WO2018165949A1

WO2018165949A1 - Des software dpa attack prevention method and device

Info

Publication number: WO2018165949A1
Application number: PCT/CN2017/076972
Authority: WO
Inventors: 宋孝亮
Original assignee: 深圳大趋智能科技有限公司
Priority date: 2017-03-16
Filing date: 2017-03-16
Publication date: 2018-09-20
Also published as: CN107466453B; CN107466453A

Abstract

Disclosed are a DES software DPA attack prevention method and device, the method comprising: obtaining a random number to act as a mask S, and giving the value to masks RX12 and SP; generating a dynamic mask according to the mask SP; using the mask RX12 to perform initialisation replacement on an IP; using the masks RX12 and S and the dynamic mask to perform a 16-round operation; performing inverse replacement on the IP via the mask RX12 and a mask RXwork to obtain encrypted data. The present invention prevents higher order DPA attacks.

Description

Method and device for preventing DES software against DPA attack

[0001] The present invention relates to the field of information security technologies, and in particular, to a method and apparatus for defending against DPA attacks by DES software.

Background technique

[0002] The DES algorithm is a widely used symmetric encryption/decryption algorithm. The DES algorithm changes a 64-bit plaintext input block into a 64-bit ciphertext output block. Its function is to re-enter the input 64-bit data block. Combine, and divide the output into two parts, L0 and R0, each part is 32 bits long, and the initial replacement is performed, that is, the ciphertext output is obtained. The F functions of each round of the DES algorithm include extended permutation, XOR with key, S-box substitution, and P-box permutation. The S box, whose English name is Substitution-box, is the basic structure for the symmetric key algorithm to perform permutation calculations. The S-box is used in the block cipher algorithm and is a non-linear structure. The cipher strength directly determines the quality of the cipher algorithm.

[0003] With the increasing security requirements of financial P0S terminals, the important encryption algorithm used by financial P0S terminals is more and more effective in protecting DPA attacks. The cryptographic algorithm using the mask algorithm can still be attacked by high-order DPA. In order to protect against high-order DPA attacks, the S-box algorithm needs to be modified, so that the modified algorithm can protect against advanced DPA attacks.

[0004] Currently, the DES mask scheme is convenient for hardware implementation against DPA attacks, but in the hardware DES cryptographic device, the 8 S-box implementations of each round of operation in the DES coprocessor are parallel, and the output of each S-box is parallel. It accounts for 4 bits (l/8 length) after P replacement, so the effect on the energy of the S box output always exists regardless of the position after the P replacement. If the 6-bit subkey of an S box is used as the target, then the remaining 28 bits of the output result are noise except for the 4 bit output of the S box. In response to this weakness, there are now related high-level cracking methods.

technical problem

[0005] The main object of the present invention is to provide a DES software anti-DPA attack method and apparatus, aiming at solving the problem that the DE S software is attacked by DPA high-order attacks.

Problem solution Technical solution

[0006] The present invention provides a method for defending against DPA attacks by DES software, including

[0007] Obtain a random number as the mask S, and assign the value of the mask S to the mask RX12 and the mask SP;

[0008] generating a dynamic mask MSP according to the mask SP;

[0009] Initializing and replacing IP using mask RX12;

[0010] performing 16 rounds of the same operation using the mask RX12, the mask S, and the dynamic mask MSP;

[0011] The IP is inversely permuted by the mask RX12 and the mask RXwork to obtain IjDES encrypted data.

[0012] Further, the step of generating a dynamic mask MSP according to the mask SP is characterized in that,

[0013] Based on the static masks SP1-SP8, a dynamic mask MSP is generated by the mask SP.

[0014] Further, the obtaining the random number as the mask S, before the step of assigning the mask RX12 and the mask SP, includes,

[0015] The IP is generated by a basic DES mask scheme.

[0016] Further, the step of acquiring a random number as the mask S includes:

[0017] A 32-byte random number is obtained as the mask S.

