数字视频广播通用加扰算法的不可能差分分析

数字视频广播通用加扰算法(DVB-CSA)是一种混合对称加密算法,由分组密码加密和流密码加密两部分组成。该算法通常用于保护视讯压缩标准(MPEG-2)中的信号流。主要研究DVB-CSA分组加密算法(DVB-CSA-Block Cipher, CSA-BC)的不可能差分性质。通过利用S盒的具体信息,该文构造了CSA-BC的22轮不可能差分区分器,该区分器的长度比已有最好结果长2轮。进一步,利用构造的22轮不可能差分区分器,攻击了缩减的25轮CSA-BC,该攻击可以恢复24 bit种子密钥。攻击的数据复杂度、时间复杂度和存储复杂度分别为253.3个选择明文、232.5次加密和224个存储单元。对于CSA-BC的不可能差分分析,目前已知最好结果能够攻击21轮的CSA-BC并恢复16 bit的种子密钥量。就攻击的长度和恢复的密钥量而言,该文的攻击结果大大改进了已有最好结果。     

循环移位对Rijndael密码安全性的影响

目前针对新一轮高级加密标准(AES)Rijndael密码的最有效攻击算法仍是由设计者提出的Square攻击。文献[1]中指出Square攻击是一种选择明文攻击，攻击强度不依赖于S盒、列混合矩阵和密钥扩散准则的选取。本文提出的逆序Square攻击算法是一种选择密文攻击方法，对5、6轮的Rjjndael密码的攻击优于Square攻击，对RD-256的攻击较原算法复杂度降低2^3，Square攻击对RD-192的攻击优于逆序攻击。如果改变密码循环移位的方向或密钥扩展算法中的循环移位方向则逆序攻击对5、6轮RD-128的攻击复杂度较Square攻击降低2^8，对7轮RD-192的攻击优于Square攻击，而在许多文献中将改变后的行移位方向默认为原算法移位的方向。     

轻量级加密算法mCrypton的不可能差分分析

物联网和RFID等设备的普及给密码学提出了新的要求,为了能够在资源受限的传感节点上实施通信保护和隐私保护,大量轻量级加密算法被提出.mCrypton是明文分组长度为64 bit的轻量级分组密码算法,共有3种可用密钥长度:64 bit、96 bit和128 bit.本文提出了针对mCrypton-96的4轮mCrypton不可能差分路径和7轮mCrypton的不可能差分分析,同时利用了mCryption 的S盒性质和密钥生成算法的弱点对不可能差分分析进行了改进,实验结果表明和传统的差分分析相比,本文提出的不可能差分分析方法降低了攻击的时间复杂度和数据复杂度.     

基于持续性故障的分组密码算法S盒表逆向分析

基于故障注入的逆向分析技术通过向运行保密算法的设备中注入故障,诱导异常加密结果产生,进而恢复保密算法内部结构和参数.在除S盒表外其他运算结构已知的前提下,本文基于持续性故障提出了一种分组密码算法S盒表逆向分析方法.我们利用算法中使用故障元素的S盒运算将产生错误中间状态并导致密文出错这一特点,构造特殊的明文和密钥,诱导保密算法第二轮S盒运算取到故障值,从而逆向推导出第一轮S盒运算的输出,进而恢复出保密算法S盒表的全部元素.以类AES-128(Advanced Encryption Standard-128)算法为例,我们的方法以1 441 792次加密运算成功恢复出完整S盒表,与现有的其他逆向分析方法进行对比,新方法在故障注入次数和计算复杂度上有明显优势.进一步,我们将该方法应用于类SM4算法,并以1 900 544次加密运算恢复出保密S盒表.最后,我们综合考虑了分组密码算法的两种典型结构Feistel和SPN(Substitution Permutation Network)的特点,对新方法的普适性进行了讨论,总结出适用算法需具备的条件.     

MIBS深度差分故障分析研究

给出了MIBS算法及故障分析原理,基于不同深度的故障模型,提出了3种针对MIBS差分故障分析方法,并进行实验验证.实验结果表明,由于其Feistel结构和S盒差分特性,MIBS易遭受深度差分故障攻击,最好的结果为在第30轮左寄存器导入1次4bit故障,故障位置和故障差分值未知,可将64bit主密钥搜索空间降低到224,经1min暴力破解恢复完整主密钥.此外,该故障分析方法也可为其他使用S盒的分组密码差分故障分析提供一定思路.     

基于时空混沌和S盒的彩色图像加密算法

利用时空混沌系统和S盒代数运算产生彼此独立的密钥流,加密过程中引入密文反馈且嵌入明文长度,分别用来加密彩色图像的各基色成分.对加密算法的性能分析表明该方案密钥空间大,统计特性好,能有效抵抗穷举攻击、差分攻击和熵攻击,有较高的加/解密速度,有利于应用到对安全性和速度都有较高要求的实时信息密码系统,是一种通用的流密码结构的彩色图像加密方案.     

