CN111884794A - SM4 white box implementation method based on interference wheel and external coding - Google Patents

Abstract

The invention discloses an SM4 white box implementation method based on an interference wheel and external coding, which comprises the following steps: generating a reversible matrix and a vector at random, adding an interference wheel, and calculating composite affine transformation according to the obtained matrix and vector; inputting codes, namely combining the internal input codes with the external input codes, offsetting the influence of the F codes and adding the internal codes P; building an embedded round key and a T table; shifting operation and calculation; outputting codes, namely combining the internal output codes with the external output codes, and adding the external codes G while offsetting the internal codes; the reverse order operation of R results in the ciphertext being G encoded. The invention improves the SM4 white box realization method of Xiaoyanying et al, resists DCA attack by enhancing the linear transformation matrix density, increases a plurality of interference rounds at the end of the program to resist DFA attack, and finally increases external coding to improve the attack difficulty and enhance the safety of the realization of the SM4 white box.

Description

SM4 white box implementation method based on interference wheel and external coding

Technical Field

The invention relates to the technical field of information security, in particular to a white box SM4 encryption algorithm scheme based on a dynamic equivalent wheel.

Background

The SM4 encryption algorithm is a block cipher standard published in China and is widely used in various fields throughout the country.

White-box encryption is an encryption algorithm technology that can resist white-box attacks. In 2002, Chow et al first proposed the concept of white-box attack, and shaoying et al designed a white-box implementation of SM4 based on the SM4 block cipher algorithm.

The side channel attack attacks the encrypted electronic device against side channel information leakage such as time consumption, power consumption or electromagnetic radiation during the operation of the encrypted electronic device. Side channel attacks include Differential Fault Attacks (DFAs) and Differential Computational Analysis (DCAs). DCA and DFA attacks have so far broken the numerous white-box implementations proposed by academia.

The scheme of Xiaoyayinget al mainly has the following disadvantages:

1. in the scheme, the random matrix Q is difficult to generate to ensure that no row vector with the Hamming weight of 1 exists, and the vector can not resist DCA attack.

2. The white box in the scheme is fixed in structure, an attacker can construct a differential error attack relation through the last 2 rounds, extract round keys of the T table in the last round, and then recover all keys.

3. The input coding and the output coding in the scheme only apply the inner coding, and the outer coding protection is not added.

Disclosure of Invention

The invention aims to overcome the defects of the prior art and provides an SM4 white box implementation method based on an interference wheel and external coding, which resists DCA and DFA attacks by increasing the linear transformation matrix density, increasing the interference wheel at the end of a program, increasing random number interference and the like and increasing the external coding so as to enhance the security of SM4 white box implementation.

In order to achieve the purpose, the invention adopts the following technical scheme:

the invention provides an SM4 white box implementation method based on interference wheels and external coding, which comprises the following steps:

randomly generating a reversible matrix and vectors, wherein the Hamming weight of the reversible matrix is not 1, adding an interference wheel, calculating compound affine transformation according to the obtained matrix and vectors, and storing the matrix and constants obtained by the compound affine transformation;

inputting codes, namely combining the internal input codes with the external input codes, offsetting the influence of the F codes and adding the internal codes P; embedding a round key and a T table structure, generating the round key through a standard SM4 cryptographic algorithm, and embedding the key into an encryption process to construct a lookup table;

shifting operation and calculation are carried out; after the steps are subjected to multiple rounds of calculation, a ciphertext with codes is obtained;

outputting codes, namely combining the internal output codes with the external output codes, and adding the external codes G while offsetting the internal codes;

and R is performed in an inverted sequence, and the ciphertext coded by G is obtained through the R in an inverted sequence.

