040_密码学实战：自定义密码分析技术深度解析——从差分密码分析到线性攻击的完整指南

自定义密码分析框架:
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ 差分密码分析    │ │ 线性密码分析    │ │ 代数攻击        │
├─────────────────┤ ├─────────────────┤ ├─────────────────┤
│ 利用差分传播    │ │ 寻找线性逼近    │ │ 建立方程组      │
│ 密钥恢复        │ │ 概率攻击        │ │ 求解密钥        │
└─────────────────┘ └─────────────────┘ └─────────────────┘

# 安装必要的Python库
# pip install numpy matplotlib sympy cryptography

import numpy as np
import matplotlib.pyplot as plt
import sympy as sp
import itertools
from collections import Counter

def build_ddt(sbox, block_size=8):
    """构建S盒的差分分布表
    
    Args:
        sbox: S盒查找表，列表形式
        block_size: 块大小（比特）
    
    Returns:
        numpy数组: 差分分布表
    """
    # 计算可能的输入数量
    n = 2 ** block_size
    
    # 初始化差分分布表
    ddt = np.zeros((n, n), dtype=int)
    
    # 遍历所有可能的输入对
    for x in range(n):
        for dx in range(n):  # dx是输入差分
            y = sbox[x]
            y_prime = sbox[x ^ dx]
            dy = y ^ y_prime  # dy是输出差分
            ddt[dx][dy] += 1
    
    return ddt

# 示例：简化版S盒
mini_sbox = [0xE, 0x4, 0xD, 0x1, 0x2, 0xF, 0xB, 0x8, 0x3, 0xA, 0x6, 0xC, 0x5, 0x9, 0x0, 0x7]

# 构建差分分布表
ddt = build_ddt(mini_sbox, 4)

# 打印差分分布表
print("差分分布表:")
print("dx\dy | " + " ".join(f"{i:2x}" for i in range(16)))
print("-----+" + "----" * 16)
for dx in range(16):
    row = [f"{count:2d}" for count in ddt[dx]]
    print(f"{dx:3x}  | " + " ".join(row))

def find_high_probability_differential(cipher, rounds, target_prob=0.01):
    """寻找高概率差分路径
    
    Args:
        cipher: 密码对象，需要实现round_function方法
        rounds: 轮数
        target_prob: 目标概率阈值
    
    Returns:
        list: 高概率差分路径列表
    """
    high_prob_paths = []
    
    # 初始状态：所有可能的输入差分
    initial_diffs = [(i, 1.0) for i in range(1, 2**cipher.block_size)]  # 排除零差分
    
    # BFS搜索差分路径
    for round_num in range(rounds):
        new_diffs = []
        
        for diff, prob in initial_diffs:
            # 计算当前轮函数后的差分分布
            round_diffs = cipher.round_function(diff)
            
            for out_diff, trans_prob in round_diffs.items():
                new_prob = prob * trans_prob
                if new_prob >= target_prob:
                    new_diffs.append((out_diff, new_prob))
        
        initial_diffs = new_diffs
        
        # 记录每轮的高概率差分
        if initial_diffs:
            high_prob_paths.append({
                'round': round_num + 1,
                'differentials': initial_diffs
            })
    
    return high_prob_paths

class SimpleFeistelCipher:
    """简化的Feistel密码实现"""
    def __init__(self, key, rounds=4):
        self.key = key
        self.rounds = rounds
        self.block_size = 8  # 8比特块大小
    
    def f_function(self, right, subkey):
        """简化的轮函数"""
        # 这里使用一个简单的函数作为示例
        return (right * subkey) % 16
    
    def get_subkey(self, round_num):
        """生成子密钥"""
        return (self.key + round_num) % 16
    
    def encrypt(self, plaintext):
        """加密函数"""
        # 分割为左右两部分
        left = plaintext >> 4
        right = plaintext & 0xF
        
        for i in range(self.rounds):
            # 保存当前右侧
            temp = right
            # 轮函数应用
            f_output = self.f_function(right, self.get_subkey(i))
            # 更新左右部分
            right = left ^ f_output
            left = temp
        
        # 最后一轮后交换左右
        return (right << 4) | left
    
    def decrypt(self, ciphertext):
        """解密函数"""
        # 分割为左右两部分
        left = ciphertext >> 4
        right = ciphertext & 0xF
        
        for i in range(self.rounds-1, -1, -1):
            # 保存当前右侧
            temp = right
            # 轮函数应用
            f_output = self.f_function(right, self.get_subkey(i))
            # 更新左右部分
            right = left ^ f_output
            left = temp
        
        # 最后一轮后交换左右
        return (right << 4) | left

def differential_attack(cipher, num_pairs=1000):
    """对简化Feistel密码的差分攻击"""
    # 选择差分特征：输入差分0x80，期望输出差分0x08
    input_diff = 0x80
    expected_output_diff = 0x08
    
    # 收集明文-密文对
    plaintext_pairs = []
    ciphertext_pairs = []
    
    for _ in range(num_pairs):
        p1 = np.random.randint(0, 256)
        p2 = p1 ^ input_diff
        
        c1 = cipher.encrypt(p1)
        c2 = cipher.encrypt(p2)
        
        # 验证输出差分
        if (c1 ^ c2) == expected_output_diff:
            plaintext_pairs.append((p1, p2))
            ciphertext_pairs.append((c1, c2))
    
    # 对最后一轮子密钥进行猜测
    subkey_candidates = Counter()
    
    for (p1, p2), (c1, c2) in zip(plaintext_pairs, ciphertext_pairs):
        # 从密文恢复最后一轮的状态
        left_c1 = c1 & 0xF
        right_c1 = c1 >> 4
        left_c2 = c2 & 0xF
        right_c2 = c2 >> 4
        
        # 猜测最后一轮子密钥
        for k in range(16):
            # 计算最后一轮的可能中间值
            f1 = right_c1 ^ left_c1
            f2 = right_c2 ^ left_c2
            
            # 检查是否满足差分约束
            if (f1 ^ f2) == ((right_c1 * k) ^ (right_c2 * k)) % 16:
                subkey_candidates[k] += 1
    