11轮3D密码算法的中间相遇攻击

引入多重集并结合截断差分和S盒的性质,构造出6轮中间相遇区分器,实现11轮3D密码的中间相遇攻击,恢复密钥所需的时间复杂度为2329,并结合时空折中的方法降低了数据复杂度。此外,利用新的区分器有效改进了3D算法10轮中间相遇攻击的时间复杂度,约2201次10轮加密运算。     

一种结合离散混沌映射和Feistel网络的分组加密算法

论文提出了一种新颖的结合一维离散混沌映射与Feistel网络结构的分组密码算法(CFCEA)。分组长度为64 bit,密钥长度为128bit,并使用了一个128bit长的辅助密钥。在轮函数中用Logistic混沌映射和3个代数群算子进行混合运算,此外还特别设计了子密钥生成算法。对CFCEA的密码学特性进行了分析,结果表明该算法具有严格的雪崩效应,扩散性能和扰乱性能理想。并且算法在64bit分组长度下差分概率和线性概率的理论上界分别近似为2-52.92和2-49.206,具备抵抗一定强度的差分和线性密码分析的能力。     

减缩轮PRIDE算法的线性分析

PRIDE是Albrecht等人在2014美密会上提出的轻量级分组密码算法.PRIDE采用典型SPN密码结构,共迭代20轮.其设计主要关注于线性层,兼顾了算法的效率和安全.该文探讨了S盒和线性层矩阵的线性性质,构造了16条优势为2^-5的2轮线性逼近和8条优势为2^-3的1轮线性逼近.利用合适的线性逼近,结合密钥扩展算法、S盒的线性性质和部分和技术,我们对18轮和19轮PRIDE算法进行了线性分析.该分析分别需要2⁶⁰个已知明文,2^74.9次18轮加密和2⁶²个已知明文,2^74.9次19轮加密.另外,我们给出了一些关于S盒差分性质和线性性质之间联系的结论,有助于减少攻击过程中的计算量.本文是已知明文攻击.本文是关于PRIDE算法的第一个线性分析.     

可变密钥矩阵密码体制

这是一种用积密码的方法对二进制数据流加密的密码体制。取用一组复杂的模二加函数对明文信息进行逐比特运算,把以二进制数据格式表示的明文消息变换成明文。这种函数与前面已被发送的内部密码的每一位有关,而且随着每一位被处理的消息而变化。在一可变的控制矩阵的控制下,通过不断地使密钥矩阵移位往来导出该函数。控制矩阵是由产生每一位密文时所导出的复杂函数的子积来构成的。     

一种新的加密标准 AES

AES是一种新的加密标准，它是分组加密算法，分组长度为128位，密钥长度为128bits、192bits、256bits三种，分别称为AES－128、AES－192、AES－256。本文介绍了AES的加密算法的加密过程，函数定义，密钥扩展过程。     

分组密码算法CTC的立方分析

立方攻击是在2009年欧洲密码年会上由Dinur和Shamir提出的一种新型密码分析方法,该方法旨在寻找密钥比特之间的线性关系。CTC(Courtois Toy Cipher)是N.Courtois设计的一种用于密码分析研究的分组密码算法,该算法的密钥长度、明文长度和迭代轮数都是可变的。文中利用立方攻击方法针对密钥长度为60bit的4轮CTC进行了分析,在选择明文攻击条件下,结合二次测试可恢复全部密钥,密钥恢复阶段仅需要不到2~10次加密算法。     

Security analysis of mCrypton proper to low‐cost ubiquitous computing devices and applications

mCrypton, which is a mini‐version of Crypton, is a 64‐bit block cipher with three key size options (64 bits, 96 bits, 128 bits). It was designed for use in low‐cost ubiquitous wireless devices and resource‐constrained tiny devices such as low‐cost Radio‐Frequency Identification tags and sensors in Ubiquitous Sensor Network. In this paper we show that 8‐round mCrypton with 128‐bit key is vulnerable to related‐key rectangle attack. We first describe how to construct two related‐key truncated differentials on which 7‐round related‐key rectangle distinguisher is based and then we exploit it to attack 8‐round mCrypton. This attack requires 2⁴⁶ dada and 2⁴⁶ time complexities, which is faster than exhaustive search. This is the first known cryptanalytic result on mCrypton. Copyright © 2009 John Wiley & Sons, Ltd.     

