【作者】 张勇；

【导师】 吴宁；

【作者基本信息】 南京航空航天大学 ， 电路与系统， 2018， 硕士

【摘要】 随着网络接入技术的飞速发展,高速接入网络中的信息安全已经成为人们关注的热点问题。AES-GCM加密算法可以解决高速接入网中潜在的窃听以及假冒威胁,已被广泛应用于现行的高速接入网络中保护敏感数据。旁路攻击是一种新型密码分析技术,通过分析密码电路泄漏的旁路信息破解密钥。以功耗攻击为代表的旁路攻击技术发展迅速,已经对密码电路构成了巨大威胁。AES-GCM密码电路中数据加密部分存在可被功耗攻击的漏洞,为了提升电路的安全性,需要对AES-GCM密码电路的功耗攻击及防御措施进行研究。论文的主要工作是研究AES-GCM密码电路的高阶差分功耗攻击HO-DPA和碰撞攻击CA以及它们的防御措施。根据AES-GCM加密算法特点,设计了一种高速AES-GCM电路结构,提出了基于延时分析的AES电路流水线划分方法,结合Karatsuba算法和快速求余算法改进了有限域乘法器的结构设计,实现了6级流水结构的比特并行乘法器。为了简化HO-DPA攻击过程,基于HO-DPA原理以及Synopsys IC设计工具和SIMC 0.18μm工艺库,设计了HO-DPA仿真平台并成功攻击了一阶全掩码AES加密电路,该平台是验证相关防御策略的基础。针对一阶掩码无法抵御HO-DPA的问题,通过添加二阶掩码的方式防御HO-DPA。为了拓宽CA的应用范围,对掩码重用型AES加密电路进行碰撞攻击的研究,构造了基于距离检测法的碰撞检测器,给出了碰撞阈值的设置方法,并改造传统碰撞链使之具有一定的容错能力。为了抵御CA,提出了一种基于随机延时的并行S盒电路结构,该结构通过破坏功耗曲线的一致性,增大碰撞检测难度,降低碰撞攻击的成功率。基于Xilinx公司ISE14.4对高速AES-GCM加密电路进行综合,电路最大吞吐率42.4Gbps,资源开销6482Slices,电路效率达到6.55Mbps/Slice,与串行结构电路相比吞吐率提高了105.8%,与并行结构电路相比电路效率提高了148.1%。基于HO-DPA仿真平台对AES-GCM电路中二阶掩码AES加密部分进行攻击,无法成功破解密钥,表明所设计的二阶掩码AES电路具备抵抗HO-DPA的能力。对基于随机延时S盒的AES加密电路进行碰撞攻击,无法正确检测到碰撞,表明该结构能够有效防御碰撞攻击。更多还原

【Abstract】 With the rapid development of network access technology,information security in high-speed access networks has become a hot issue.AES-GCM algorithm can solve potential eavesdropping and counterfeiting threats in high-speed access networks and has been widely used in the current high-speed access network to protect private data.Side channel attack is a new type of cryptanalysis technique that resolves keys by analyzing the leaked side channel information.As a representative of side channel attack,power attack has posed a huge threat to cryptography circuits.There are vulnerabilities that can be attacked by power attacks in the encryption part of AES-GCM.To improve the security of AES-GCM,it is necessary to study the power attack and its defense.The main work of this paper is to study the High-Order Differential Power Attack HO-DPA and Collision Attack CA and their defense of AES-GCM cryptography.According to the feature of AES-GCM algorithm,this paper designs a high-speed AES-GCM circuit,proposes an AES pipeline division method based on delay analysis,designs a bit parallel multiplication based on the combination of Karatsuba algorithm and fast redundancy algorithm.In order to simplify the HO-DPA attack process,this paper designs a HO-DPA emulation platform based on HO-DPA principle,Synopsys IC design tool and SIMC 0.18μm library,and successfully attacks the first-order masked AES circuit.The platform is the basis for validating the defense strategy.To resist HO-DPA,a second-order mask strategy is applied.In order to broaden the application range of CA,this paper studies the CA of mask-reusing AES,constructs a collision detector based on distance detection,gives the setting method of collision threshold,and renovates the traditional collision chain to make it have a certain degree of fault tolerance.In order to defend CA,a parallel S-box based on random delay is proposed which reduces the success rate of CA by breaking the consistency of power curve.The high-speed AES-GCM encryption circuit is synthesized by ISE14.4.The maximum throughput of the circuit is 42.4Gbps,the resource overhead is 6482 Slices and the efficiency is 6.55Mbps/slice.Compared with the serial circuit,the throughput is improved by 105.8%,compared with the parallel circuit the efficiency is increased by 148.1%.The second-order mask AES of the AES-GCM is attacked based on the HO-DPA platform.Experiment results show that the designed second-order mask AES circuit has the capability of resisting HO-DPA.Then the AES containing S-box based on random delay is attacked by CA,and the collision can not be detected correctly,which shows that the S-box based on random delay can prevent the collision attack.更多还原