    # 返回最可能的子密钥
    return subkey_candidates.most_common(1)[0][0]

# 测试差分攻击
cipher = SimpleFeistelCipher(key=7, rounds=4)
true_key = cipher.get_subkey(3)  # 最后一轮子密钥
found_key = differential_attack(cipher, num_pairs=1000)

print(f"真实子密钥: {true_key}")
print(f"恢复的子密钥: {found_key}")
print(f"攻击成功: {true_key == found_key}")

def build_lat(sbox, block_size=8):
    """构建S盒的线性近似表
    
    Args:
        sbox: S盒查找表，列表形式
        block_size: 块大小（比特）
    
    Returns:
        numpy数组: 线性近似表
    """
    # 计算可能的掩码数量
    n = 2 ** block_size
    
    # 初始化线性近似表
    lat = np.zeros((n, n), dtype=int)
    
    # 遍历所有可能的输入和输出掩码
    for input_mask in range(n):
        for output_mask in range(n):
            # 计算满足线性近似的输入数量
            count = 0
            
            for x in range(n):
                y = sbox[x]
                
                # 计算线性组合：input_mask · x ⊕ output_mask · y
                input_linear = bin(input_mask & x).count('1') % 2
                output_linear = bin(output_mask & y).count('1') % 2
                
                if input_linear == output_linear:
                    count += 1
            
            # 计算偏差：(count - n/2) / n
            lat[input_mask][output_mask] = count - n // 2
    
    return lat

# 使用之前的简化版S盒
mini_sbox = [0xE, 0x4, 0xD, 0x1, 0x2, 0xF, 0xB, 0x8, 0x3, 0xA, 0x6, 0xC, 0x5, 0x9, 0x0, 0x7]

# 构建线性近似表
lat = build_lat(mini_sbox, 4)

# 打印线性近似表
print("线性近似表:")
print("输入掩码\输出掩码 | " + " ".join(f"{i:2x}" for i in range(16)))
print("---------------+" + "----" * 16)
for input_mask in range(16):
    row = [f"{val:2d}" for val in lat[input_mask]]
    print(f"{input_mask:14x}  | " + " ".join(row))

def find_optimal_linear_approximation(cipher, rounds, target_bias=0.1):
    """寻找最优线性近似
    
    Args:
        cipher: 密码对象，需要实现linear_approx方法
        rounds: 轮数
        target_bias: 目标偏差阈值
    
    Returns:
        dict: 最优线性近似信息
    """
    best_approximations = []
    
    # 初始状态：所有可能的输入掩码（排除零掩码）
    initial_masks = [(i, 1.0) for i in range(1, 2**cipher.block_size)]
    
    # 逐轮构建线性近似
    for round_num in range(rounds):
        new_masks = []
        
        for mask, bias in initial_masks:
            # 计算当前轮函数的线性近似
            round_approx = cipher.linear_approx(mask)
            
            for out_mask, approx_bias in round_approx.items():
                # 多轮线性近似的偏差组合规则
                new_bias = 2 * approx_bias * bias - bias  # 简化的偏差组合公式
                
                if abs(new_bias) >= target_bias:
                    new_masks.append((out_mask, new_bias))
        
        initial_masks = new_masks
        
        # 记录每轮的最佳近似
        if initial_masks:
            best_approx = max(initial_masks, key=lambda x: abs(x[1]))
            best_approximations.append({
                'round': round_num + 1,
                'input_mask': best_approx[0],
                'bias': best_approx[1]
            })
    
    return best_approximations

class SimpleFeistelCipher:
    """简化的Feistel密码实现（用于线性攻击）"""
    def __init__(self, key, rounds=4):
        self.key = key
        self.rounds = rounds
        self.block_size = 8  # 8比特块大小
    
    def f_function(self, right, subkey):
        """简化的轮函数"""
        # 使用一个更适合线性分析的函数
        return (right + subkey) % 16
    
    def get_subkey(self, round_num):
        """生成子密钥"""
        return (self.key + round_num) % 16
    
    def encrypt(self, plaintext):
        """加密函数"""
        # 分割为左右两部分
        left = plaintext >> 4
        right = plaintext & 0xF
        
        for i in range(self.rounds):
            # 保存当前右侧
            temp = right
            # 轮函数应用
            f_output = self.f_function(right, self.get_subkey(i))
            # 更新左右部分
            right = left ^ f_output
            left = temp
        
        # 最后一轮后交换左右
        return (right << 4) | left

def linear_attack(cipher, num_samples=10000):
    """对简化Feistel密码的线性攻击"""
    # 选择线性近似：假设我们找到了一个好的线性表达式
    # 这里使用一个简化的线性近似作为示例
    
    # 收集明文-密文对
    samples = []
    for _ in range(num_samples):
        p = np.random.randint(0, 256)
        c = cipher.encrypt(p)
        samples.append((p, c))
    
    # 对最后一轮子密钥进行猜测
    subkey_scores = {}
    
    for k in range(16):  # 最后一轮子密钥可能的取值
        correct_count = 0
        
        for p, c in samples:
            # 从明文和密文提取需要的位
            p_left = p >> 4
            p_right = p & 0xF
            c_left = c & 0xF
            c_right = c >> 4
            
            # 线性近似：P_left[0] ⊕ P_right[0] ⊕ C_left[0] = f(C_right, k)[0]
            # 这里使用最低有效位作为示例
            p_left_lsb = (p_left >> 3) & 1
            p_right_lsb = (p_right >> 3) & 1
            c_left_lsb = (c_left >> 3) & 1
            
            # 计算f函数输出的LSB
            f_output = (c_right + k) % 16
            f_lsb = (f_output >> 3) & 1
            
            # 验证线性近似
            if (p_left_lsb ^ p_right_lsb ^ c_left_lsb) == f_lsb:
                correct_count += 1
        
        # 计算偏差
        bias = abs(correct_count / num_samples - 0.5)
        subkey_scores[k] = bias
    
    # 返回偏差最大的子密钥
    best_key = max(subkey_scores.items(), key=lambda x: x[1])[0]
    return best_key, subkey_scores

# 测试线性攻击
cipher = SimpleFeistelCipher(key=7, rounds=4)
true_key = cipher.get_subkey(3)  # 最后一轮子密钥
found_key, scores = linear_attack(cipher, num_samples=10000)

print(f"真实子密钥: {true_key}")
print(f"恢复的子密钥: {found_key}")
print(f"攻击成功: {true_key == found_key}")
print("子密钥评分:")
for k, score in sorted(scores.items(), key=lambda x: x[1], reverse=True):
    print(f"  子密钥 {k}: 偏差 = {score:.6f}")

def build_boolean_equations(sbox, block_size=4):
    """为S盒构建布尔方程
    
    Args:
        sbox: S盒查找表
        block_size: 块大小（比特）
    
    Returns:
        list: 布尔方程列表
    """
    equations = []
    
