基于秘密共享的LBlock的S盒防御方案  

The Defense Scheme of S-box on LBlock Based on Secret Sharing

作　　者：陈柏沩 夏璇 钟卫东[1,2] 吴立强[1] CHEN Bowei;XIA Xuan;ZHONG Weidong;WU Liqiang(College of Cryptographic Engineering,Engineering University of PAP,Xi’an 710086,China;Network and Information Security Key Laboratory of PAP,Xi’an 710086,China)

机构地区：[1]武警工程大学密码工程学院,西安710086 [2]网络与信息安全武警部队重点实验室,西安710086

出　　处：《信息网络安全》2021年第7期80-86,共7页Netinfo Security

基　　金：国家重点研发计划[2017YFB0802000];武警工程大学基础基金[WJY201914]。

摘　　要：针对LBlock算法在侧信道攻击前脆弱的问题,文章提出一种可以抵抗一阶和二阶差分功耗攻击(Differential Power Analysis,DPA)的门限防护方案。该方案以秘密共享原理为基础理论,并且在算法进行运算时采用了复合域的概念,将算法的运算域由GF(24)转移到GF(22)上,减少硬件消耗的同时,又提高了算法的安全性。在乘法器分组中采用虚拟值方法,以保证满足门限方案的均匀性,并在反相器中引入分解法,以保证各信息分组相关独立且线性无关。分析验证表明,方案满足门限方案所需要的各项性质,并且可以抵御一阶、二阶DPA攻击。所有的信息分组都是独立且无联系的,所以该方案对于glitch攻击也具有相应的防护能力,具有较好的实用性。Aiming at the problem that the LBlock algorithm is very fragile before side-channel attacks,the article proposes a threshold protection scheme that can resist first-order and second-order Differential Power Analysis(DPA).This scheme is based on the principle of secret sharing,and adopts the concept of compound domain when the algorithm is operated,and transfers the operation domain of the algorithm from GF(24)to GF(22).While reducing hardware consumption,it also improves the security of the algorithm.The virtual value method is used in the multiplier grouping to ensure the uniformity of the threshold scheme,and the decomposition method is introduced in the inverter to ensure that each information group is independent and linearly independent.Through analysis and verification,the scheme satisfies all the properties required by the threshold scheme and can resist first-order and second-order DPA attacks.Because all information groups are independent and unrelated,the solution also has corresponding protection against glitch attacks and has good practicability.

关 键 词：秘密共享 DPA攻击 防御方案 glitch攻击 S盒 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]