对SHACAL-2算法和MD5加密模式的差分故障攻击

发布时间：2018-07-24 15:13

【摘要】：差分故障攻击是一种间接攻击方法,其对分组密码和流密码均有很好的攻击效果。自1997年Biham提出差分故障攻击的概念以来,利用该方法可攻击DES算法、椭圆曲线加密体制、3DES算法、SMS4算法、ARIA算法、CLEFIA算法、AES算法等诸多密码算法。本文主要通过求解混合方程来研究SHACAL-2算法和MD5加密模式非线性部件的差分特性。并利用该差分特性对其进行差分故障攻击。主要结果如下:(1)证明了当SHACAL-2算法选择函数的第1个位置输入差分非零或者择多函数的前两个位置中任意一个输入差分非零时(其它位置差分均为零),差分方程解的个数只与输入差分的重量有关。将这一结果运用到SHACAL-2算法的差分故障攻击中,从理论上解释了有效的差分故障位置为E,并证明了至少需要160个随机故障才能以超过60%的成功概率恢复512比特的种子密钥,而至少需要240个随机故障才能以超过98%的成功概率恢复512比特的种子密钥。(2通过研究MD5加密模式中轮函数的差分特性,给出了一个逐比特求解差分方程的快速算法。利用该算法可以实现从倒数第三轮对MD5加密模式进行差分故障攻击。研究结果表明如果从倒数第三轮开始导入故障,平均只需56个故障,即可成功恢复512比特的种子密钥,而如果从倒数第二轮开始导入故障,平均需要112个故障才能成功恢复512比特的种子密钥。故与从倒数第二轮开始导入故障相比,从倒数第三轮导入故障不仅可以将故障攻击的轮数提前而且恢复种子密钥所需的故障数减少了一半。
[Abstract]:Differential fault attack is an indirect attack method, which has a good effect on block cipher and stream cipher. Since Biham put forward the concept of differential fault attack in 1997, this method can be used to attack many cryptographic algorithms such as DES algorithm, elliptic curve cryptosystem / 3DES algorithm, SMS4 algorithm and CLEFIA algorithm. In this paper, the differential characteristics of nonlinear components in SHACAL-2 algorithm and MD5 encryption mode are studied by solving mixed equations. The differential characteristic is used to attack the differential fault. The main results are as follows: (1) it is proved that the solution of the difference equation is obtained when the input difference of the first position of the SHACAL-2 algorithm is nonzero or the first two positions of the selection function are not 00:00 (all the other positions are zero). The number of the input difference is only related to the weight of the input difference. Applying this result to the differential fault attack of SHACAL-2 algorithm, the effective differential fault location is explained as E, and it is proved that at least 160 random faults are needed to recover the 512-bit seed key with more than 60% success probability. At least 240 random faults are needed to recover the 512-bit seed key with a success probability of more than 98%. (2) by studying the differential characteristics of the wheel function in the MD5 encryption mode, a fast algorithm for solving the difference equation bit by bit is presented. Using this algorithm, the differential fault attack on MD5 encryption mode can be realized from the reciprocal third round. The results show that if the fault is imported from the penultimate third round, only 56 faults on average, the 512-bit seed key can be successfully recovered, and if the fault is imported from the penultimate round, An average of 112 faults are required to successfully recover the 512 bit seed key. Therefore, compared with importing faults from the reciprocal second round, the imported faults from the reciprocal round can not only reduce the number of rounds of fault attack ahead of schedule, but also reduce the number of faults needed to restore the seed key by half.
【学位授予单位】：国防科学技术大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TN918.1

【相似文献】