    # 为每个输入组合生成方程
    for x in range(2**block_size):
        y = sbox[x]
        
        # 将输入和输出转换为二进制
        x_bin = format(x, f'0{block_size}b')
        y_bin = format(y, f'0{block_size}b')
        
        # 为每个输出位生成方程
        for i in range(block_size):
            # 创建输入变量
            input_vars = [f'x{j}' for j in range(block_size)]
            # 创建输出变量
            output_var = f'y{i}'
            
            # 构建方程：y_i = f(x_0, x_1, ..., x_{n-1})
            # 这里我们使用真值表的方式表示
            equation = {
                'output': output_var,
                'value': y_bin[i],
                'input': {f'x{j}': x_bin[j] for j in range(block_size)}
            }
            equations.append(equation)
    
    return equations

# 使用之前的简化版S盒
mini_sbox = [0xE, 0x4, 0xD, 0x1, 0x2, 0xF, 0xB, 0x8, 0x3, 0xA, 0x6, 0xC, 0x5, 0x9, 0x0, 0x7]

# 构建布尔方程
equations = build_boolean_equations(mini_sbox, 4)

# 打印部分方程示例
print("S盒布尔方程示例:")
for eq in equations[:8]:  # 只打印前8个方程作为示例
    print(f"{eq['output']} = {eq['value']} when input = {eq['input']}")

import numpy as np
from numpy.linalg import norm

class LatticeReduction:
    """简化的格基约简实现"""
    
    @staticmethod
    def gramschmidt(basis):
        """Gram-Schmidt正交化过程"""
        n = len(basis)
        b_star = np.zeros_like(basis, dtype=float)
        
        for i in range(n):
            b_star[i] = basis[i].copy()
            for j in range(i):
                mu = np.dot(basis[i], b_star[j]) / np.dot(b_star[j], b_star[j])
                b_star[i] -= mu * b_star[j]
        
        return b_star
    
    @staticmethod
    def babai_algorithm(basis, target):
        """Babai最近向量算法"""
        # 首先进行Gram-Schmidt正交化
        b_star = LatticeReduction.gramschmidt(basis)
        n = len(basis)
        
        # 计算系数
        c = np.zeros(n, dtype=float)
        v = target.copy()
        
        for i in range(n-1, -1, -1):
            c[i] = np.dot(v, b_star[i]) / np.dot(b_star[i], b_star[i])
            v -= np.round(c[i]) * basis[i]
        
        # 计算格点
        lattice_point = np.zeros_like(target)
        for i in range(n):
            lattice_point += np.round(c[i]) * basis[i]
        
        return lattice_point

# 简化的RSA小指数攻击示例
def small_e_rsa_attack(n, e, c):
    """RSA小指数攻击（e=3）"""
    # 构建格基
    # 对于e=3，我们尝试求解m^3 ≡ c mod n
    # 构造格 L = {(a, b) | a ≡ b*c mod n}
    
    # 确定格基维度
    dim = e
    basis = np.zeros((dim, dim), dtype=int)
    
    # 填充格基
    for i in range(dim-1):
        basis[i][i] = 1
    basis[dim-1][0] = n
    for i in range(1, dim):
        basis[dim-1][i] = 1
    
    # 目标向量
    target = np.zeros(dim, dtype=int)
    target[dim-1] = 1
    
    # 使用Babai算法找到最近向量
    reduction = LatticeReduction()
    lattice_point = reduction.babai_algorithm(basis, target)
    
    # 计算明文m
    m = int(lattice_point[dim-1])
    
    # 验证结果
    if pow(m, e, n) == c:
        return m
    else:
        return None

# 测试小指数攻击（仅用于演示，使用非常小的数）
n = 121  # 11*11，实际攻击中n应该很大
p = 11
q = 11
e = 3
m = 5
c = pow(m, e, n)

print(f"公钥: (n={n}, e={e})")
print(f"密文: {c}")
print(f"实际明文: {m}")

try:
    recovered_m = small_e_rsa_attack(n, e, c)
    print(f"恢复的明文: {recovered_m}")
    print(f"攻击成功: {recovered_m == m}")
except Exception as e:
    print(f"攻击失败: {str(e)}")

class SimpleBlockCipher:
    """简化的分组密码实现"""
    def __init__(self, key, rounds=3):
        self.key = key
        self.rounds = rounds
        self.block_size = 4  # 4比特块大小
        
        # 简化的S盒
        self.sbox = [0xE, 0x4, 0xD, 0x1, 0x2, 0xF, 0xB, 0x8, 0x3, 0xA, 0x6, 0xC, 0x5, 0x9, 0x0, 0x7]
        
        # 生成子密钥
        self.subkeys = []
        for i in range(rounds):
            self.subkeys.append((key + i * 7) % 16)
    
    def encrypt(self, plaintext):
        """加密函数"""
        state = plaintext
        
        # 初始轮密钥加
        state ^= self.subkeys[0]
        
        # 主轮
        for i in range(1, self.rounds):
            # S盒替换
            state = self.sbox[state]
            # 轮密钥加
            state ^= self.subkeys[i]
        
        # 最后一轮S盒替换
        state = self.sbox[state]
        
        return state

def build_cipher_equations(cipher, plaintext, ciphertext):
    """为密码算法构建代数方程"""
    equations = []
    variables = set()
    
    # 定义密钥变量
    key_var = 'k'
    variables.add(key_var)
    
    # 定义中间状态变量
    state_vars = []
    for i in range(cipher.rounds + 1):
        state_var = f's{i}'
        state_vars.append(state_var)
        variables.add(state_var)
    
    # 初始状态方程
    equations.append(f"{state_vars[0]} = {plaintext} ^ ({key_var} % 16)")
    
    # 主轮方程
    for i in range(1, cipher.rounds):
        # S盒替换方程
        equations.append(f"{state_vars[i]} = sbox[{state_vars[i-1]}]")
        # 轮密钥加方程
        equations.append(f"{state_vars[i]} = {state_vars[i]} ^ (({key_var} + {i} * 7) % 16)")
    