[0018]

[0019] The present invention also provides a device for preventing DPA attacks by DES software, including

[0020] obtaining an assignment unit, configured to obtain a random number as a mask S, and assign the value of the mask S to the mask RX12 and the mask SP;

[0021] The first generating unit is configured to generate a dynamic mask MSP according to the mask SP;

[0022] an initial replacement unit, configured to perform initial replacement on the IP using the mask RX12;

[0023] an arithmetic unit, configured to perform 16 rounds of the same operation using the mask RX12, the mask S, and the dynamic mask MSP

[0024] an inverse permutation unit, configured to perform inverse permutation of the IP by the mask RX12 and the mask RXwork to obtain DES encrypted data.

[0025] Further, the first generating unit includes a production module, configured to generate a dynamic mask MSP by using a mask SP on the basis of the static masks SP1-SP8.

[0026] Further, a second generating unit is further included, configured to generate an IP by using a basic DES masking scheme.

[0027] Further, the acquisition and assignment unit includes an acquisition module, configured to acquire a 32-byte random number as Mask s.

Advantageous effects of the invention

Beneficial effect

[0028] The beneficial effects of the present invention are: based on the static masks SP1-SP8, the dynamic mask MSP is generated by the mask SP, and the 16-round operation is performed by the dynamic mask MSP, which is simple and effective, and can be realized for high Protection against DPA attacks.

Brief description of the drawing

DRAWINGS

1 is a schematic flowchart of a method for preventing a DPA attack by a DES software according to an embodiment of the present invention;

2 is a schematic flowchart of a method for preventing a DPA attack by a DES software according to another embodiment of the present invention;

3 is a structural block diagram of an apparatus for preventing a DPA attack by a DES software according to an embodiment of the present invention.

[0032]

[0033] The implementation, functional features, and advantages of the present invention will be further described with reference to the accompanying drawings.

BEST MODE FOR CARRYING OUT THE INVENTION

The specific embodiments described herein are intended to be illustrative only and not to limit the invention.

The descriptions of "first", "second" and the like in the present invention are used for the purpose of description only, and are not to be construed as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Thus, features defining "first" and "second" may include at least one of the features, either explicitly or implicitly. In addition, the technical solutions between the various embodiments may be combined with each other, but must be based on the realization of those skilled in the art, and when the combination of the technical solutions is contradictory or impossible to implement, it should be considered that the combination of the technical solutions does not exist. It is also within the scope of protection required by the present invention.

[0036] The singular forms "a", "an", "the" It will be further understood that the phrase "comprising", used in the <RTI ID=0.0></RTI><RTIgt;</RTI><RTIgt;</RTI> the meaning of the present invention means that the features, integers, steps, operations, components and/or components are present, but one or more other features are not excluded or added. , integer, step, operation, element Pieces, components, and/or their groups. The phrase "and/or" used herein includes all or any of the elements and all combinations of one or more of the associated listed.

[0037] Those skilled in the art will understand that all terms (including technical and scientific terms) used herein have the same meaning as the ordinary meanings of the ordinary skill in the art to which the present invention belongs, unless otherwise defined. It should also be understood that terms such as those defined in a general dictionary should be understood to have meaning consistent with the meaning in the context of the prior art, and will not be idealized or excessive unless specifically defined as here. The formal meaning is explained.

[0038] DES, English full name: Data Encryption Standard, is a group symmetric cryptographic algorithm, is a widely used symmetric encryption/decryption algorithm, DES algorithm changes 64-bit plaintext input block into 64-bit ciphertext output block, Its function is to recombine the input 64-bit data block in bits, and divide the output into two parts, L0 and R0. Each part is 32 bits long, and the initial replacement is performed, that is, the ciphertext output is obtained. The F functions of each round of the DES algorithm include extended permutation, XOR with key, S-box substitution, and P-box permutation.

