KR102404223B1 - Apparatus and method for encryption generating using key dependent layer, computer-readable storage medium and computer program - Google Patents

Abstract

An apparatus for generating encryption using a key-dependent layer according to an embodiment comprises: a first key-dependent layer that receives data as an input and outputs an intermediate value of the data; and an encryption unit that receives an intermediate value of the data as an input and outputs encrypted data; , a second key-dependent layer that receives the encrypted data as input and outputs protected encrypted data, and a key scheduler that provides a round key value to the first key-dependent layer, the encryption unit, and the second key-dependent layer. may include

Description

Apparatus and method for generating a password using a key-dependent layer, a computer-readable recording medium, and a computer program

The embodiment relates to a technique for preventing an attacker from guessing an intermediate value in a situation where a side-channel attack is possible on an encryption device.

In general, the following techniques may be used as a technique for generating a password.

Masking

의 암호문

을 구한 후, 최종적으로 y를 얻기 위해

의 연산을 수행한다. (경우에 따라 마스킹 기법은 다르게 구성한다.) 따라서 암호화 중 중간 값을 알 수 없기 때문에 일반적인 전력 분석 공격은 성공할 수 없다.The masking technique is one of several countermeasures against power analysis attacks. The masking technique uses a masking random number m to obtain a ciphertext y for a plaintext x.

ciphertext of

After finding , to finally get y

perform the operation of (In some cases, the masking technique is configured differently.) Therefore, a general power analysis attack cannot succeed because the intermediate value during encryption cannot be known.

Branch Number of Linear Operation

의 s 비트 크기의 워드에 대한 Branch Number

는 다음과 같이 정의된다.The branch number of a linear operation represents a numerical value of the degree of diffusion of a linear operation, and the larger the value, the higher the diffusion effect can be guaranteed. given linear operation

Branch Number for a word of s bit size

is defined as

는 벡터 α의 n_s개의 원소

중 값이 0이 아닌 원소의 개수를 뜻한다.here,

is the n _s elements of the vector α

Indicates the number of elements whose value is not 0.

Maximum Distance Separable (MDS) Matrix

의 입, 출력의 거리

는 항상 k+1 보다 크거나 같음을 만족한다. 암호에서는 이와 같은 [2k,k,k+1] 코드의 MDS 행렬 P를 사용하여 최대 확산성을 보장할 수 있다. 이와 같이, MDS 행렬 곱을 선형 연산으로 갖는 경우 해당 선형 연산의 Branch Number가 k+1 임을 보장할 수 있다. 다양한 행렬을 이용하여 암호의 선형 연산으로 사용되나, 행렬 곱을 통해 구성한 선형 연산의 이론적인 최대 Branch Number가 k+1 임이 알려져 있어 행렬 곱을 이용한 확산 효과를 k+1을 기준으로 평가하기도 한다.The MDS matrix refers to a matrix of MDS codes. When the [n,k,d] code defined in the finite field GF(2 ^s ) satisfies d=n-k+1, it is called an MDS code. Here, d may represent a minimum value of distances between different code words included in the [n, k, d] code. So Generator k by 2k matrix of systematic [2k,k,k+1] code

distance of input and output of

is always greater than or equal to k+1. In encryption, the maximum spreadability can be guaranteed by using the MDS matrix P of the [2k,k,k+1] code. As such, when the MDS matrix multiplication is a linear operation, it can be guaranteed that the branch number of the linear operation is k+1. It is used as a linear operation of encryption using various matrices, but it is known that the theoretical maximum branch number of a linear operation constructed through matrix multiplication is k+1, so the diffusion effect using matrix multiplication is evaluated based on k+1.

In order to solve the above problems, the embodiment provides an apparatus and method for generating a password using a key-dependent layer for preventing that an encryption algorithm implemented in a device equipped with an encryption function may be exposed to a side-channel attack. for that purpose

In order to solve this problem, the embodiment is used as an operation of a key-dependent layer that is easy to apply a side-channel response technique (masking technique), so that an intermediate value cannot be known to a side-channel attacker with a relatively efficient operation. .

An apparatus for generating encryption using a key-dependent layer according to an embodiment comprises: a first key-dependent layer that receives data as an input and outputs an intermediate value of the data; and an encryption unit that receives an intermediate value of the data as an input and outputs encrypted data; , a second key-dependent layer that receives the encrypted data as input and outputs protected encrypted data, and a key scheduler that provides a round key value to the first key-dependent layer, the encryption unit, and the second key-dependent layer. may include

The first key-dependent layer and the second key-dependent layer may include a key-dependent function and a Key XOR operation.