    # 最后一轮方程
    equations.append(f"{state_vars[cipher.rounds]} = sbox[{state_vars[cipher.rounds-1]}]")
    
    # 最终密文方程
    equations.append(f"{state_vars[cipher.rounds]} = {ciphertext}")
    
    return equations, variables

def algebraic_attack(cipher, known_pairs):
    """简化的代数攻击实现"""
    print("构建方程组...")
    all_equations = []
    all_variables = set()
    
    # 为每个已知的明文-密文对构建方程
    for p, c in known_pairs:
        equations, variables = build_cipher_equations(cipher, p, c)
        all_equations.extend(equations)
        all_variables.update(variables)
    
    print(f"生成了 {len(all_equations)} 个方程")
    print(f"涉及 {len(all_variables)} 个变量: {sorted(all_variables)}")
    
    # 打印部分方程示例
    print("\n部分方程示例:")
    for eq in all_equations[:5]:
        print(f"  {eq}")
    
    # 简化版求解：暴力搜索密钥空间
    print("\n开始暴力搜索密钥空间...")
    for key_candidate in range(256):  # 假设密钥是8比特
        # 创建子密钥
        subkeys = [(key_candidate + i * 7) % 16 for i in range(cipher.rounds)]
        
        # 验证所有明文-密文对
        valid = True
        for p, c in known_pairs:
            # 使用候选密钥加密
            state = p ^ subkeys[0]
            for i in range(1, cipher.rounds):
                state = cipher.sbox[state]
                state ^= subkeys[i]
            state = cipher.sbox[state]
            
            if state != c:
                valid = False
                break
        
        if valid:
            return key_candidate
    
    return None

# 测试代数攻击
cipher = SimpleBlockCipher(key=7, rounds=3)

# 准备已知的明文-密文对
known_pairs = []
for p in [0, 1, 2, 3]:
    c = cipher.encrypt(p)
    known_pairs.append((p, c))
    print(f"明文: {p}, 密文: {c}")

# 执行代数攻击
recovered_key = algebraic_attack(cipher, known_pairs)

print(f"\n真实密钥: {cipher.key}")
print(f"恢复的密钥: {recovered_key}")
print(f"攻击成功: {recovered_key == cipher.key}")

def impossible_differential_attack(cipher, num_pairs=1000):
    """简化的不可能差分攻击实现"""
    # 选择不可能差分特征
    # 这里假设我们有一个两轮的不可能差分：ΔP → ΔC 是不可能的
    input_diff = 0x0F  # 输入差分
    impossible_output_diff = 0x3C  # 不可能的输出差分
    
    # 收集明文-密文对
    valid_pairs = []
    for _ in range(num_pairs):
        p1 = np.random.randint(0, 2**cipher.block_size)
        p2 = p1 ^ input_diff
        
        c1 = cipher.encrypt(p1)
        c2 = cipher.encrypt(p2)
        
        # 只保留那些输出差分不是不可能差分的对
        if (c1 ^ c2) != impossible_output_diff:
            valid_pairs.append((p1, p2, c1, c2))
    
    print(f"收集到 {len(valid_pairs)} 个有效明文-密文对")
    
    # 初始化可能的密钥集合（假设最后一轮子密钥是8比特）
    possible_subkeys = set(range(256))
    
    # 对每个明文-密文对，排除不可能的子密钥
    for p1, p2, c1, c2 in valid_pairs:
        # 复制当前可能的子密钥集合
        current_possible = possible_subkeys.copy()
        
        # 对每个可能的子密钥进行验证
        for k in current_possible:
            # 尝试使用子密钥解密最后一轮
            # 这里我们简化处理，假设最后一轮只有轮密钥加
            state1 = c1 ^ k
            state2 = c2 ^ k
            
            # 计算解密后的状态差分
            state_diff = state1 ^ state2
            
            # 如果这个差分与不可能差分特征的中间状态匹配，则排除该子密钥
            # 这里简化处理，实际中需要更复杂的条件
            if state_diff == 0x1A:  # 假设的中间状态差分
                possible_subkeys.discard(k)
    
    return possible_subkeys

# 测试不可能差分攻击（这里需要一个更复杂的密码实现）
# 这里仅作为框架展示，实际攻击需要根据具体密码算法调整

def integral_attack(cipher, block_size=8, num_rounds=3):
    """简化的积分攻击实现"""
    # 创建积分结构：选择一个字节变化，其他字节固定
    integral_set = []
    fixed_value = 0xAA
    varying_byte_pos = 0  # 变化的字节位置
    
    # 生成积分集合（2^8个明文）
    for i in range(256):
        plaintext = fixed_value
        # 在指定位置设置变化的字节
        plaintext ^= (i << (varying_byte_pos * 8))
        integral_set.append(plaintext)
    
    # 加密整个积分集合
    ciphertexts = [cipher.encrypt(p) for p in integral_set]
    
    print(f"创建了包含 {len(ciphertexts)} 个密文的积分集合")
    
    # 猜测最后一轮部分子密钥
    # 这里假设最后一轮有一个8比特的子密钥
    possible_subkeys = []
    
    for k in range(256):
        # 对每个密文应用部分解密
        partial_decrypted = []
        for c in ciphertexts:
            # 简化处理：假设最后一步是轮密钥加
            partial = c ^ k
            partial_decrypted.append(partial)
        
        # 检查积分性质（例如：所有字节的异或和为零）
        xor_sum = 0
        for p in partial_decrypted:
            xor_sum ^= p
        
        # 如果异或和为零，可能是正确的子密钥
        if xor_sum == 0:
            possible_subkeys.append(k)
    
    return possible_subkeys

# 测试积分攻击（同样需要一个更复杂的密码实现）
# 这里仅作为框架展示，实际攻击需要根据具体密码算法调整

class RainbowTable:
    """简化的彩虹表实现"""
    
    def __init__(self, chain_length=1000, num_chains=10000):
        self.chain_length = chain_length
        self.num_chains = num_chains
        self.table = []
    
    def reduction_function(self, hash_value, index):
        """约简函数：将哈希值转换回明文空间"""
        # 简化版本：使用哈希值和链索引生成一个可能的密码
        # 实际中应该使用更复杂的约简函数族
        seed = int(hash_value, 16) ^ index
        # 生成一个6-8位的数字密码
        return f"{seed % 100000000:08d}"
    
    def create_chain(self, start_password):
        """创建一条彩虹链"""
        current = start_password
        
        for i in range(self.chain_length):
            # 哈希函数
            import hashlib
            h = hashlib.md5(current.encode()).hexdigest()
            
            if i < self.chain_length - 1:
                # 约简函数
                current = self.reduction_function(h, i)
            else:
                # 链的末端是最后一个哈希值
                return (start_password, h)
    
    def build_table(self):
        """构建彩虹表"""
        print(f"开始构建彩虹表，{self.num_chains}条链，每条链{self.chain_length}步...")
        
