HC-256流密码：高效软件实现与安全性分析

需积分: 10 80 浏览量更新于2024-07-31 收藏 221KB PDF 举报

"HC-256是一种高效的流密码算法，由256位的秘密密钥和256位的初始化向量生成密钥流。在Intel Pentium 4处理器上，其C语言实现的加密速度约为1.9位每时钟周期（4.2个周期/字节）。文中还介绍了一个HC-256的变种。" 流密码HC-256是一种用于共享密钥加密的算法，其设计目标是实现软件效率高、安全性强。与块密码相比，现代高效的流密码在软件实现中可以运行得更快，大约快4到5倍。然而，尽管流密码有这些优势，但公开的安全且高效的流密码设计并不多见。例如，常用的RC4流密码就存在多个已知弱点。在NESSIE项目中，提交的六种流密码方案均未达到严格的 security 要求。因此，本论文旨在设计一个简单、安全、软件效率高且免费可用的流密码算法，即HC-256。该算法由两个秘密表组成，每个表包含1024个32位元素。在每个步骤中，我们会更新其中一个表中的一个元素，以此来生成密钥流。 HC-256的工作机制涉及到密钥扩展和状态更新。密钥扩展过程将256位的密钥和初始化向量扩展成足够长度的密钥流，用于加密或解密数据。这个过程通常包括一系列的非线性和线性变换，以增加密码的复杂性和安全性。状态更新则是通过特定的算法操作来改变内部状态，确保密钥流的不可预测性。文章中提到的HC-256的变种可能是指对原始算法进行了一些修改，以增强某些方面的性能或者解决可能存在的安全性问题。这种变种可能涉及调整内部结构、改变更新规则或引入新的混淆和扩散机制。 HC-256的高效性能在于其在Intel Pentium 4处理器上的表现，1.9位每时钟周期的加密速度意味着它在实际应用中能够快速处理大量数据。这使得HC-256适用于需要高速加密的场景，如网络通信、数据存储和实时流媒体等。 HC-256是一种针对软件环境优化的流密码算法，旨在提供良好的加密速度和安全性。它的设计考虑了现有的流密码弱点，并试图通过创新的结构和操作来克服这些问题。尽管如此，任何密码算法的安全性都需要经过持续的分析和攻击尝试来验证，以确保其在面对新威胁时依然可靠。

3.2 Security of the secret key

We note that the output function and the feedback function of HC-256 are

highly non-linear. The non-linear output function leaks very small amount of

partial information at each step. The non-linear feedback function ensures that

the secret key could not be recovered from those leaked partial information.

In this subsection, we will ﬁrst illustrate that even for the HC-256 with no

linear masking, it is impossible to recover the secret key faster than exhaustive

key search. Then we show that recovering the secret key of HC-256 is more

diﬃcult.

HC-256 with no linear masking. For HC-256 with no linear masking, the

output at the ith step is generated as s

= h

( P [i ¯ 12] ) or s

= h

( Q[i ¯ 12] ).

If two outputs generated from the same S-box are equal, then those two inputs

to the S-box are equal with large probability. According to the analysis of the

randomness of h

(x) and h

(x) given in Subsection 4.1, we know that for 2048×

α ≤ i < j < 2048×α+1024, the probability that s

= s

is about 2

−31

. If s

= s

then at the j-th step, P [i ¯ 12] = P [j ¯ 12] with probability about 0.5. It means

that 15-bit information of the table P is leaked. We note that each S-box is used

in only 1024 steps. For these 1024 outputs, there are about

1024

× 2

−31

≈ 2

−12

collisions. To recover P , we need

1024×32

−12

×15

× 1024 ≈ 2

33.1

outputs. We also note

that P and Q interact in a very complicated way (each table is used as S-box to

update another table), so they must be recovered together. Thus 2

34.1

outputs

are needed in the attack to recover P and Q if we exploit the information being

leaked in this way. Note that the feedback function of HC-256 is highly non-linear

and it can not be simply approximated as LFSR, we conclude that recovering P

and Q from those 2

34.1

outputs would be more diﬃcult than exhaustive search.

HC-256. The analysis above shows that the secret key of HC-256 with no linear

masking is secure. With the linear masking, the information leakage is greatly

reduced. For 2048 × α ≤ i < j < 2048 × α + 1024, if two outputs s

and s

are

equal, we know that h

(P [i ¯ 12]) ⊕ P [i] = h

(P [j ¯ 12]) ⊕ P [j]. Since h

(P [i ¯

12]) = h

(P [j ¯ 12) with probability about 2

−31

, the probability that P [i] = P [j]

is about 2

−31

. It means that each collision leaks about 2

−26.1

-bit information,

which is 2

times less than that leaked from the collison of the outputs of HC-

256 with no linear masking. The information leakage is signiﬁcantly reduced

and it is obvious that the linear masking improves the security tremendously.

Note that the analysis above shows already that the key of HC-256 with no

linear masking is secure, so we conclude that the secret key of HC-256 cannot

be recovered faster than exhaustive key search.

3.3 Security of the initialization process (key/IV setup)

The initialization process of the HC-256 consists of two stages, as given in Sub-

section 2.2. We expand the key and IV into P and Q. At this stage, every bit

剩余22页未读，继续阅读

scalps

粉丝: 1
资源: 9

HC-256流密码：高效软件实现与安全性分析

shiro-crypto-cipher-1.4.0-API文档-中文版.zip

[2005-V1]Grain - A Stream Cipher for Constrained Environments.pdf

prince-c-ref:C99中的Prince cipher源代码和具有中间值的测试向量-vector source code

Cipher Cracker-开源

ACO Substitution Cipher Cracker-开源

rust-stream-cipher

ciphersuite-name-converter:一个简单的CLI（可能是Web）库脚本可在openSSL和SSLTLS密码套件字符串之间进行转换

tls-cipher-list-policy

Atbash-Cipher-Encoder-Decoder

case-study-caesar-cipher-p21ajoliet：GitHub Classroom创建的case-study-caesar-cipher-p21ajoliet

最新资源