As a preferred technical solution, the reversible matrix is a 32-order reversible matrix, which specifically includes:

P₀,P₁,…,P_35+λ,Q₀,Q₁,…,Q_31+λ,E₀,E₁,…,E_31+λ,F₀,F₁,F₂,F₃,G₀,G₁,G₂,G₃

the above are reversible matrices of order 32 on GF (2);

the vector is a 32 × 1 random vector, and specifically includes:

p₀,p₁,…,p_35+λ,q₁,q₂,…,q_31+λ,e₁,e₂,…,e_31+λ,nk₀,nk₁,...,nk_λ/2

the above are random vectors of 32 × 1 over GF (2); wherein lambda is the number of interference adding rounds,

as a preferred technical solution, the calculating the complex affine transformation specifically includes:

D_r＝P_r+4·Q_r ^-1,d_r＝P_r+4·Q_r ^-1·q_r

C_r＝P_r+4·P_r ^-1,c_r＝P_r+4·P_r ^-1·p_r+p_r+4

where r is 0,1, 31+ λ, j is 0,1,2, D_r,C_r,M_r,jIs a 32 th order matrix on GF (2), d_r,c_r,m_r,jIs a 32 x 1 vector over GF (2).

As a preferred technical solution, the storing the result of the complex affine transformation specifically includes storing the following matrix and constants:

D_r,d_r,C_r,c_r,M_r,j,I_k,i_k,O_k,o_k,nk_t,r∈0,1,2,...,31+λ,j∈0,1,2,t∈0,1,...λ/2,k＝0,1,2,3。

as a preferred technical solution, the input code is specifically:

the internal input code is combined with the external input code, and specifically comprises the following steps:

I_k＝P_k·F_k ^-1,i_k＝p_k,k＝0,1,2,3

wherein, I_kIs a 32 th order matrix, i, over GF (2)_kIs a 32 x 1 vector over GF (2), reusing I_kFor input X_kThe coding specifically comprises:

X'_k＝I_k·X_k+i_k,k＝0,1,2,3

wherein, X'_kIs a 32 x 1 vector.

As a preferred technical solution, the embedded round key and the T table are specifically configured as follows:

generating 32 rounds of round keys rk through standard SM4 cipher algorithm in advance_rLet rk be_rDivided into four segments rk of length 8 bits_r,jIn the SM4 algorithm, the transformation function T is:

wherein, X_r+1,X_r+2,X_r+3Is a 32 x 1 vector, and takes part in the calculation of the round key_rThe value of (1) is divided into the states of a normal wheel and an interference wheel, and the interference wheels appear in pairs;

traversing 8-bit input value x, storing 32-bit output value y, and constructing 8-in 32-out lookup table

Table_r,j:GF(2⁸)→GF(2³²)

Wherein R is_r,0||R_r,1||R_r,2||R_r,3＝Q_r·L,R_r,jIs a matrix of 32 x 8, and is,

Table_r,jrepresenting an 8 in 32 out look up table.

As a preferred technical scheme, the round key_rThe method comprises the following specific steps:

wherein a is_j,j∈[0,3]Each of the length of which is 8 bits,

as a preferred technical solution, the shift operation and calculation specifically include:

before the r round, the calculation is performed with the shift operation ROT_r：

And (3) calculating:

wherein M is_r,jAnd m_r,jIs the result of the composite affine transformation;

remember y_r＝y_r,0||y_r,1||y_r,2||y_r,3From each y_r,jQuerying Table separately_r,j(y_r,j),j＝0,1,2,3

z_r,j＝Table_r,j(y_r,j),j＝0,1,2,3

Wherein z is calculated_r,jIs a 32-bit value;

and (3) calculating:

wherein D_r,d_r,C_r,c_rIs the result of the above-mentioned complex affine transformation;

after 32+ lambda rounds of calculation by the steps of shift operation and calculation, a cipher text with codes can be obtained.

As a preferred technical solution, the output code is specifically:

the internal output code is combined with the external output code, specifically:

wherein the calculated O_kIs a 32 th order matrix on GF (2), o_kIs a 32 x 1 vector over GF (2) with Y encoded intra-band_k' coding, in a specific manner:

Y_k＝O_k·Y′_k+o_k,k＝0,1,2,3

wherein Y is obtained_kIs a 32 x 1 vector.

Compared with the prior art, the invention has the following advantages and beneficial effects:

1. based on the thought of variable round number, the invention leads the boundary between the rounds to become fuzzy in the encryption process, increases the attack difficulty and improves the security of the encryption process.