        for i in range(self.num_chains):
            # 生成起始密码
            start_password = f"{i:08d}"
            
            # 创建链
            chain = self.create_chain(start_password)
            self.table.append(chain)
            
            if (i + 1) % 1000 == 0:
                print(f"已构建 {i + 1} 条链")
        
        print("彩虹表构建完成")
    
    def crack_hash(self, target_hash):
        """使用彩虹表破解哈希值"""
        import hashlib
        
        print(f"开始破解哈希值: {target_hash}")
        
        # 尝试所有可能的约简函数索引
        for i in range(self.chain_length - 1, -1, -1):
            current_hash = target_hash
            
            # 从当前索引开始向上计算链
            for j in range(i, self.chain_length - 1):
                # 应用约简函数
                password = self.reduction_function(current_hash, j)
                # 应用哈希函数
                current_hash = hashlib.md5(password.encode()).hexdigest()
            
            # 查找链的末尾是否在彩虹表中
            for start_pass, end_hash in self.table:
                if end_hash == current_hash:
                    # 找到匹配的链，重新构建整个链
                    current = start_pass
                    
                    for j in range(self.chain_length):
                        # 检查当前哈希是否匹配目标
                        if hashlib.md5(current.encode()).hexdigest() == target_hash:
                            print(f"找到匹配的密码: {current}")
                            return current
                        
                        # 继续沿链前进
                        current = self.reduction_function(hashlib.md5(current.encode()).hexdigest(), j)
        
        print("未找到匹配的密码")
        return None

# 测试彩虹表攻击
# 注意：实际使用中，彩虹表需要大量的存储空间和预计算时间
# 这里仅作为简化示例
rainbow_table = RainbowTable(chain_length=100, num_chains=1000)

# 构建彩虹表（简化版，实际需要更长时间）
rainbow_table.build_table()

# 测试破解
import hashlib
test_password = "12345678"
test_hash = hashlib.md5(test_password.encode()).hexdigest()

print(f"\n测试哈希值: {test_hash}")
print(f"实际密码: {test_password}")

recovered_password = rainbow_table.crack_hash(test_hash)
print(f"恢复的密码: {recovered_password}")
print(f"攻击成功: {recovered_password == test_password}")

import time
import numpy as np
import matplotlib.pyplot as plt

class VulnerableRSA:
    """存在时序漏洞的RSA实现"""
    
    def __init__(self, n, d):
        self.n = n
        self.d = d  # 私钥指数
    
    def decrypt(self, c):
        """易受时序攻击的RSA解密实现"""
        # 二进制分解私钥指数
        bits = bin(self.d)[2:]
        result = 1
        
        # 从最高位到最低位处理
        for bit in bits:
            # 平方操作
            result = (result * result) % self.n
            
            # 如果当前位为1，则乘以底数
            if bit == '1':
                # 故意添加延迟，使1位和0位的执行时间不同
                time.sleep(0.001)
                result = (result * c) % self.n
        
        return result

def timing_attack(rsa, c, num_samples=1000):
    """针对RSA的时序攻击"""
    # 估计私钥长度
    d_bits = len(bin(rsa.d)[2:])
    print(f"估计私钥长度: {d_bits} 比特")
    
    # 恢复每一位私钥
    recovered_d = 0
    
    for i in range(d_bits):
        # 计算当前位的权重
        bit_value = 1 << (d_bits - 1 - i)
        
        # 对当前位进行多次测量
        times_with_bit = []
        
        for _ in range(num_samples):
            # 测量解密时间
            start_time = time.time()
            rsa.decrypt(c)
            end_time = time.time()
            
            times_with_bit.append(end_time - start_time)
        
        # 分析时间统计
        avg_time = np.mean(times_with_bit)
        median_time = np.median(times_with_bit)
        
        # 简化判断：如果平均时间超过某个阈值，则认为当前位为1
        # 实际中需要更复杂的统计分析
        if avg_time > 0.05:  # 假设的阈值
            recovered_d |= bit_value
            bit_result = 1
        else:
            bit_result = 0
        
        print(f"位 {i+1}: {bit_result}, 平均时间: {avg_time:.6f}s")
    
    return recovered_d

# 测试时序攻击（使用小参数仅用于演示）
# 实际攻击中需要更精确的测量和统计分析
p = 61
q = 53
n = p * q
phi = (p-1) * (q-1)
d = 17  # 私钥指数

rsa = VulnerableRSA(n, d)
c = 23  # 密文

print(f"公钥: n = {n}")
print(f"实际私钥: d = {d} ({bin(d)})")

# 执行时序攻击
recovered_d = timing_attack(rsa, c, num_samples=100)

print(f"\n恢复的私钥: d = {recovered_d} ({bin(recovered_d)})")
print(f"攻击成功: {recovered_d == d}")

# 可视化攻击结果
plt.figure(figsize=(10, 6))
plt.bar(['真实私钥', '恢复的私钥'], [d, recovered_d])
plt.title('RSA私钥恢复结果')
plt.xlabel('私钥')
plt.ylabel('值')
plt.show()

class CipherStrengthEvaluator:
    """密码算法强度评估器"""
    
    def __init__(self):
        # 评估标准权重
        self.weights = {
            'key_size': 0.3,
            'attack_complexity': 0.3,
            'implementation_robustness': 0.2,
            'standard_recognition': 0.1,
            'side_channel_resistance': 0.1
        }
    
    def evaluate_key_size(self, key_size, algorithm_type):
        """评估密钥长度"""
        # 根据算法类型和密钥长度评估
        if algorithm_type == 'symmetric':
            if key_size >= 256:
                return 1.0
            elif key_size >= 128:
                return 0.8
            elif key_size >= 64:
                return 0.5
            else:
                return 0.1
        elif algorithm_type == 'asymmetric':
            if key_size >= 4096:
                return 1.0
            elif key_size >= 2048:
                return 0.7
            elif key_size >= 1024:
                return 0.3
            else:
                return 0.1
        return 0.0
    
    def evaluate_attack_complexity(self, best_attack_complexity, key_size):
        """评估攻击复杂度"""
        # 计算理论上的暴力破解复杂度
        theoretical_complexity = 2 ** key_size
        