The key-dependent function may include a matrix multiplication operation, and the matrix multiplication operation may be determined from a 16-bit master key value.

The matrix multiplication operation may receive four state value words and a 16-bit key and output four words.

The key-dependent function may be a key-dependent function applied to a masking technique.

In addition, the encryption method using the key-dependent layer according to the embodiment includes the steps of outputting an intermediate value of the data by inputting data, outputting encrypted data by taking the intermediate value of the data as an input, the encryption It may include outputting protected encrypted data by inputting the encrypted data.

According to the embodiment, when a key-dependent layer is included in the encryption algorithm, there is an effect of preventing side-channel attacks.

In addition, the embodiment has the effect of facilitating a side-channel attack response while the key determines the operation of the key dependent layer in the early and late stages of the encryption process.

In addition, since the key-dependent layer operation of the embodiment utilizes the matrix multiplication operation of the Companion Matrix, which has a relatively low operation cost, there is an effect of maximizing the lightness of the operation.

In addition, in the embodiment, since it is easy to apply an existing sub-channel correspondence technique (masking technique) to a corresponding operation, there is an effect that additional sub-channel correspondence techniques can also be efficiently applied.

1 is a block diagram showing an apparatus for generating encryption according to an embodiment.
2 is a diagram illustrating components of a key-dependent layer.
3 is a diagram illustrating components of a key-dependent function.
4 is a diagram illustrating a masked key-dependent layer to which masking is applied.
5 is a diagram illustrating an algorithm of a key-dependent function.
6 is a diagram illustrating a Key Dependent Matrix Multiplication algorithm.
7 is a diagram illustrating the Galois Field multiplication operation of 02 and 03 in the Key Dependent Matrix Multiplication algorithm.
8 is a diagram illustrating an algorithm of a masked key dependent function.
9 is a diagram illustrating a Masked Key Dependent Matrix Multiplication algorithm.
10 is a diagram illustrating an algorithm for outputting a Galois Field multiplication operation result of 02 and 03 masked in the Masked Key Dependent Matrix Multiplication algorithm and a corresponding output masking value.
11 is a flowchart illustrating a method of generating an encryption according to an embodiment.

Hereinafter, the embodiment will be described in detail with reference to the drawings.

Fig. 1 is a block diagram showing an apparatus for generating encryption according to an embodiment, Fig. 2 is a diagram showing the components of a key-dependent layer, Fig. 3 is a diagram showing the components of a key-dependent function, and Fig. 4 is a diagram to which masking is applied. It is a diagram showing a masked key-dependent layer, Fig. 5 is a diagram showing an algorithm of a key-dependent function, Fig. 6 is a diagram showing a Key Dependent Matrix Multiplication algorithm, and Fig. 7 is Galois of 02 and 03 in the Key Dependent Matrix Multiplication algorithm. Field multiplication is a diagram, FIG. 8 is a diagram illustrating an algorithm of a masked key-dependent function, FIG. 9 is a diagram illustrating a Masked Key Dependent Matrix Multiplication algorithm, and FIG. 10 is a masked 02 in the Masked Key Dependent Matrix Multiplication algorithm. It is a diagram showing an algorithm for outputting the Galois Field multiplication operation result of and 03 and the corresponding output masking value.

Referring to FIG. 1 , an encryption generating apparatus 1000 according to an embodiment may include a first key-dependent layer 100 , an encryption unit 200 , a second key-dependent layer 300 , and a key scheduler 400 . have. Here, the key scheduler 400 receives the master key (MK), and uses the generated round key (RK _i ll K _i in FIG. 2 ) with the first key dependent layer 100 , the encryption unit 200 , and the second key. It may be provided to the dependent layer 300 .

A first key-dependent layer (100, Key Dependent Layer) may be applied before data encryption. Here, the data P may include a word. The first key-dependent layer 100 may operate by inputting the data P and the round key RKi ll Ki. The first key-dependent layer 100 may output the input data P as an intermediate value P'. Here, the round key RKi ll Ki may be provided from the key scheduler 400 receiving the master key MK.

The encryption unit 200 (Encryption Body) may output the encrypted data (C') by receiving the median value (P') of the data output from the first key-dependent layer 100 as an input.

The encryption unit 200 may use an encryption device capable of encrypting data of a standardized length, and in more detail, it is possible to use a commercial block cipher and a newly designed block cipher. Therefore, in general, the corresponding encryption device refers to one capable of encryption and decryption from the round key provided from the master key (MK).