2. The scheme of the invention adds external coding and can effectively resist DFA and DCA attacks.

3. The invention provides the requirement that the Hamming weight of the row vector is more than 1 for the matrix Q, and enhances the capability of resisting DCA attack.

4. According to the invention, a plurality of interference rounds which appear in pairs are added in the last round realized by the white box, the secret key hidden in the interference round is the false secret key nk, an attacker cannot restore the real secret key after obtaining the secret key, and the DFA attack resistance is enhanced.

Drawings

FIG. 1 is a flow chart of a method for implementing the white box SM4 according to the invention;

FIG. 2 is a schematic diagram of a white box SM4 implementation method round function of the present invention;

FIG. 3 is a block diagram of a dynamic equivalent wheel T table according to the present invention;

FIG. 4 shows the ROT of the present invention_rSchematic diagram of the shifting method.

Detailed Description

The present invention will be described in further detail with reference to examples and drawings, but the present invention is not limited thereto.

Examples

The SM4 white box implementation method based on the interference wheel and the external coding resists DCA and DFA attacks by enhancing the density of the linear transformation matrix, increasing the interference wheel in the last wheel of the program, increasing the random number interference and the like and increasing the external coding, so as to enhance the security of the SM4 white box implementation. The embodiment is based on an interference wheel and an SM4 white box implementation method of external coding, as shown in fig. 1, and includes the following steps:

s1, randomly generating a reversible matrix and vectors, wherein the value of Hamming weight 1 does not exist in all row vectors in the reversible matrix, and adding an interference wheel:

P₀,P₁,…,P_35+λ,Q₀,Q₁,…,Q_31+λ,E₀,E₁,…,E_31+λ,F₀,F₁,F₂,F₃,G₀,G₁,G₂,G₃

the above are reversible matrices of order 32 on GF (2);

and the following 32 × 1 random vector:

p₀,p₁,…,p_35+λ,q₁,q₂,…,q_31+λ,e₁,e₂,…,e_31+λ,nk₀,nk₁,...,nk_λ/2

the above are random vectors of 32 × 1 over GF (2);

wherein the number of interference rounds lambda is the number of interference rounds added,

and calculating the following complex affine transformation according to the generated matrix and the vector thereof:

D_r＝P_r+4·Q_r ^-1,d_r＝P_r+4·Q_r ^-1·q_r

C_r＝P_r+4·P_r ^-1,c_r＝P_r+4·P_r ^-1·p_r+p_r+4

I_k＝P_k·F_k ^-1,i_k＝p_k

where r is 0,1, 31, λ, j is 0,1,2, k is 0,1,2,3, D_r,C_r,M_r,jIs a 32 th order matrix on GF (2), d_r,c_r,m_r,jIs a 32 x 1 vector over GF (2).

And storing the following matrixes and constants according to the obtained calculation result:

D_r,d_r,C_r,c_r,M_r,j,I_k,i_k,O_k,o_k,nk_t,r∈0,1,2,...,31+λ,j∈0,1,2,t∈0,1,...λ/2,k＝0,1,2,3。

s2, inputting codes, namely combining the internal input codes with the external input codes; assume a 128 bit input (T)₀,T₁,T₂,T₃) Has been input into the code F code, X_i＝F_i·X_iAnd i is 0,1,2 and 3. Therefore, for the input code, it is necessary to cancel the influence of F first and then add the inner codes P, P and F^-1Can be combined into I_kThe method specifically comprises the following steps:

I_k＝P_k·F_k ^-1,i_k＝p_k,k＝0,1,2,3

reuse I_kFor input X_kCoding to obtain X'_kThe method specifically comprises the following steps:

X'_k＝I_k·X_k+i_k,k＝0,1,2,3。

s3, constructing an embedded round key and a T table, and embedding the key into the encryption process through the embedded round key, so that the encryption key does not need to be input before encryption; the T-table is constructed as shown in FIG. 3.