        # 计算相对安全性
        relative_security = best_attack_complexity / theoretical_complexity
        
        if relative_security >= 1.0:
            return 1.0
        elif relative_security >= 0.5:
            return 0.8
        elif relative_security >= 0.1:
            return 0.5
        else:
            return 0.2
    
    def evaluate_implementation(self, has_side_channels, has_timing_leaks, has_cache_leaks):
        """评估实现健壮性"""
        score = 1.0
        
        if has_side_channels:
            score -= 0.4
        if has_timing_leaks:
            score -= 0.3
        if has_cache_leaks:
            score -= 0.3
        
        return max(0.0, score)
    
    def evaluate_standard_recognition(self, is_standardized, standard_body=None):
        """评估标准认可度"""
        if not is_standardized:
            return 0.3
        
        # 根据标准机构的权威程度评分
        if standard_body in ['NIST', 'ISO/IEC']:
            return 1.0
        elif standard_body in ['IETF', 'ETSI']:
            return 0.8
        else:
            return 0.6
    
    def evaluate_side_channel_resistance(self, countermeasures):
        """评估侧信道防护能力"""
        # 基本分数
        score = 0.3
        
        # 根据采取的防护措施加分
        if 'constant_time' in countermeasures:
            score += 0.3
        if 'masking' in countermeasures:
            score += 0.2
        if 'shuffling' in countermeasures:
            score += 0.1
        if 'noise_injection' in countermeasures:
            score += 0.1
        
        return min(1.0, score)
    
    def calculate_overall_score(self, evaluations):
        """计算总体评分"""
        total_score = 0.0
        
        for category, score in evaluations.items():
            if category in self.weights:
                total_score += score * self.weights[category]
        
        return total_score
    
    def evaluate_cipher(self, cipher_info):
        """评估密码算法总体强度"""
        evaluations = {
            'key_size': self.evaluate_key_size(
                cipher_info['key_size'], 
                cipher_info['algorithm_type']
            ),
            'attack_complexity': self.evaluate_attack_complexity(
                cipher_info['best_attack_complexity'],
                cipher_info['key_size']
            ),
            'implementation_robustness': self.evaluate_implementation(
                cipher_info.get('has_side_channels', False),
                cipher_info.get('has_timing_leaks', False),
                cipher_info.get('has_cache_leaks', False)
            ),
            'standard_recognition': self.evaluate_standard_recognition(
                cipher_info.get('is_standardized', False),
                cipher_info.get('standard_body', None)
            ),
            'side_channel_resistance': self.evaluate_side_channel_resistance(
                cipher_info.get('countermeasures', [])
            )
        }
        
        overall_score = self.calculate_overall_score(evaluations)
        
        return {
            'category_scores': evaluations,
            'overall_score': overall_score,
            'recommendation': self.get_recommendation(overall_score)
        }
    
    def get_recommendation(self, score):
        """根据评分给出使用建议"""
        if score >= 0.9:
            return "高度安全，适合敏感数据保护"
        elif score >= 0.7:
            return "安全，适合大多数应用场景"
        elif score >= 0.5:
            return "中等安全，建议加强防护措施"
        elif score >= 0.3:
            return "安全性较低，仅适用于非敏感数据"
        else:
            return "不安全，不建议使用"

# 测试评估器
if __name__ == "__main__":
    evaluator = CipherStrengthEvaluator()
    
    # 评估AES-256
    aes_info = {
        'key_size': 256,
        'algorithm_type': 'symmetric',
        'best_attack_complexity': 2**254,  # 假设最佳攻击复杂度
        'has_side_channels': False,
        'has_timing_leaks': False,
        'has_cache_leaks': False,
        'is_standardized': True,
        'standard_body': 'NIST',
        'countermeasures': ['constant_time', 'masking']
    }
    
    aes_evaluation = evaluator.evaluate_cipher(aes_info)
    print("AES-256 评估结果:")
    print(f"总体评分: {aes_evaluation['overall_score']:.2f}")
    print(f"建议: {aes_evaluation['recommendation']}")
    print("各维度评分:")
    for category, score in aes_evaluation['category_scores'].items():
        print(f"  {category}: {score:.2f}")
    
    # 评估一个弱加密算法
    weak_info = {
        'key_size': 40,
        'algorithm_type': 'symmetric',
        'best_attack_complexity': 2**30,  # 有明显弱点
        'has_side_channels': True,
        'has_timing_leaks': True,
        'has_cache_leaks': True,
        'is_standardized': False,
        'countermeasures': []
    }
    
    weak_evaluation = evaluator.evaluate_cipher(weak_info)
    print("\n弱加密算法评估结果:")
    print(f"总体评分: {weak_evaluation['overall_score']:.2f}")
    print(f"建议: {weak_evaluation['recommendation']}")

class TimingResistantOperations:
    """抗时序攻击的密码学操作实现"""
    
    @staticmethod
    def constant_time_compare(a, b):
        """恒定时间比较操作"""
        if len(a) != len(b):
            return False
        
        result = 0
        for x, y in zip(a, b):
            # 逐字节比较，确保即使发现不匹配也继续比较所有字节
            result |= x ^ y
        
        return result == 0
    
    @staticmethod
    def constant_time_select(condition, if_true, if_false):
        """恒定时间选择操作"""
        # 将布尔条件转换为0或1的整数
        mask = 1 if condition else 0
        # 确保结果不依赖于条件的值
        return (if_true & mask) | (if_false & (1 - mask))
    
    @staticmethod
    def constant_time_xor(a, b):
        """恒定时间异或操作"""
        result = bytearray(len(a))
        for i in range(len(a)):
            result[i] = a[i] ^ b[i]
        return bytes(result)

# 测试抗时序攻击操作
if __name__ == "__main__":
    import time
    import numpy as np
    
    tr_ops = TimingResistantOperations()
    
    # 测试恒定时间比较
    print("测试恒定时间比较:")
    
    # 生成测试数据
    correct_hmac = bytes.fromhex('a1b2c3d4e5f6')
    wrong_hmacs = [
        bytes.fromhex('11b2c3d4e5f6'),  # 第一位不同
        bytes.fromhex('a112c3d4e5f6'),  # 第二位不同
        bytes.fromhex('a1b213d4e5f6'),  # 第三位不同
        bytes.fromhex('a1b2c314e5f6')   # 第四位不同
    ]
    
