一种NoisyRounds保护的白盒AES实现及其差分故障分析  

A NoisyRounds-based White-box AES Implementation and Corresponding Differential Fault Analysis

作　　者：孙涛 唐国俊 吴昕锴 毛振宁 龚征[1] SUN Tao;TANG Guo-Jun;WU Xin-Kai;MAO Zhen-Ning;GONG Zheng(School of Computer Science,South China Normal University,Guangzhou 510631,China)

机构地区：[1]华南师范大学计算机学院,广州510631

出　　处：《密码学报》2020年第3期342-357,共16页Journal of Cryptologic Research

基　　金：国家自然科学基金(61572028);“十三五”国家密码发展基金(MMJJ20180206)。

摘　　要：差分故障分析(differential fault analysis,DFA)是一种通过对密码算法中间状态注入错误从而获取密钥信息的侧信道攻击方法.由Bos等人创造性的用于白盒分组密码方案并成功破解多个公开发表的白盒AES实现.本文基于随机冗余轮函数(DummyRounds)和Chow等人的AES白盒实现(以下简称Chow-WBAES),提出一种称为NoisyRounds的白盒AES安全加固方案(以下简称NoisyRoundsWBAES).该方案通过改变Chow-WBAES的第10轮并在其后添加相互抵消的结构,使得NoisyRoundsWBAES能对DFA分析产生混淆作用.通过NoisyRounds-WBAES与Chow-WBAES实施DFA攻击的分析结果表明,在带外部编码的情况下,NoisyRounds与现有保护方案一样能抵抗DFA工具的分析.但相应的算法的输出结果也将带上外部编码,从而失去不同系统间的兼容性,在不带外部编码的情况下,n组NoisyRounds对DFA分析将产生O(n^4)的计算复杂度.Differential fault analysis(DFA)is a pivotal side-channel tool that can extract the secret information by injecting faults into the execution process of cryptographic algorithms.This approach has been used as a security assessment of the white-box cryptography and successfully cracked many published white-box AES(WBAES)implementations.In this paper,based on Dummy Rounds and Chow et al.’s WBAES,the NoisyRounds-WBAES is introduced to resist DFA.In particular,NoisyRounds-WBAES obfuscates the 10-th round function in WBAES and applies some self-counteracting redundant computations.Comparing with the related WBAES proposals,external encoding can protect the white-box implementations from DFA,and the corresponding output results can also be encoded by the external encoding,which leads to incompatibility between different systems.Without external encoding,the n-round NoisyRounds can obfuscate the DFA tool analysis with computational complexity being O(n^4).

关 键 词：AES算法 白盒安全 侧信道攻击 差分故障攻击 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]