Generating 32-bit round key rk by standard SM4 cipher algorithm in advance_rLet rk be_rDivided into four segments rk of length 8 bits_r,j. In the SM4 algorithm, the transformation function T is as follows:

wherein, X_r+1,X_r+2,X_r+3Is a 32 × 1 vector, key_rIs divided into the states of normal wheel and disturbance wheel, the disturbance wheel appearing in pairs, in particularAs follows:

wherein a is_j,j∈[0,3]Each of the length of which is 8 bits,

an 8-in 32-out lookup table is constructed below (traversing 8-bit input value x, storing 32-bit output value y)

Table_r,j:GF(2⁸)→GF(2³²)

Wherein R is_r,0||R_r,1||R_r,2||R_r,3＝Q_r·L,R_r,jIs a matrix of 32 x 8, and is,

Table_r,jlook-up table showing 8 in and 32 out

S4, shift operation and calculation, in the r th wheel, by the input (X'_r,X′_r+1,X′_r+2,X′_r+3) Calculating X'_r+4The process of (2) is as follows:

since the disturbing wheel is added at the 33 rd wheel (x-32), the shift operation ROT needs to be performed before the calculation_rAs shown in fig. 4.

Shift operation (ROT)_r)：

The calculation, as shown in fig. 2, is as follows:

wherein M is_r,jAnd m_r,jIs the result of the composite affine transformation;

remember y_r＝y_r,0||y_r,1||y_r,2||y_r,3From each y_r,jQuerying Table separately_r,j(y_r,j),j＝0,1,2,3

z_r,j＝Table_r,j(y_r,j),j＝0,1,2,3

Specifically, the calculation is as follows:

wherein D_r,d_r,C_r,c_rIs the result of the above-mentioned complex affine transformation;

after 32+ lambda rounds of calculation in step S4, a ciphertext (Y) with a code can be obtained₀',Y₁',Y₂',Y₃')。

S5, outputting codes, and combining the internal output codes with the external output codes; adding an outer code G while offsetting the inner code, specifically:

combining the internal output code with the external output code, specifically:

wherein the calculated O_kIs a 32 th order matrix on GF (2), o_kIs a 32 x 1 vector over GF (2) with Y encoded intra-band_k' coding, in a specific manner:

Y_k＝O_k·Y′_k+o_k,k＝0,1,2,3

wherein Y is obtained_kIs a 32 x 1 vector.

S6, R reverse order operation, and G coded ciphertext (Y) is obtained after R reverse order operation₃,Y₂,Y₁,Y₀) The encoding of G cancels out during use.

It should also be noted that in this specification, terms such as "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.

The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (9)

1. The SM4 white box implementation method based on the interference wheel and the external coding is characterized by comprising the following steps of:

randomly generating a reversible matrix and vectors, wherein the Hamming weight of the reversible matrix is not 1, adding an interference wheel, calculating compound affine transformation according to the obtained matrix and vectors, and storing the matrix and constants obtained by the compound affine transformation;

inputting codes, namely combining the internal input codes with the external input codes, offsetting the influence of the F codes and adding the internal codes P; embedding a round key and a T table structure, generating the round key through a standard SM4 cryptographic algorithm, and embedding the key into an encryption process to construct a lookup table;

shifting operation and calculation are carried out; after the steps are subjected to multiple rounds of calculation, a ciphertext with codes is obtained;

outputting codes, namely combining the internal output codes with the external output codes, and adding the external codes G while offsetting the internal codes;

and R is performed in an inverted sequence, and the ciphertext coded by G is obtained through the R in an inverted sequence.

2. The SM4 white-box implementation method based on interference wheels and external coding of claim 1, wherein the invertible matrix is a 32-order invertible matrix, specifically:

P₀,P₁,…,P_35+λ,Q₀,Q₁,…,Q_31+λ,E₀,E₁,…,E_31+λ,F₀,F₁,F₂,F₃,G₀,G₁,G₂,G₃

the above are reversible matrices of order 32 on GF (2);

the vector is a 32 × 1 random vector, and specifically includes:

p₀,p₁,…,p_35+λ,q₁,q₂,…,q_31+λ,e₁,e₂,…,e_31+λ,nk₀,nk₁,...,nk_λ/2

the above are random vectors of 32 × 1 over GF (2); where λ is the number of added interference rounds, E_r＝diag(E_r,0,E_r,1,E_r,2,E_r,3),

