对Grain-128AEAD的立方体攻击及恶意软件分析方法综述

### 对Grain - 128AEAD的立方体攻击及恶意软件分析方法综述 #### 1. 对Grain - 128AEAD的立方体攻击 在密码学领域，对加密算法的安全性进行分析至关重要。这里主要探讨针对Grain - 128AEAD的立方体攻击方法。 ##### 1.1 攻击算法 - **预处理阶段（算法3）** 输入包括立方体大小 \( \ell_c \)、每个立方体大小测试的立方体数量 \( c_{max} \)、BLR线性测试次数 \( n \) 以及缩减初始化轮数 \( r \)。具体步骤如下： ```plaintext Algorithm 3 Pre-processing Phase of Cube Attack against Grain - 128AEAD Input: Cube size ℓc, No. of tested cubes cmax for each cube size, No. of BLR linearity tests n, Reduced initialisation round r 1: for 1 to cmax do 2: Choose a cube C of size ℓc at random 3: success ← 0 4: for 1 to n do 5: K0 ← 0128 6: K1 ← rand{0, 1}128 7: K2 ← rand{0, 1}128 8: K3 ← rand{0, 1}128 9: Re - initialise the state 10: for i = 0 to 3 do 11: Compute PC(Ki, V ) using yt compute from Grain128AEADInitImp 12: end for 13: if PC(K0, V ) + PC(K1, V ) + PC(K2, V ) = PC(K1 + K2, V ) then 14: PS(I) passes the respective BLR test 15: success ← success + 1 16: else 17: break 18: end if 19: end for 20: if success = n then 21: Construct coefficients in the ANF of PS(I) 22: α−1 ← PS(I)(K = (0, ..., 0)) 23: αi ← PS(I)(K = (0, ..., 1  i - th , 0, ..., 0)) + α−1 for i = 0, ..., 127 24: PS(I)(K) ← α−1 + α0k0 + α1k1 + · · · + α127k127 25: Record C, reduced round r, and PS(I) 26: end if 27: end for ``` - **在线阶段（算法4）** 输入为预处理阶段获得的缩减轮数 \( r \) 的一组立方体 \( C \)。步骤如下： ```plaintext Algorithm 4 Online Phase of Cube Attack against Grain - 128AEAD Input: A set of cubes C for a reduced round r obtained from the pre - processing phase 1: Create a random key K 2: for each cube C from the pre - processing phase do 3: Compute ∑ v∈C P(K, V ) using Grain128AEADInitImp 4: if PS(I) = ∑ v∈C P(K, V ) then 5: Cube C is verified to distinguish the output of Grain - 128AEAD from random 6: else 7: The cube C is determined as a false cube 8: end if 9: end for ``` ##### 1.2 实验结果 实验对不同立方体大小和缩减时钟值进行了测试，结果如下： | 立方体大小 \( \e