    # 测量比较时间
    times = []
    for wrong_hmac in wrong_hmacs:
        iterations = 1000
        start_time = time.time()
        for _ in range(iterations):
            tr_ops.constant_time_compare(correct_hmac, wrong_hmac)
        end_time = time.time()
        avg_time = (end_time - start_time) / iterations * 1e6  # 转换为微秒
        times.append(avg_time)
        print(f"不同位置的平均比较时间: {avg_time:.2f} μs")
    
    # 计算时间标准差
    std_dev = np.std(times)
    print(f"时间标准差: {std_dev:.2f} μs")
    print(f"变异系数: {std_dev / np.mean(times) * 100:.2f}%")
    
    # 与普通比较进行对比
    print("\n与普通比较的对比:")
    normal_times = []
    
    for wrong_hmac in wrong_hmacs:
        iterations = 1000
        start_time = time.time()
        for _ in range(iterations):
            correct_hmac == wrong_hmac
        end_time = time.time()
        avg_time = (end_time - start_time) / iterations * 1e6
        normal_times.append(avg_time)
        print(f"不同位置的平均比较时间: {avg_time:.2f} μs")
    
    normal_std_dev = np.std(normal_times)
    print(f"普通比较时间标准差: {normal_std_dev:.2f} μs")
    print(f"普通比较变异系数: {normal_std_dev / np.mean(normal_times) * 100:.2f}%")

class SecureMemoryManager:
    """安全内存管理"""
    
    @staticmethod
    def secure_allocate(size):
        """安全分配内存"""
        # 在实际应用中，应该使用平台特定的安全内存分配函数
        # 例如Windows的VirtualAlloc或Linux的mmap配合MAP_LOCKED
        import ctypes
        
        # 分配内存
        buffer = ctypes.create_string_buffer(size)
        
        # 锁定内存，防止交换到磁盘
        if hasattr(ctypes, 'pythonapi') and hasattr(ctypes.pythonapi, 'PyMem_RawMalloc'):
            try:
                # 尝试锁定内存
                # 注意：这在某些Python实现中可能不可用
                pass
            except:
                pass
        
        return buffer
    
    @staticmethod
    def secure_free(buffer):
        """安全释放内存"""
        # 先清零内存
        if buffer:
            for i in range(len(buffer)):
                buffer[i] = 0
        
        # 在Python中，内存最终由垃圾回收器释放
        # 在实际应用中，应该使用对应的安全释放函数
    
    @staticmethod
    def secure_erase(data):
        """安全擦除数据"""
        # 如果是可变数据类型，尝试直接修改内存
        if isinstance(data, (bytearray, list)):
            for i in range(len(data)):
                data[i] = 0
        
        # 对于不可变类型，无法直接修改，但可以创建一个新的零填充对象
        elif isinstance(data, bytes):
            # 创建一个零填充的新bytes对象
            return b'\x00' * len(data)
        
        return data

# 测试安全内存管理
if __name__ == "__main__":
    # 分配安全内存
    print("测试安全内存管理:")
    
    # 创建密钥
    key = b'0123456789abcdef'  # 16字节密钥
    print(f"原始密钥: {key.hex()}")
    
    # 安全擦除密钥
    mm = SecureMemoryManager()
    key = mm.secure_erase(key)
    print(f"擦除后密钥: {key.hex() if isinstance(key, bytes) else key}")
    
    # 测试可变数据类型
    mutable_key = bytearray(b'0123456789abcdef')
    print(f"\n原始可变密钥: {mutable_key.hex()}")
    mm.secure_erase(mutable_key)
    print(f"擦除后可变密钥: {mutable_key.hex()}")

import os
import sys
import subprocess
import platform

def setup_crypto_analysis_environment():
    """设置密码分析实验环境"""
    print("开始设置密码分析实验环境...")
    
    # 检查操作系统
    system = platform.system()
    print(f"当前操作系统: {system}")
    
    # 创建实验目录结构
    base_dir = os.path.join(os.getcwd(), "crypto_analysis_lab")
    if not os.path.exists(base_dir):
        os.makedirs(base_dir)
        print(f"创建基础目录: {base_dir}")
    
    # 创建子目录
    subdirs = ["data", "scripts", "results", "tools"]
    for subdir in subdirs:
        dir_path = os.path.join(base_dir, subdir)
        if not os.path.exists(dir_path):
            os.makedirs(dir_path)
            print(f"创建子目录: {dir_path}")
    
    # 检查Python版本
    print(f"Python版本: {platform.python_version()}")
    
    # 检查并安装必要的Python库
    required_libraries = [
        "numpy", "scipy", "matplotlib", "pycryptodome", 
        "scikit-learn", "pandas", "jupyter"
    ]
    
    print("\n检查Python库安装状态:")
    for lib in required_libraries:
        try:
            __import__(lib)
            print(f"✓ {lib} 已安装")
        except ImportError:
            print(f"✗ {lib} 未安装，正在安装...")
            try:
                subprocess.check_call([sys.executable, "-m", "pip", "install", lib])
                print(f"✓ {lib} 安装成功")
            except Exception as e:
                print(f"✗ {lib} 安装失败: {e}")
    
    # 创建示例配置文件
    config_content = '''
[experiment]
name = "密码分析实验"
description = "差分、线性和代数攻击实验"

[crypto_algorithms]
symmetric = ["AES", "DES", "3DES", "ChaCha20"]
asymmetric = ["RSA", "ECC", "DSA"]
hash = ["MD5", "SHA-1", "SHA-256", "SHA-3"]

[analysis_settings]
max_plaintexts = 1000000
max_key_size = 256
enable_profiling = true
log_level = "INFO"
'''
    
    config_path = os.path.join(base_dir, "config.ini")
    with open(config_path, "w") as f:
        f.write(config_content)
    print(f"\n创建配置文件: {config_path}")
    
