SIMON系列轻量级分组密码故障立方攻击  

Fault-cube attack on SIMON family of lightweight block ciphers

作　　者：马云飞[1] 王韬[1] 陈浩[1] 张帆[2] 楼潇轩 许鲁珉 杨文兵 

机构地区：[1]军械工程学院信息工程系,河北石家庄050003 [2]浙江大学信息与电子工程学院,浙江杭州310027 [3]九八〇四厂军代室,云南曲靖655000

出　　处：《浙江大学学报（工学版）》2017年第9期1770-1779,共10页Journal of Zhejiang University：Engineering Science

基　　金：国家自然科学基金资助项目(61272491,61309021,61472357);保密通信重点实验室基金资助项目(9140C110602150C11053)

摘　　要：针对SIMON密码按位与&运算特性以及现有立方攻击与故障攻击的不足,给出一种故障立方攻击方法.根据线性和二次多项式数量确定候选故障注入轮;利用差分特征表确定故障注入的具体位置;利用离线阶段求得的大量低次多项式,恢复部分轮密钥,并结合密钥猜测攻击恢复全轮密钥.结果表明:对SIMON32/64进行故障立方攻击,需要平均注入故障69次,计算复杂度为247.91,优于现有立方攻击;相比于差分故障攻击,采用故障立方攻击方法确定故障位置更有效,故障模型更易实现,且整个攻击过程具有自动化程度高的特点.该方法可为核心运算次数较低的轻量级分组密码提供借鉴.A fault-cube method was given aiming at the special property of And operation（）in SIMON and the problem in previous cube attack and fault attack.The round-candidates for fault injection were identified according to the number of linear and quadratic equations.Positions for fault injection were determined by using a difference-characteristics table.Some round-keys were recovered by extracting lowdegree equations during the off-line phase.Then,the entire round-keys were obtained with combination of guess-and-determine attack.The experimental results show that the attack on SIMON32/64 needs 69 fault injections on average and requires a compute complexity of 247.91,which is better than the previous cube attack.Compared to differential fault attack,the fault-cube method is more effective in determining fault positions.Moreover,using the fault model is easier to realize and the attack process is of high automation.The fault-cube method will provide some ideas on other lightweight block ciphers with low-degree core operations as well.

关 键 词：轻量级分组密码 SIMON 立方攻击 故障攻击 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]