论文部分内容阅读
Camellia是NESSIE计划中128位分组密码的最终获胜者.现有的针对Camellia的Cache计时攻击大多基于时序驱动模型,需百万计的样本在几十分钟内完成.文中研究表明,由于频繁的查找表操作,Camellia对访问驱动Cache计时攻击也是脆弱的,攻击所需样本量比时序驱动要小.首先,基于访问驱动方式,给出了一种通用的针对对称密码S盒的分析模型,指出Camellia加密过程中的轮函数易泄露初始密钥和轮密钥的异或结果值,密钥扩展中的左移函数使得Camellia安全性大大降低.然后,给出了多例针对Camellia-128/192/256的访问驱动Cache计时攻击,实验结果表明:500和900个随机明文样本可恢复Camellia-128、Camellia-192/256密钥,文中的攻击可被扩展到针对已知密文条件下的解密过程或远程环境中进行实施,3000个随机明文可在局域网和校园网环境下恢复Camellia-128/192/256密钥.最后,分析了Camellia易遭受Cache计时攻击的原因,并为密码设计者提出了防御该攻击的一些有效措施.
Camellia is the ultimate winner of the 128-bit block cipher in NESSIE program.Currently Cache caching attacks on Camellia are mostly based on a time-driven model and millions of samples are required to be completed in tens of minutes.Research shows that due to frequent searching Table operation, Camellia is also vulnerable to access-driven Cache timing attack, the attack required sample size is smaller than the timing-driven.Firstly, based on the access-driven method, a generic analysis model for symmetric-key S-box is given, The round function in the encryption process is easy to reveal the XOR result value of the initial key and the round key, and the left shift function in the key expansion greatly reduces the security of Camellia.Then, several examples are given for the Camellia-128/192 / The results show that 500 and 900 random plaintext samples can recover the Camellia-128 and Camellia-192/256 keys. Attacks in this paper can be extended to the decryption process under known ciphertext conditions Or remote environment, 3000 random plaintexts can recover Camellia-128/192/256 keys in LAN and campus network.Finally, it analyzes that Camellia is vulnerable to Cache timing attack The reason for the attack, and for password designers put forward some effective measures to defend the attack.