[0039] The S box, the English name is Substitution-box, is the basic structure of the symmetric key algorithm to perform permutation calculation.

The S-box is used in the block cipher algorithm and is a non-linear structure. The cipher strength directly determines the quality of the cipher algorithm.

[0040]

[0041] Referring to FIG. 1, an embodiment of the present invention is provided. The present invention provides a method for defending against DPA attacks by a DES software, including the following steps:

[0042] 511. Obtain a random number as the mask S, and assign the value of the mask S to the mask RX12 and the mask SP.

[0043] 512. Generate a dynamic mask MSP according to the mask SP.

[0044] 513. Initialize the IP by using the mask RX12.

[0045] 514. Perform 16 rounds of the same operation using the mask RX12, the mask S, and the dynamic mask MSP.

[0046] 515. Perform inverse multiplexing on the IP through the mask RX12 and the mask RXwork to obtain DES encrypted data.

[0047] For step S1 l, a random number is obtained as the mask S, and the random number can be a 32-byte random number. After the value of the mask S, the value of the mask S is assigned to the mask RX12 and the mask SP. For subsequent calculations, such as the initial replacement of IP and the inverse of IP, the mask RX12 is required.

[0048] For the step S12, the dynamic mask MSP is generated according to the mask SP, the dynamic mask MSP is generated by the mask SP, and the 16-round operation is performed by the dynamic mask MSP, which is simple and effective, and the DES algorithm pair can be implemented. Protection against high-level DPA attacks improves the security of cryptographic devices. In a specific embodiment of the present invention, the specific execution code of step S12 is as follows:

[0049] maskbits = (MSP[0]»24)&0x3F;

[0050] dynamicSPx[i][j] = SPx[j ^A maskbits] ^A MSP[l].

[0051] For step S13, the IP is initialized and replaced by the mask RX12, and the initialization is replaced by: the input 64-bit data block is recombined in bits, and the output is divided into two parts, L0 and R0, each part is 32 bits long. . The mask RX12 is added during the initialization and replacement of the IP to improve the security of the DES algorithm. In a specific embodiment of the present invention, the specific execution code of step S13 is as follows:

[0052] leftt=block[0];

Right=block[l];

Leftt ^A = RX12[0];

Right ^A = RX12[l];

[0056] For step S14, 16 rounds of the same calculation are performed by using the mask RX12, the mask S, and the dynamic mask MSP to ensure the complexity of the encryption, and 16 rounds of the same calculation can be performed by using the dynamic mask MSP to improve the DES algorithm pair. The protection of high-order DPA attacks further improves the security of cryptographic devices.

[0057] For step S15, finally, the IP processed by the above step is inversely replaced by the mask RX12 and the mask RXwork, and the final DES encrypted data can be obtained. In an embodiment of the invention, the execution code of step S15 is:

Leftt ^A = RX12[0];

Right ^A = RX12[l];

[0060] work ^A = RXwork;

[0061] A DES software anti-DPA attack method, based on the static mask SP1-SP8, generates a dynamic mask MSP through a mask SP, and performs 16 round operations through a dynamic mask MSP, which is simple and effective, and can be Implement protection against high-level DPA attacks.

[0062]

[0063] In another embodiment of the present invention, a method for preventing a DPA attack by a DES software includes the following steps:

[0064] S20. Generate an IP by using a basic DES masking scheme.

[0065] S21: Obtain a 32-byte random number as the mask S, and assign the value of the mask S to the mask RX12 and the mask. Code SP.

[0066] S22. Generate a dynamic mask MSP by using a mask SP on the basis of the static masks SP1-SP8.

[0067] S23: Initializing and replacing the IP by using the mask RX12.

[0068] S24. Perform 16 rounds of the same operation using the mask RX12, the mask S, and the dynamic mask MSP.

[0069] S25. Perform inverse multiplexing on the IP through the mask RX12 and the mask RXwork to obtain DES encrypted data.

