δ C₄It is 32 bits, represents in buffer area last difference taking turns output result respectively；

For step 4, to the difference analysis of Δ C and determine that the principle of abort situation is as follows:

Message is processed by HAS-160 algorithm by the unit that is grouped into of 512 bit long, altogether being taken turns computing by 4 to form, buffer area is all carried out 20 step interative computations by each wheel, is output as the hash value of 160 bits, the intermediate object program of HAS-160 and final result are stored in the buffer area of 160 bits, buffer area depositor (A, B, the C of 5 32 bit long, D, E) represent, as in figure 2 it is shown, the iterative formula of i+1 step is as follows:

$A_{i+1}=S_P\left(A_i\right)\⊕f_i(B_i,C_i,D_i)\⊕E_i\⊕W_i\⊕K_i,$

B_i+1=A_i,

C_i+1=S_q(B_i),

D_i+1=C_i,

E_i+1=D_i,

Wherein,Represent XOR；I is the step number of iteration, i ∈ [0,79]；A_i, B_i, C_i, D_i, E_iIt it is the value in the i-th step buffer area；F_i(B, C, D) is the compression function of the i-th step；S_P(T) the variable T ring shift left p position of 32 bits is represented；From set, { 5,11,7,15,6,13,8,14,7,12,9,11,8,15,6,12,9,14,5,13} and set { obtain 10,17,25,30} p and q at random respectively；W_iIt it is the word of 32 bit long that the packet from 512 bits being currently entered is derived；K_iIt it is addition constant。

The correct output C of HAS-160 algorithm is:

$C=(A_{80}\⊕A_0,B_{80}\⊕B_0,C_{80}\⊕C_0,D_{80}\⊕D_0,E_{80}\⊕E_0),$

(A₀,B₀,C₀,D₀,E₀) for the initial value in buffer area, substituted into above-mentioned equation and can obtain last output result (A₈₀,B₈₀,C₈₀,D₈₀,D₈₀)。At this,

$A_{80}=S_P\left(A_{79}\right)\⊕f_{79}(B_{79},C_{79},D_{79})\⊕E_{79}\⊕W_{79}\⊕K_{79},$

By B₈₀=A₇₉, C₈₀=S_q(B₇₉), D₈₀=C₇₉, E₈₀=D₇₉, bring A into₈₀, learn in above-mentioned equation, only W₇₉And E₇₉Unknown, and assailant be intended to recover W₇₉If, E₇₉Value be known, then W₇₉Just can be solved by below equation and obtain:

$W_{79}=A_{80}\⊕f_{79}\left({S_q}^{-1}\left(C_{80}\right),D_{80},E_{80}\right)\⊕E_{79}\⊕S_p\left(B_{80}\right)\⊕K_{79},$

According to the known E of algorithm structure₇₉=D₇₈, namely try to achieve D₇₈Value just may know that E₇₉, thus can derive W₇₉。

In like manner, it is also possible to obtain:

$W_{78}=B_{80}\⊕f_{78}\left({S_q}^{-1}\left(D_{80}\right),E_{80}.D_{78}\right)\⊕S_p\left({S_q}^{-1}\left(C_{80}\right)\right)\⊕E_{78}\⊕K_{78}$

Above formula to be derived W₇₈, it is necessary to know D₇₈And E₇₈, again because of E₇₈=D₇₇, so it is to be appreciated that D₇₇And D₇₈Value, just can try to achieve W₇₈。

By analyzing when the position that fault imports is at B₇₇Time, it is possible to try to achieve D₇₇And D₇₈Value, and then derive W₇₈And W₇₉。By the structure of HAS-160 algorithm it can be seen that should fault import at A together₇₆Time, import at B with fault₇₇Time effect be identical。Thus A₇₆Or B₇₇For effective abort situation。

Wherein, the effectiveness to abort situation, make a concrete analysis of as follows:

1. effective fault:

