基于混合整数线性规划的八阵图不可能差分分析

八阵图(ESF)是基于LBlock改进的轻量级分组密码，具有优良的软硬件实现效率。针对ESF算法的安全性，该文借助自动化搜索工具，利用不可能差分分析方法，对算法进行安全性评估。首先结合ESF的结构特性和S盒的差分传播特性，建立了基于混合整数线性规划(MILP)的不可能差分搜索模型；其次利用算法S盒的差分传播特性和密钥扩展算法中轮子密钥间的相互关系，基于一条9轮不可能差分区分器，通过向前扩展2轮向后扩展4轮，实现了对ESF算法的15轮密钥恢复攻击。分析结果表明，该攻击的数据复杂度和时间复杂度分别为2^60.16和2^67.44，均得到有效降低，且足够抵抗不可能差分分析。     

白盒SM4优化算法在水印技术中的应用

针对目前应用软件缺乏防止动态调试方法的问题，提出了一种白盒SM4算法与水印技术相结合的方法。对白盒SM4算法的仿射变换及迭代进行合理的优化，结合水印算法的关键技术，检测代码是否被篡改。如果被篡改就立即启动响应代码，通过改变其入口函数等方式，使程序失效。在满足手机应用白盒环境的前提下，其空间复杂度可降低为原来的1/2，时间效率可以提升四倍左右。通过数据计算可知，所提的白盒算法满足多样性要求，并可以抵御BGE(Billet,Gilbert,EchChatbi)攻击。     

基于SAKURA-G实验板的SM4硬件电路能量攻击研究

目前,公开研究SM4能量攻击的实验中,功耗波形都采用计算机仿真、单片机软件实现等手段,这与实际中使用的SM4硬件电路实现的功耗尚有很大差别.由此分析了一种SM4算法硬件电路实现的安全性,将它的Verilog硬件电路下载到SAKURA-G开发板中,并采集其实际运行时的功耗信息.通过相关性能量分析技术对首轮S盒输入、首轮S盒输出、首轮输出寄存器多个可能泄露信息的位置进行攻击,还原了首轮子密钥.通过相同方法可以还原第2~4轮子密钥,最终推导128比特源密钥.最后分别从系统级和算法级探讨了相应的防御对策.     

Twofish算法中密钥相关S-盒的差分性质分析及其改进

该文从理论上证明了Twofish算法中,密钥越长,密钥相关S-盒的差分概率就越小,提出了一种新的与密钥作用的方式来产生密钥相关S-盒的方法,理论与测试结果表明新的S-盒的异或差分概率和模加差分概率比原算法的差分概率要小.     

轻量级分组密码算法ESF的相关密钥不可能差分分析

八阵图算法(ESF)是一种具有广义Feistel结构的轻量级分组密码算法,可用在物联网环境下保护射频识别(RFID)标签等资源受限的环境中,目前对该算法的安全性研究主要为不可能差分分析。该文通过深入研究S盒的特点并结合ESF密钥扩展算法的性质,研究了ESF抵抗相关密钥不可能差分攻击的能力。通过构造11轮相关密钥不可能差分区分器,在此基础上前后各扩展2轮,成功攻击15轮ESF算法。该攻击的时间复杂度为240.5次15轮加密,数据复杂度为261.5个选择明文,恢复密钥比特数为40 bit。与现有结果相比,攻击轮数提高的情况下,时间复杂度降低,数据复杂度也较为理想。     

基于持续性故障的分组密码算法S盒表逆向分析

基于故障注入的逆向分析技术通过向运行保密算法的设备中注入故障,诱导异常加密结果产生,进而恢复保密算法内部结构和参数.在除S盒表外其他运算结构已知的前提下,本文基于持续性故障提出了一种分组密码算法S盒表逆向分析方法.我们利用算法中使用故障元素的S盒运算将产生错误中间状态并导致密文出错这一特点,构造特殊的明文和密钥,诱导保密算法第二轮S盒运算取到故障值,从而逆向推导出第一轮S盒运算的输出,进而恢复出保密算法S盒表的全部元素.以类AES-128(Advanced Encryption Standard-128)算法为例,我们的方法以1 441 792次加密运算成功恢复出完整S盒表,与现有的其他逆向分析方法进行对比,新方法在故障注入次数和计算复杂度上有明显优势.进一步,我们将该方法应用于类SM4算法,并以1 900 544次加密运算恢复出保密S盒表.最后,我们综合考虑了分组密码算法的两种典型结构Feistel和SPN(Substitution Permutation Network)的特点,对新方法的普适性进行了讨论,总结出适用算法需具备的条件.     