[0070] For step S20, the IP generation scheme is consistent with the basic DES mask scheme, which is simple and straightforward, and no additional design is required.

[0071] For step S21, a random number is obtained as the mask S, and the random number is a 32-byte random number. After the value of the mask S, the value of the mask S is assigned to the mask RX12 and the mask SP, For subsequent calculations, such as the initial replacement of IP and the inverse of IP, the mask RX12 is required.

[0072] For step S22, a dynamic mask MSP is generated according to the mask SP described above, and a dynamic mask MSP is generated by the mask SP on the basis of the static masks SP1-SP8, and then performed by the dynamic mask MSP. The round operation is simple and effective, and the DES algorithm can be protected against high-order DPA attacks, and the security of the cryptographic device can be improved. In an embodiment of the present invention, the specific execution code of step S22 is as follows:

[0073] maskbits = (MSP[0]»24)&0x3F;

[0074] dynamicSPx[i][j] = SPx[j ^A maskbits] ^A MSP[l].

[0075] For step S23, the IP is initialized and replaced by the mask RX12, and the initialization is replaced by: the input 64-bit data block is recombined in bits, and the output is divided into two parts, L0 and R0, each part is 32 bits long. . The mask RX12 is added during the initialization and replacement of the IP to improve the security of the DES algorithm. In a specific embodiment of the present invention, the specific execution code of step S23 is as follows:

[0076] leftt=block[0];

Right=block[l];

Leftt ^A = RX12[0];

Right ^A = RX12[l];

[0080] For step S24, 16 rounds of the same calculation are performed by using the mask RX12, the mask S, and the dynamic mask MSP to ensure the complexity of the encryption, and 16 rounds of the same calculation can be performed by using the dynamic mask MSP to improve the DES algorithm pair. The protection of high-order DPA attacks further improves the security of cryptographic devices.

[0081] For step S25, finally, the IP processed by the above step is processed by the mask RX12 and the mask RXwork. Inverse permutation, the final DES encrypted data can be obtained. In a specific embodiment of the present invention, the execution code of step S25 is:

Leftt ^A = RX12[0];

Right ^A = RX12[l];

[0084] work ^A = RXwork;

[0085] A DES software anti-DPA attack method, based on the static mask SP1-SP8, generates a dynamic mask MSP through a mask SP, and performs 16 round operations through a dynamic mask MSP, which is simple and effective, and can be Implement protection against high-level DPA attacks.

[0086]

[0087] The present invention also provides a device for preventing DPA attacks by DES software, including:

[0088] The second generating unit 10 is configured to generate an IP by using a basic DES masking scheme.

[0089] The obtaining value unit 20 is configured to obtain a random number as the mask S, and the value of the mask S is given to the mask RX1 2 and the mask SP.

[0090] The first generating unit 30 is configured to generate a dynamic mask MSP according to the mask SP.

[0091] an initial replacement unit 40, configured to perform initial replacement on the IP using the mask RX12;

[0092] The operation unit 50 is configured to perform 16 rounds of the same operation using the mask RX12, the mask S, and the dynamic mask MSP.

[0093] The inverse permutation unit 60 is configured to perform inverse permutation of the IP by using the mask RX12 and the mask RXwork to obtain DES encrypted data.

[0094] For the second generation unit 10, the IP generation scheme is consistent with the basic DES mask scheme, which is simple and straightforward, and no additional design is required.

[0095] For the acquisition assignment unit 20, a random number is obtained as the mask S, and the random number may be a 32-byte random number. After the value of the mask S, the value of the mask S is assigned to the mask RX12 and the mask. SP, for subsequent calculations, such as initial replacement of IP and inverse IP replacement, need to use mask RX12.

[0096] The acquisition assignment unit 20 includes an acquisition module for acquiring a 32-byte random number as the mask S.