3. The SM4 white-box implementation method based on interference wheels and external coding according to claim 2, wherein the computing of the complex affine transformation is specifically:

D_r＝P_r+4·Q_r ^-1,d_r＝P_r+4·Q_r ^-1·q_r

C_r＝P_r+4·P_r ^-1,c_r＝P_r+4·P_r ^-1·p_r+p_r+4

where r is 0,1, 31+ λ, j is 0,1,2, D_r,C_r,M_r,jIs a 32 th order matrix on GF (2), d_r,c_r,m_r,jIs a 32 x 1 vector over GF (2).

4. The SM4 white-box implementation method based on interference wheels and external coding according to claim 3, wherein the storing of the result of the complex affine transformation is specifically to store the following matrices and constants:

D_r,d_r,C_r,c_r,M_r,j,I_k,i_k,O_k,o_k,nk_t,r∈0,1,2,...,31+λ,j∈0,1,2,t∈0,1,...λ/2,k＝0,1,2,3。

5. the SM4 white box implementation method based on interference wheels and external coding as claimed in claim 1, wherein the input coding is specifically:

the internal input code is combined with the external input code, and specifically comprises the following steps:

I_k＝P_k·F_k ^-1,i_k＝p_k,k＝0,1,2,3

wherein, I_kIs a 32 th order matrix, i, over GF (2)_kIs a 32 x 1 vector over GF (2), reusing I_kFor input X_kThe coding specifically comprises:

X'_k＝I_k·X_k+i_k,k＝0,1,2,3

wherein, X'_kIs a 32 x 1 vector.

6. The SM4 white box implementation method based on interference round and outer coding of claim 1, wherein the embedded round key and T table construction specifically is:

generating 32 rounds of round keys rk through standard SM4 cipher algorithm in advance_rLet rk be_rDivided into four segments rk of length 8 bits_r,jIn the SM4 algorithm, the transformation function T is:

wherein, X_r+1,X_r+2,X_r+3Is a 32 x 1 vector, and takes part in the calculation of the round key_rThe value of (1) is divided into the states of a normal wheel and an interference wheel, and the interference wheels appear in pairs;

traversing 8-bit input value x, storing 32-bit output value y, and constructing 8-in 32-out lookup table

Table_r,j:GF(2⁸)→GF(2³²)

Wherein R is_r,0||R_r,1||R_r,2||R_r,3＝Q_r·L,R_r,jIs a matrix of 32 x 8, and is,

Table_r,jrepresenting an 8 in 32 out look up table.

7. The SM4 white-box implementation method based on interference round and outer coding of claim 6, wherein the round key_rThe method comprises the following specific steps:

wherein a is_j,j∈[0,3]Each of the length of which is 8 bits,

8. the SM4 white-box implementation method based on interference wheels and external coding according to claim 3, wherein the shifting operation and calculation are specifically:

before the r round, the calculation is performed with the shift operation ROT_r：

And (3) calculating:

wherein M is_r,jAnd m_r,jIs the result of the composite affine transformation;

remember y_r＝y_r,0||y_r,1||y_r,2||y_r,3From each y_r,jQuerying Table separately_r,j(y_r,j),j＝0,1,2,3

z_r,j＝Table_r,j(y_r,j),j＝0,1,2,3

Wherein z is calculated_r,jIs a 32-bit value;

and (3) calculating:

wherein D_r,d_r,C_r,c_rIs the result of the above-mentioned complex affine transformation;

after 32+ lambda rounds of calculation by the steps of shift operation and calculation, a cipher text with codes can be obtained.

9. The SM4 white box implementation method based on interference wheels and external coding as claimed in claim 1, wherein the output coding is specifically:

the internal output code is combined with the external output code, specifically:

wherein the calculated O_kIs a 32 th order matrix on GF (2), o_kIs a 32 x 1 vector over GF (2), and is additionally provided with intra-coded Y'_kThe coding is specifically as follows:

Y_k＝O_k·Y'_k+o_k,k＝0,1,2,3

wherein Y is obtained_kIs a 32 x 1 vector.

Images