数字视频广播通用加扰算法的不可能差分分析

数字视频广播通用加扰算法(DVB-CSA)是一种混合对称加密算法,由分组密码加密和流密码加密两部分组成。该算法通常用于保护视讯压缩标准(MPEG-2)中的信号流。主要研究DVB-CSA分组加密算法(DVB-CSA-Block Cipher, CSA-BC)的不可能差分性质。通过利用S盒的具体信息,该文构造了CSA-BC的22轮不可能差分区分器,该区分器的长度比已有最好结果长2轮。进一步,利用构造的22轮不可能差分区分器,攻击了缩减的25轮CSA-BC,该攻击可以恢复24 bit种子密钥。攻击的数据复杂度、时间复杂度和存储复杂度分别为253.3个选择明文、232.5次加密和224个存储单元。对于CSA-BC的不可能差分分析,目前已知最好结果能够攻击21轮的CSA-BC并恢复16 bit的种子密钥量。就攻击的长度和恢复的密钥量而言,该文的攻击结果大大改进了已有最好结果。     

LiCi分组密码算法的不可能差分分析

LiCi是由Patil等人(2017)提出的轻量级分组密码算法。由于采用新型的设计理念,该算法具有结构紧凑、能耗低、占用芯片面积小等优点,特别适用于资源受限的环境。目前该算法的安全性备受关注,Patil等人声称:16轮简化算法足以抵抗经典的差分攻击及线性攻击。该文基于S盒的差分特征,结合中间相遇思想,构造了一个10轮的不可能差分区分器。基于此区分器,向前后各扩展3轮,并利用密钥编排方案,给出了LiCi的一个16轮的不可能差分分析方法。该攻击需要时间复杂度约为283.08次16轮加密,数据复杂度约为259.76选择明文,存储复杂度约为276.76数据块,这说明16轮简化的LiCi算法无法抵抗不可能差分攻击。     

MD-64算法的相关密钥-矩形攻击

该文针对MD-64分组密码算法在相关密钥-矩形攻击下的安全性进行了研究。分析了算法中高次DDO (Data Dependent Operations)结构、SPN结构在输入差分重量为1时的差分转移规律,利用高次DDO结构的差分特性和SPN结构重量为1的差分路径构造了算法的两条相关密钥-差分路径,通过连接两条路径构造了算法的完全轮的相关密钥-矩形区分器,并对算法进行了相关密钥-矩形攻击,恢复出了32 bit密钥。攻击算法所需的数据复杂度为262相关密钥-选择明文,计算复杂度为291.6次MD-64算法加密,存储复杂度为266.6 Byte存储空间,成功率约为0.961。分析结果表明,MD-64算法在相关密钥-矩形攻击条件下的安全性无法达到设计目标。     

MIBS-80的13轮不可能差分分析

该文首次对13轮MIBS-80算法进行了不可能差分分析。首先基于MIBS-80中S盒的不可能差分筛选明文对,其次通过第1轮轮密钥与第2轮轮密钥、第1轮轮密钥与第13轮轮密钥之间的制约关系进一步筛选明文对。该文的攻击排除掉的明文对数量是已有的不可能差分攻击排除掉的明文对数量的218.2倍,因而同时降低了攻击的存储复杂度和时间复杂度。此外,该文多次利用查表的方法求出攻击中涉及的密钥,进一步降低了攻击所需的时间复杂度和存储复杂度。最后,该文利用独立的80 bit轮密钥来恢复主密钥,确保得到正确密钥。该文的攻击需要260.1个选择明文,269.5次13轮加密,存储量为271.2个64 bit,该结果优于已有的不可能差分攻击。     

General digital rights management solution based on white-box cryptography

Digital rights management(DRM) applications are usually confronted with threats like key extraction, code lifting, and illegal distribution. White-box cryptography aims at protecting software implementations of cryptographic algorithms and can be employed into DRM applications to provide security. A general DRM solution based on white-box cryptography was proposed to address the three threats mentioned above. The method is to construct a general perturbation-enabled white-box compiler for lookup-table based white-box block ciphers, such that the white-box program generated by this compiler provides traceability along with resistance against key extraction and code lifting. To get a traceable white-box program, the idea of hiding a slight perturbation in the lookup-table was employed, aiming at perturbing its decryption functionality, so that each user can be identified. Security analysis and experimental results show that the proposed DRM solution is secure and practical.     

DWB-AES:基于AES的动态白盒实现方法

物联网设备因资源受限,需要兼具安全性、灵活性的轻量级密码模块保障安全,白盒密码能够满足物联网设备的安全需求.在常见的白盒密码实现方法中,往往密钥和查找表是绑定的,因此每次更换密钥都需要重新生成并更换查找表,这在实际应用中不够灵活.为了解决该问题,提出了一种基于AES的动态白盒实现方法,即DWB-AES.该方法通过改变轮...     

密码算法安全-侧信道泄漏评估技术的研究及应用

密码设备是否安全并不能单纯依赖于密码算法数学上的计算不可行性,其在实际运行过程中泄漏的物理信号更值得关注.文章针对目前国内常用密码算法SM4进行分析,评估其运行过程中的侧信道泄漏信号是否存在攻击的可能,设计了相关检测实验验证了文章提出的SM4算法泄漏评估方法的有效性.     