The second key-dependent layer 300 may output the protected encrypted data C by receiving the encrypted data C' as an input. The second key-dependent layer 300 may have the same configuration as the first key-dependent layer 100 .

Since an attacker who does not know the master key (MK) cannot determine the operation of the first and second key-dependent layers (100, 300), the intermediate values (P', C) from the data or protected encrypted data (P, C) ') cannot be found. Accordingly, it is difficult for an attacker who cannot obtain an intermediate value that is correlated with the side-channel information obtained by the attacker to perform a general side-channel attack. Accordingly, the corresponding protection technique can be applied to the data (P, C) by using a key-dependent layer composed of relatively efficient operations.

Hereinafter, we will look at the configuration of the key-dependent layer. Here, the key-dependent layer may be a first key-dependent layer or a second key-dependent layer, and the first key-dependent layer and the second key-dependent layer may have the same configuration.

Composition of Key Dependent Layer

As shown in FIG. 2 , the key-dependent layer 100 may be formed of a key-dependent function 110 (Key Dependent Function, hereinafter referred to as a 'KDF function') and a key 130 XOR operation.

Key Dependent Function - KDF

As shown in FIG. 3 , the inside of the KDF function may include a matrix multiplication operation, and as shown in FIG. 5 , 4 state value words and 16-bit key values are input, and 4 words are output. can do. Here, the matrix used for the matrix multiplication operation may be constructed by multiplying the matrix M(K _j ) determined from the 16-bit key K _j . Here, M(K _j ) may be determined as in Equation (1).

[Equation 1]

FIG. 5 shows an algorithm that performs the Companoin matrix multiplication four times. When the matrix multiplication is performed, input word values can be mixed with information about the key by using 02 and 03, which have a relatively small amount of computation.

Diffusion effect of KDF

가 각각 하나의 Companion 행렬을 결정하여 서로 곱한 결과를 M(K)로 한다. 16비트의 키 K로부터 결정되는 2¹⁶ 개의 행렬 M(K)는 GF(2⁴)(즉, s=4), GF(2⁸)(즉, s=8) 상에서 모두 다르고, GF(2⁴) 상에서의 행렬 M(K)의 Branch Number는 표 1과 같이 분포되어 있다.The linear operation used in the embodiment may consist of a matrix M(K) product operation generated from key information. M(K) may be determined from a 16-bit key K. Four 4-bit key values that make up K

Determines one Companion matrix each, and multiplies the result to be M(K). 2 ¹⁶ matrices M(K) determined from a 16-bit key K are different on GF(2 ⁴ ) (ie s=4), GF(2 ⁸ ) (ie s=8), and GF(2 ⁴ ) ), the branch numbers of the matrix M(K) are distributed as shown in Table 1.

[Table 1]

From the above results, it can be said that the matrix M(K) used in the embodiment has a relatively high branch number, considering that the maximum spreadability of the matrix multiplication operation of 4 X 4 is Branch Number = 5.

KDL with masking applied

Since the KDL used in the embodiment is based on a Feistel structure that has a KDF, which has a linear property for XOR operation, as a round function, it is easy to apply a masking technique. KDL to which the masking technique is applied can be expressed as MKDL. As an example in which MKDL is composed of 6 MKDFs, it can be represented as shown in FIG. 4 .

MKDF is a KDF to which masking is applied, and an output masking value corresponding to an input masking value may be derived as an additional result value.

,

을 출력함을 알 수 있다.8 to 10 are algorithms showing MKDF and components of MKDF. MKDL is an output value masked with the same value as the input masking value m, as can be seen in FIG.

,

It can be seen that output

11 is a flowchart illustrating a method for generating an encryption according to an embodiment.

11, the encryption method according to the embodiment includes the steps of outputting an intermediate value of the data by inputting data (S100), and outputting encrypted data by inputting the intermediate value of the data as an input (S200) and outputting protected encrypted data by inputting the encrypted data (S300). Here, the password generating method may be performed in the password generating apparatus.

The step of inputting data and outputting an intermediate value of the data ( S100 ) may be performed in the first key-dependent layer.

The step (S200) of outputting encrypted data by inputting an intermediate value of data may be performed by the encryption unit.

Outputting protected encrypted data by inputting the encrypted data ( S300 ) may be performed in the second key-dependent layer.

