对轻量级分组密码算法LBlock的差分故障攻击

密码学报ISSN2095-7025CN10-1195/TN Journal of Cryptologic Research,2019,6(1):18–26?《密码学报》编辑部版权所有.

E-mail:jcr@https://www.sodocs.net/doc/2a5794927.html, https://www.sodocs.net/doc/2a5794927.html, Tel/Fax:+86-10-82789618

对轻量级分组密码算法LBlock的差分故障攻击*

王涛,王永娟,高杨,张诗怡

信息工程大学,郑州450001

通信作者:王涛,E-mail:wt107263@https://www.sodocs.net/doc/2a5794927.html,

摘要:本文首先分析差分故障攻击的故障模型与原理,利用S盒的差分不均匀性,通过建立输入差分、输出差分和可能输入值之间的对应关系,给出差分故障分析的优化方案,实现快速归约,提高差分故障攻击的效率.本文通过对LBlock算法建立对应关系,可以快速直观缩小输入值取值空间,进而快速确定对应扩展密钥.对于不同故障值(输入差分),对应的输出差分和可能输入值均不相同,可以得到二元关系集合.由于轻量级分组密码S盒多为4×4S盒,该集合中元素较少,注入少量不同故障值,通过查表,对可能输入值取交集即可快速确定唯一可能输入值.将优化方案应用于LBlock轻量级分组密码算法,在最后一轮输入处注入2次宽度为16bit的故障可恢复最后一轮轮密钥,然后将状态回推一轮,在倒数第二轮输入处注入2次宽度为16bit的故障可恢复倒数第二轮密钥.根据密钥扩展方案,恢复两轮轮密钥后将恢复主密钥的计算复杂度降为219.

关键词:轻量级分组密码;LBlock算法;差分故障攻击

中图分类号:TP309.7文献标识码:A DOI:10.13868/https://www.sodocs.net/doc/2a5794927.html,ki.jcr.000279

中文引用格式:王涛,王永娟,高杨,张诗怡.对轻量级分组密码算法LBlock的差分故障攻击[J].密码学报, 2019,6(1):18–26.

英文引用格式:WANG T,WANG Y J,GAO Y,ZHANG S Y.Di?erential fault attack on lightweight block cipher LBlock[J].Journal of Cryptologic Research,2019,6(1):18–26.

Di?erential Fault Attack on Lightweight Block Cipher LBlock

WANG Tao,WANG Yong-Juan,GAO Yang,ZHANG Shi-Yi

Information Engineering University,Zhengzhou450001,China

Corresponding author:WANG Tao,E-mail:wt107263@https://www.sodocs.net/doc/2a5794927.html,

Abstract:Firstly,this paper analyzes the fault model and principle of di?erential fault attack.By using the di?erential inhomogeneity of S-boxes,this paper gives an optimization of di?erential fault analysis by establishing the corresponding relationship between input di?erentials,output di?erentials, and possible input values to improve the e●ciency of di?erential fault attack.In this paper,the corresponding relationship for LBlock algorithm is established,which can be used to e?ectively reduce the value space of input values,and then quickly determine the corresponding extended key.For di?erent fault values(input di?erentials),the corresponding output di?erences,and possible input values are not the same,there exists a set of binary relationships.Since the lightweight S-boxes are mostly4×4S boxes,there are fewer elements in the set and a small number of di?erent false values

*基金项目:国家自然科学基金(61872381)

Foundation:National Natural Science Foundation of China(61872381)

收稿日期:2017-11-13定稿日期:2018-05-12

万方数据