I () is as Δ C₀、ΔC₁、ΔC₂、ΔC₃When ≠ 0, the position that fault imports is A₇₇；

(ii) as Δ C₀、ΔC₁、ΔC₂、ΔC₄When ≠ 0, the position that fault imports is B₇₇；

(iii) as Δ C₀、ΔC₁、ΔC₂、ΔC₃、ΔC₄In when being all not 0, the position that fault imports is A₇₆And A₇₆Any position before。

2. invalid failures:

(I) as Δ C=0, illustrating that the fault value imported is equal to the initial value on current location, is equivalently employed without importing fault, fault is invalid；

(II) when Δ C ≠ 0:

I () is as Δ C₀、ΔC₁、ΔC₂、ΔC₃、ΔC₄In have and only have one when being not 0,

A () is as Δ C₀When ≠ 0, the position that fault imports is A₈₀Or E₇₉；

B () is as Δ C₁When ≠ 0, the position that fault imports is B₈₀；

C () is as Δ C₂When ≠ 0, the position that fault imports is C₈₀；

D () is as Δ C₃When ≠ 0, the position that fault imports is D₈₀；

E () is as Δ C₄When ≠ 0, the position that fault imports is E₈₀；

(ii) as Δ C₀、ΔC₁、ΔC₂、ΔC₃、ΔC₄In only two while when being not 0,

A () is as Δ C₀≠ 0 and Δ C₁When ≠ 0, the position that fault imports is A₇₉；

B () is as Δ C₀≠ 0 and Δ C₂When ≠ 0, the position that fault imports is B₇₉；

C () is as Δ C₀≠ 0 and Δ C₃When ≠ 0, the position that fault imports is C₇₉；

D () is as Δ C₀≠ 0 and Δ C₄When ≠ 0, the position that fault imports is D₇₉；

(iii) as Δ C0, Δ C₁、ΔC₂、ΔC₃、ΔC₄In only three while when being not 0,

A () is as Δ C₀、ΔC₁With Δ C₂When ≠ 0, the position that fault imports is A₇₈；

B () is as Δ C₀、ΔC₁With Δ C₃When ≠ 0, the position that fault imports is B₇₈；

C () is as Δ C₀、ΔC₁With Δ C₄When ≠ 0, the position that fault imports is C₇₈。

To sum up analyze, as Δ C₀、ΔC₁、ΔC₂、ΔC₃When ≠ 0, the abort situation of importing is A₇₇, as Δ C₀、ΔC₁、ΔC₂、ΔC₄When ≠ 0, the abort situation of importing is B₇₇, as Δ C₀、ΔC₁、ΔC₂、ΔC₃、ΔC₄In when being all not 0, the abort situation of importing is A₇₆And A₇₆Any position before, these positions are effective fault and import position。

For above-mentioned execution step, choice experiment environment is as it is shown on figure 3, its Computer is used for producing the input message M of HAS-160 and analyzing output result；It is packaged with the equipment of HAS-160 algorithm for processing the message of input, namely message M is encrypted；The equipment producing fault is used for changing experiment execution environment, it is therefore an objective to disturbing the processing procedure to input message, thus realizing importing fault function, producing wrong output result。

Utilize above-mentioned analysis method, the present invention is on the computer of Intel (R) Core (TM) i3-2350MCPU2.30GHz4GB internal memory, adopt Java language programming to carry out simulated failure under Eclipse developing instrument to import and message processing procedure, repeat 2000 times, test result indicate that above-mentioned detection method is accurate。The safety that the method is assessment HAS-160 algorithm provides sufficient theoretical foundation, and the method is simple to operate, and result of calculation is accurate。

Claims (4)

1. one kind is detected the method that HAS-160 algorithm resists differential fault attack, it is characterised in that comprise the following steps:

(1) stochastic generation clear-text message to be processed；

(2) utilize clear-text message described in HAS-160 algorithm process, obtain correct output and mistake output；

