对SM4算法的改进差分故障攻击  

Improved Differential Fault Attack for SM4 Cipher

作　　者：金雨璇 杨宏志 王相宾 袁庆军 JIN Yu-Xuan;YANG Hong-Zhi;WANG Xiang-Bin;YUAN Qing-Jun(PLA Strategic Support Force Information Engineering University,Zhengzhou 450000,China;Henan Key Laboratory of Network Cryptography Technology,Zhengzhou 450000,China;Shenzhen NST Technology Co.Ltd.,Shenzhen 518028,China)

机构地区：[1]战略支援部队信息工程大学,郑州450000 [2]河南省网络密码技术重点实验室,郑州450000 [3]深圳网安计算机安全检测技术有限公司,深圳518028

出　　处：《密码学报》2020年第4期453-464,共12页Journal of Cryptologic Research

基　　金：国家自然基金(61602512);河南省网络密码技术重点实验室开放基金(LNCT2019-S02)。

摘　　要：SM4算法是国内首个官方公布的商用密码算法.本文研究SM4密码算法在差分故障攻击方向的安全性.在现有故障模型的基础上,针对现有故障注入能力已提高至比特级别的现状,提出面向比特的随机故障模型.理论上,本攻击模型通过1次单比特故障注入,结合平均15.3526比特的穷举攻击,就可以完全恢复出SM4的128比特初始密钥.由于SM4算法S盒的差分均匀度为4,也即存在四个解的差分方程,因此实际攻击时穷举攻击的复杂度将高于理论值2比特左右;随后在普通PC机上进行了大量的仿真实验,实验结果也佐证了这一事实,恢复SM4初始密钥的穷举攻击复杂度大约在15到18比特.SM4 algorithm is the first officially published commercial cryptographic algorithm standard in China.This paper studies the security of the SM4 cipher algorithm against Differential Fault Analysis.Based on the existing model of fault analysis,where the existing fault injection capability has been improved to the bit level,a bit level random fault model is proposed.In theory,with a single fault injection,combined with an average of 15.3526 bits of exhaustive attacks,the 128-bit initial key of SM4 can be fully recovered with this model.Since the difference uniformity of the S-box of the SM4 algorithm is 4,that is,there are difference equations which have four solutions,the complexity of the exhaustive attack in actual attack will be higher than the theoretical value by about 2 bits.A large number of simulation experiments has been performed on a normal PC,the experimental results support the fact that the exhaustive attack complexity of restoring the SM4 initial key is approximately 15 to 18 bits.

关 键 词：SM4算法 差分故障攻击 单比特故障 故障模型 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]