Non-profiled Deep-Learning-Based Power Analysis of the SM4 and DES Algorithms

Power analysis methods are commonly used for evaluating the security of cryptographic devices. They are characteristically low-cost and display a high success rate and the ability to obtain important device information, e.g., keys. Given the current wide application of deep-learning technology, there is a growing tendency to incorporate power-analysis technology in development. This study investigates non-profiled deep-learning-based power analysis. The labels used in this attack are uncertain, and the attack conditions required are greatly reduced. We choose the Recurrent neural network (RNN), multilayer perceptron, and convolutional neural network algorithms, which use the same network structure, to recover the keys for the SM4 software and DES hardware implementations. We propose combining the RNN algorithm with power analysis, and validate the benefits experimentally. The experimental results show that they all successfully recover the correct key for the SM4 software implementation, although the RNN algorithm by itself achieves a better effect. This conclusion also applies to attacks on the DES hardware implementation but is limited to labels based on the bit model.     

基于任意BELL态的量子密钥分配

为了提高量子密钥分配的安全性和效率,利用量子纠缠交换的规律,提出了基于纠缠交换的量子密钥分配协议。通信双方通过简单的BELL测量建立起共享密钥,窃听者不可能窃取密钥而不被发现。该协议与其它分配协议的不同在于,可以实现对任意两个BELL态进行BELL测量达到量子密钥分配的目的。协议的实现只需要EPR粒子对,而不需要制备多粒子纠缠态。分析结果表明,此协议只用到两粒子的纠缠态,不需要进行幺正操作,它不仅能够保证密钥分配的安全性,而且简单高效。     

基本路径测试方法在仿真训练软件测试中的应用

覆盖率测试是仿真训练软件白盒测试的重点。研究了仿真训练软件测试的特点,分析了仿真训练软件测试的关键点,应用基本路径测试方法间接的实现了仿真训练软件全路径覆盖问题。通过实例验证,该方法可以较好的提高仿真训练测试效率、降低测试成本。     

The computational object approach for network and systems management

In the past 20 years, Network and Systems Management (N&SM) has thrived on mostly centralized or weakly distributed paradigms. Advances in technologies and software engineering suggested new ways of doing N&SM. The computational object approach is one of the main management technologies that have recently appeared. Based on this approach, the architecture proposed in this paper uses programming concepts instead of protocol concepts and conceals protocol complexity by easily manipulated components. Concerning the information model, the Common Information Model (CIM) is used which is designed in an object-oriented manner that is the key behind scalable N&SM.The implementation is done in the Windows environment and using the C++ programming language.     

SM algorithms-based encryption scheme for large genomic data files

With the rapid development of the genomic sequencing technology, the cost of obtaining personal genomic data and effectively analyzing it has been gradually reduced. The analysis and utilization of genomic data gradually entered the public view, and the leakage of genomic data privacy has attracted the attention of researchers. The security of genomic data is not only related to the protection of personal privacy, but also related to the biological information security of the country. However, there is still no effective genomic data privacy protection scheme using Shangyong Mima(SM) algorithms. In this paper, we analyze the widely used genomic data file formats and design a large genomic data files encryption scheme based on the SM algorithms. Firstly, we design a key agreement protocol based on the SM2 asymmetric cryptography and use the SM3 hash function to guarantee the correctness of the key. Secondly, we used the SM4 symmetric cryptography to encrypt the genomic data by optimizing the packet processing of files, and improve the usability by assisting the computing platform with key management. Software implementation demonstrates that the scheme can be applied to securely transmit the genomic data in the network environment and provide an encryption method based on SM algorithms for protecting the privacy of genomic data.     

针对SM4轮输出的改进型选择明文功耗分析攻击

The power analysis attack on SM4 using the chosen-plaintext method was proposed by Wang et al in 2013 CIS.The fixed data was introduced in the method when attacking the round key.However,the attack process was complex.There were many problems in the process,such as more power traces,more numbers of the chosen-plaintext and acquisition power traces.The correlation between the fixed data and the round key were presented,which could be used to decode the round key.Based on the correlation,the improved chosen-plaintext power analysis attack against SM4 at the round-output was proposed.The proposed method attacked the fixed data by analyzing the power traces of the special plaintext.And the round key was derived based on the correlation.The results show that the proposed attack algorithm is effective.The proposed method not only improves the efficiency of the attack by reducing number of power traces,number of the chosen-plaintext and number of acquisition power traces,but also can be applied to a chosen-plaintext power analysis attack against SM4 at the shift operation.     

基于SM4轮函数设计的认证加密算法

认证加密算法,作为一种对称密码算法,能够同时保护数据的机密性和完整性,在信息安全领域有着重要作用.现有的认证加密算法大多是基于分组密码的工作模式设计的,底层需要调用全轮的分组密码,效率受到很大限制.本文主要考虑从基本部件出发直接设计一个高效的认证加密算法.首先结合国产分组密码标准SM4与广义Feistel结构给出了一种通用的结构设计.然后以抵抗碰撞攻击为安全性目标,利用混合整数规划（MILP）方法搜索得到了一些状态大小和效率各不相同的结构,这些结构可以被用来构造消息认证码和认证加密算法.最后,利用目前搜索得到的状态大小和效率较优的结构设计了一个认证加密算法,并进行了初步的安全性分析和软件实现,其速度约为SM4-GCM速度的10倍.