(3) difference value of correct output and mistake output is calculated；

(4) difference value is analyzed, it is judged that whether HAS-160 algorithm is subject to the impact of differential fault attack, and derives the position that fault imports, and analyzes its effectiveness。

2. the method that detection HAS-160 algorithm according to claim 1 resists differential fault attack, it is characterised in that described step (4) is specific as follows: make difference value Δ C=(Δ C₀, Δ C₁, Δ C₂, Δ C₃, Δ C₄), it is stored in the buffer area of 160 bits, the buffer area depositor (Α, Β, C, D, E) of 5 32 bit long represents, wherein, Δ C₀, Δ C₁, Δ C₂,ΔC₃With Δ C₄It is 32 bits, represents in buffer area last difference taking turns output result respectively；Wherein, the efficiency analysis of abort situation is as follows:

Effective fault:

I) as Δ C₀、ΔC₁、ΔC₂、ΔC₃When ≠ 0, the position that fault imports is A₇₇；

Ii) as Δ C₀、ΔC₁、ΔC₂、ΔC₄When ≠ 0, the position that fault imports is B₇₇；

Iii) as Δ C₀、ΔC₁、ΔC₂、ΔC₃、ΔC₄In when being all not 0, the position that fault imports is A₇₆And A₇₆Any position before；

Invalid failures:

I) as difference value Δ C=0, illustrating that the fault value imported is equal to the initial value on current location, is equivalently employed without importing fault, fault is invalid；

II) when difference value Δ C ≠ 0:

I) as Δ C₀、ΔC₁、ΔC₂、ΔC₃、ΔC₄In have and only have one when being not 0,

A) as Δ C₀When ≠ 0, the position that fault imports is A₈₀Or E₇₉；

B) as Δ C₁When ≠ 0, the position that fault imports is B₈₀；

C) as Δ C₂When ≠ 0, the position that fault imports is C₈₀；

D) as Δ C₃When ≠ 0, the position that fault imports is D₈₀；

E) as Δ C₄When ≠ 0, the position that fault imports is E₈₀；

Ii) as Δ C₀、ΔC₁、ΔC₂、ΔC₃、ΔC₄In only two while when being not 0,

A) as Δ C₀≠ 0 and Δ C₁When ≠ 0, the position that fault imports is A₇₉；

B) as Δ C₀≠ 0 and Δ C₂When ≠ 0, the position that fault imports is B₇₉；

C) as Δ C₀≠ 0 and Δ C₃When ≠ 0, the position that fault imports is C₇₉；

D) as Δ C₀≠ 0 and Δ C₄When ≠ 0, the position that fault imports is D₇₉；

Iii) as Δ C₀、ΔC₁、ΔC₂、ΔC₃、ΔC₄In only three while when being not 0,

A) as Δ C₀、ΔC₁With Δ C₂When ≠ 0, the position that fault imports is A₇₈；

B) as Δ C₀、ΔC₁With Δ C₃When ≠ 0, the position that fault imports is B₇₈；

C) as Δ C₀、ΔC₁With Δ C₄When ≠ 0, the position that fault imports is C₇₈。

3. the method that detection HAS-160 algorithm according to claim 1 resists differential fault attack, it is characterised in that described step (2) specifically includes following sub-step:

(21) input clear-text message, Control release environment is not by the interference of other any uncorrelated things so that HAS-160 algorithm can correctly carry out, thus obtaining correct output result, is designated as correct output；

(22) re-entering clear-text message, again with HAS-160 algorithm, it is processed, change running environment by physical equipment simultaneously, induction produces fault and disturbs the processing procedure of HAS-160 algorithm, and output result is designated as mistake output。

4. the method that detection HAS-160 algorithm according to claim 3 resists differential fault attack, it is characterized in that, described step (22) changes clock, voltage, humidity, radiation, pressure, light and/or vortex flow by physical equipment fault is imported randomly HAS-160 algorithm process flow process, to obtain the output result of mistake。