Various embodiments of the present document provide software (eg, a machine-readable storage media) (eg, a memory (internal memory or external memory)) including instructions stored in a machine-readable storage medium (eg, a computer). : program) can be implemented. The device is a device capable of calling a stored command from a storage medium and operating according to the called command, and may include the electronic device according to the disclosed embodiments. When the command is executed by the control unit, the control unit may perform a function corresponding to the command directly or by using other components under the control of the control unit. Instructions may include code generated or executed by a compiler or interpreter. The device-readable storage medium may be provided in the form of a non-transitory storage medium. Here, non-transitory means that the storage medium does not include a signal and is tangible, and does not distinguish that data is semi-permanently or temporarily stored in the storage medium.

According to an embodiment, the method according to various embodiments disclosed in the present document may be included and provided in a computer program product.

According to an embodiment, there is provided a computer-readable recording medium storing a computer program, comprising the steps of: receiving data as an input and outputting an intermediate value of the data; and outputting encrypted data by receiving the intermediate value of the data as an input and instructions for causing the processor to perform a method including an operation for outputting protected encrypted data by inputting the encrypted data as an input.

According to an embodiment, there is provided a computer program stored in a computer-readable recording medium, comprising: outputting an intermediate value of the data by inputting data; and outputting encrypted data by inputting the intermediate value of the data as an input and instructions for causing the processor to perform a method including an operation for outputting protected encrypted data by inputting the encrypted data as an input.

Although the above has been described with reference to the drawings and embodiments, it will be understood by those skilled in the art that various modifications and changes can be made to the embodiments without departing from the spirit of the embodiments described in the claims below. will be able

100: first key dependent layer
200: Encryption Department
300: second key dependent layer
400: key scheduler

Claims (8)

a first key-dependent layer that receives data as an input and outputs an intermediate value of the data;
an encryption unit for outputting encrypted data by inputting an intermediate value of the data;
a second key-dependent layer that receives the encrypted data as an input and outputs protected encrypted data; and
a key scheduler providing a round key value to the first key dependent layer, the encryption unit, and the second key dependent layer;
including,
Each of the first key-dependent layer and the second key-dependent layer,
A key-dependent function including a matrix multiplication operation, and a Key XOR operation,
The matrix multiplication operation is
A cryptographic generator determined based on the round key value. delete delete According to claim 1,
The matrix multiplication operation is
A cryptographic generating apparatus that divides the 16-bit round key value into four 4-bit key values to determine four Companion matrices, and is determined based on the determined four Companion matrices. According to claim 1,
The key-dependent function is a key-dependent function to which a masking technique can be applied. outputting an intermediate value of the data by inputting data through a first key dependent layer;
outputting encrypted data by inputting an intermediate value of the data through an encryption unit;
outputting protected encrypted data with the encrypted data as an input through a second key-dependent layer; and
providing a round key value to the first key dependent layer, the encryption unit, and the second key dependent layer;
including,
Each of the step of outputting the intermediate value of the data and the step of outputting the protected encrypted data comprises:
performing a matrix multiplication operation included in a key-dependent function; and
Including; performing a key XOR operation;
The matrix multiplication operation is
A method of generating an encryption determined based on the round key value. As a computer-readable recording medium storing a computer program,
The computer program is
outputting an intermediate value of the data by inputting data through a first key dependent layer;
outputting encrypted data by inputting an intermediate value of the data through an encryption unit;
outputting protected encrypted data with the encrypted data as an input through a second key-dependent layer; and
providing a round key value to the first key dependent layer, the encryption unit, and the second key dependent layer;
including instructions for causing the processor to perform
Each of the step of outputting the intermediate value of the data and the step of outputting the protected encrypted data comprises:
performing a matrix multiplication operation included in a key-dependent function; and
Including; performing a key XOR operation;
The matrix multiplication operation is
A computer-readable recording medium determined based on the round key value. As a computer program stored in a computer-readable recording medium,
The computer program is
outputting an intermediate value of the data by inputting data through a first key dependent layer;
outputting encrypted data by inputting an intermediate value of the data through an encryption unit;
outputting protected encrypted data with the encrypted data as an input through a second key-dependent layer; and
providing a round key value to the first key dependent layer, the encryption unit, and the second key dependent layer;
including instructions for causing the processor to perform
Each of the step of outputting the intermediate value of the data and the step of outputting the protected encrypted data comprises:
performing a matrix multiplication operation included in the key-dependent function; and
Including; performing a key XOR operation;
The matrix multiplication operation is
a computer program determined based on the round key value.

Images