[0097] For the first generating unit 30, the dynamic mask MSP is generated according to the mask SP, the dynamic mask MSP is generated by the mask SP, and the 16-round operation is performed by the dynamic mask MSP, which is simple and effective, and can implement DES. The algorithm protects against high-order DPA attacks and improves the security of cryptographic devices. First generating unit, including There is a production module for generating a dynamic mask M SP by mask SP on the basis of static masks SP1-SP8.

[0098] For the initial replacement unit 40, the IP is initialized and replaced by the mask RX12, and the initialization is replaced by: The input 64-bit data block is recombined in bits, and the output is divided into two parts, L0 and R0, each part is long. 3 2 digits. The mask RX12 is added during the initialization and replacement of the IP to improve the security of the DES algorithm.

[0099] For the operation unit 50, the over-mask RX12, the mask S, and the dynamic mask MSP perform 16 rounds of the same calculation to ensure the complexity of encryption, and the same calculation can be performed by dynamic mask MSP for 16 rounds, and the DES algorithm can be improved. Protection against high-level DPA attacks further enhances the security of cryptographic devices.

[0100] The inverse permutation unit 60 finally obtains the final DES encrypted data by performing inverse permutation on the IP processed in the above step by using the mask RX12 and the mask RXwork.

[0101] A device for preventing DPA attacks by the DES software, based on the static mask SP1-SP8, generates a dynamic mask MSP through the mask SP, and performs 16 round operations through the dynamic mask MSP, which is simple and effective, and can be Implement protection against high-level DPA attacks.

[0102]

The above is only a preferred embodiment of the present invention, and is not intended to limit the scope of the invention, and the equivalent structure or equivalent process transformations made by the description of the invention and the drawings are used directly or indirectly. Other related technical fields are equally included in the scope of patent protection of the present invention.

Claims

Claim

A method for preventing a DPA attack by a DES software, characterized in that,

Obtain a random number as the mask S, and assign the value of the mask S to the mask RX12 and the mask SP; generate a dynamic mask MSP according to the mask SP;

Use the mask RX12 to initialize the IP;

The same operation is performed for 16 rounds using the mask RX12, the mask S, and the dynamic mask MSP; the DES encrypted data is obtained by inversely transposing the IP through the mask RX12 and the mask RXwork. The method for preventing a DPA attack by the DES software according to claim 1, wherein the step of generating a dynamic MSP according to the mask SP is characterized in that:

Based on the static mask SP1-SP8, the dynamic mask MSP is generated by the mask SP. The method for preventing a DPA attack by the DES software according to claim 1, wherein the obtaining the random number as the mask S, before the step of assigning the mask RX12 and the mask SP, includes,

The IP is generated by the basic DES mask scheme.

The method for preventing a DPA attack by the DES software according to claim 1, wherein the step of acquiring a random number as the mask S includes:

Obtain a 32-byte random number as the mask S.

A device for preventing DPA attacks by a DES software, characterized in that,

Obtaining an assignment unit for obtaining a random number as a mask S, and assigning the value of the mask S to the mask RX12 and the mask SP;

a first generating unit, configured to generate a dynamic mask MSP according to the mask SP;

An initial permutation unit for initializing and replacing IP using a mask RX12; and an arithmetic unit for performing 16 rounds of the same operation using a mask RX12, a mask S, and a dynamic mask MSP;

The inverse permutation unit is configured to inversely replace the IP by using the mask RX12 and the mask RXwork to obtain the DES encrypted data.

The device for preventing DPA attacks by the DES software according to claim 5, wherein the first generating unit comprises a production module for using on a static mask SP1-SP8 , Generate a dynamic mask MSP by mask SP.

The apparatus for preventing DPA attacks by the DES software according to claim 5, further comprising a second generating unit, configured to generate an IP by using a basic DES masking scheme.

The apparatus for preventing DPA attacks by the DES software according to claim 5, wherein the obtaining and assigning unit comprises an obtaining module, configured to acquire a 32-byte random number as a mask S.