A noise resistant synchronization scheme for HDTV images

A method that increases the error resistance of the HDTV system and offers graceful picture degradation in the presence of bit errors, is presented. Due to the nature of the presently proposed compression schemes for HDTV systems, an error in a data bit does not only affect the block the bit belongs to, but unfortunately the effects of this error may perpetuate to the following blocks. This is because a bit error may cause loss of synchronization between the data bits and the picture blocks they represent. Our method restricts the effects of a bit error to a picture block whose size is significantly smaller than those used by the HDTV systems. We achieve synchronization by transmitting a header-word for each such synchronization block. Each header-word contains the number of data bits representing the compressed block. This header-word is protected by two levels of FEC code. To decrease the number of extra bits needed by the header-words, two different synchronization block sizes are used, a relatively small block size for the reference frames and a larger size for the inter-frames. The resulting method improves the quality of the picture in the presence of errors and defers the SNR at which the HDTV picture suddenly deteriorates by 2.5 to 3 dB. It also allows operation at higher order modulation transmission schemes, e.g., 32-QAM instead of 16-QAM, without the requirement of increased signal power     

Joint optimization of block size and quantization forquadtree-based motion estimation

A new approach to finding the best block size for quadtree-based motion estimation is developed and compared to a conventional fixed block size algorithm. The optimal balance between the motion vector bits and the discrete cosine transform (DCT) coefficient bits is achieved by a fast tree optimization technique based on Lagrange multiplier.     

基于流水线的自检测进位相关和加法器设计

文章提出了一种基于流水线设计的具有自检测功能的进位相关和加法器。该加法器包括四个8位进位相关和加法器（CDSA）．一个4位超前进位单元（BLCU）和一个奇偶校验器。与普通的行波进位加法器相比，文章设计的加法器硬件实现面积仅增加3．85％，而在关键路径的延时上，该加法器要减少39．2％。     

An FPGA implementation of the AES-Rijndael in OCB/ECB modes of operation

Implementation in one FPGA of the AES-Rijndael in Offset Codebook (OCB) and Electronic Codebook (ECB) modes of operation was developed and experimentally tested using the Insight Development Kit board, based on Xilinx Virtex II XC2V1000-4 device. The circuit was designed to provide simultaneous data privacy and authenticity in applications which require small area such as wireless LANs, cellular phones, and smart cards. The experimental clock frequency was equal to 50 MHz and translates to the throughputs of 493 Mbit/s for block size and key size of 128 bits, respectively. The circuit combines the efficiency of OCB authentication with the high security of Rijndael encryption/decryption algorithms, offering an authenticated encryption/decryption scheme.     

Trivium序列密码的线性性质和代数性质

Trivium是C.De Cannière和B.Preneel在2005年为欧洲eSTREAM项目设计的序列密码,Trivium被选为最终的7个算法之一.Trivium的内部状态为288比特,密钥长度为80比特.文中给出Trivium的分组密码迭代模型,在这个模型下,利用计算程序得出了Trivium各轮输出关于内部状态的线性逼近及其线性逼近概率,当初始化轮数超过246时,其输出关于输入的线性逼近概率不大于1/2＋2-41.利用计算机搜索程序,给出Trivi-um在轮的代数方程规模,利用l 152个输出比特,得到的二次方程组包含6 788个变量、11 232个方程,从实验上证明了Trivium算法能抗线性攻击和代数攻击.     

Stream-based cipher feedback mode in wireless error channel

Block ciphers encrypt a fixed size block of plaintext at a time to produce a block of ciphertext. Stream ciphers encrypt stream data, such as voice or Telnet traffic, one bit or more bits at a time. The cipher feedback mode is a stream cipher implemented by a block cipher via multiple stages, and in each stage one bit or a number of bits of plaintext are encrypted at a time. In this paper, we study error performance of the stream-based cipher feedback mode in an unreliable wireless channel in terms of throughput. We model performance of the cipher feedback mode in terms of the probability that part of or the whole ciphertext can not be successfully decrypted, and the throughput by adopting the cipher feedback mode. We explicitly derive the optimal number of stages in the cipher feedback mode to achieve the optimal throughput, given an error rate in a wireless network. We also prove that for the cipher feedback mode, the whole ciphertext is successfully decrypted if and only if the whole ciphertext is successfully transmitted.     

Eight-sided fortress: a lightweight block cipher简

In this paper, we present a new lightweight block cipher named eight-sided fortress（ESF）, which is suitable for resource-constrained environments such as sensor networks and low-cost radio rrequency identification（RFID） tags. Meanwhile, we present the specification, design rationale and evaluation results in terms of the hardware implementation. For realizing both efficiency and security in embedded systems, similar to the other lightweight block ciphers, ESF is 64 bits block length and key size is 80 bits. It is inspired from existing block cipher, PRESENT and LBlock. The encryption algorithm of ESF is based on variant Feistel structure with SPN round function, used Feistel network as an overall structure with the purpose of minimizing computational resources.