    # 创建示例脚本
    example_script = '''
import numpy as np
import matplotlib.pyplot as plt
from Crypto.Cipher import AES

# 简化的差分密码分析示例
def simple_differential_analysis():
    print("执行简化的差分密码分析...")
    
    # 生成随机密钥
    key = os.urandom(16)  # AES-128密钥
    cipher = AES.new(key, AES.MODE_ECB)
    
    # 选择输入差分
    input_diff = bytes.fromhex('00000000000000000000000000000001')
    
    # 收集明文-密文对
    num_pairs = 1000
    plaintext_pairs = []
    ciphertext_pairs = []
    
    for _ in range(num_pairs):
        p1 = os.urandom(16)
        p2 = bytes([a ^ b for a, b in zip(p1, input_diff)])
        
        c1 = cipher.encrypt(p1)
        c2 = cipher.encrypt(p2)
        
        plaintext_pairs.append((p1, p2))
        ciphertext_pairs.append((c1, c2))
    
    # 分析差分分布
    # 注意：这只是一个简化示例，真实的AES差分分析要复杂得多
    print(f"收集了 {num_pairs} 对明文-密文对")
    print("差分分析完成")

if __name__ == "__main__":
    simple_differential_analysis()
'''
    
    script_path = os.path.join(base_dir, "scripts", "differential_example.py")
    with open(script_path, "w") as f:
        f.write(example_script)
    print(f"创建示例脚本: {script_path}")
    
    print("\n密码分析实验环境设置完成！")
    print(f"实验目录: {base_dir}")
    print("要开始实验，请导航到该目录并运行示例脚本。")

# 运行环境设置
if __name__ == "__main__":
    setup_crypto_analysis_environment()

from Crypto.Cipher import AES
import numpy as np

def inject_fault(state, position, bit=0):
    """在AES状态中注入故障
    
    Args:
        state: AES状态（16字节）
        position: 注入位置（0-15）
        bit: 要翻转的位（0-7）
    
    Returns:
        bytes: 故障状态
    """
    state_list = list(state)
    # 翻转指定位置的指定位
    state_list[position] ^= (1 << bit)
    return bytes(state_list)

class FaultyAES:
    """存在故障的AES实现"""
    
    def __init__(self, key):
        self.key = key
        self.cipher = AES.new(key, AES.MODE_ECB)
    
    def encrypt(self, plaintext, inject_fault_flag=False, fault_position=None):
        """加密函数，支持故障注入"""
        # 正常加密
        ciphertext = self.cipher.encrypt(plaintext)
        
        # 如果需要注入故障
        if inject_fault_flag and fault_position is not None:
            # 在最后一轮状态注入故障
            # 注意：这是一个简化模型，真实实现需要修改AES库
            # 这里我们模拟故障效果
            ciphertext = inject_fault(ciphertext, fault_position)
        
        return ciphertext

def aes_dfa_attack(plaintext, correct_ciphertext, faulty_ciphertexts, fault_positions):
    """AES差分故障分析攻击
    
    Args:
        plaintext: 明文（16字节）
        correct_ciphertext: 正确密文（16字节）
        faulty_ciphertexts: 故障密文列表
        fault_positions: 故障位置列表
    
    Returns:
        bytes: 恢复的最后一轮轮密钥
    """
    print("开始AES差分故障分析攻击...")
    
    # AES S盒
    sbox = [
        0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
        0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
        0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
        0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
        0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
        0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
        0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
        0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
        0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
        0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
        0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
        0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
        0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
        0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
        0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
        0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
    ]
    
    # 恢复最后一轮轮密钥
    last_round_key = bytearray(16)
    
    # 对每个故障进行分析
    for faulty_ciphertext, fault_pos in zip(faulty_ciphertexts, fault_positions):
        print(f"分析位置 {fault_pos} 的故障...")
        
        # 计算差分
        delta = bytes([a ^ b for a, b in zip(correct_ciphertext, faulty_ciphertext)])
        
        # 对于差分中只有一位非零的情况（单字节故障）
        non_zero_positions = [i for i, d in enumerate(delta) if d != 0]
        
        if len(non_zero_positions) == 1:
            pos = non_zero_positions[0]
            
            # 尝试所有可能的密钥字节值
            possible_keys = []
            
            for k_guess in range(256):
                # 计算解密后的中间值
                c_prime = correct_ciphertext[pos] ^ k_guess
                
                # 检查所有可能的故障值
                for fault_value in range(1, 256):  # 故障值不能为0
                    # 计算故障后的中间值
                    c_fault_prime = (correct_ciphertext[pos] ^ fault_value) ^ k_guess
                    
                    # 检查S盒差分约束
                    if sbox[c_prime] ^ sbox[c_fault_prime] == delta[pos]:
                        possible_keys.append(k_guess)
                        break
            
            # 统计可能的密钥值，找出出现次数最多的
            key_counts = {}
            for k in possible_keys:
                key_counts[k] = key_counts.get(k, 0) + 1
            
            if key_counts:
                # 选择出现次数最多的密钥字节
                best_key = max(key_counts.items(), key=lambda x: x[1])[0]
                last_round_key[pos] = best_key
                print(f"  位置 {pos} 的可能密钥: 0x{best_key:02x}")
    
    # 统计已恢复的密钥字节数
    recovered_bytes = sum(1 for b in last_round_key if b != 0)
    print(f"攻击完成，已恢复 {recovered_bytes}/16 字节的最后一轮轮密钥")
    
    return bytes(last_round_key)

# 测试AES差分故障分析
if __name__ == "__main__":
    # 生成随机密钥
    key = os.urandom(16)  # AES-128密钥
    faulty_aes = FaultyAES(key)
    
    # 生成随机明文
    plaintext = os.urandom(16)
    
    # 获取正确密文
    correct_ciphertext = faulty_aes.encrypt(plaintext)
    
    # 生成多个故障密文
    faulty_ciphertexts = []
    fault_positions = []
    
    # 在不同位置注入故障
    for pos in range(16):
        faulty_ciphertext = faulty_aes.encrypt(plaintext, inject_fault_flag=True, fault_position=pos)
        faulty_ciphertexts.append(faulty_ciphertext)
        fault_positions.append(pos)
    
    # 执行差分故障分析
    recovered_key = aes_dfa_attack(plaintext, correct_ciphertext, faulty_ciphertexts, fault_positions)
    
    # 注意：实际的AES密钥扩展还需要从最后一轮密钥推导出完整密钥
    # 这里我们只恢复了最后一轮轮密钥作为演示
    print(f"\n最后一轮轮密钥（恢复）: {recovered_key.hex()}")
    
    # 在实际应用中，我们需要实现AES密钥扩展的逆向过程
    # 来从最后一轮轮密钥恢复完整的加密密钥