Patent Application
20140355755
This application claims the benefit of Korean Patent Application No. 10-2013-0060863 filed on May 29, 2013, which is hereby incorporated by reference in its entirety into this application.
1. Technical Field
The present invention relates generally to an apparatus and method for performing a compression operation in a hash algorithm and, more particularly, to an apparatus and method for performing a compression operation in a fast message hash algorithm, which receive a 512-bit message and 512-bit chaining variable data, repeatedly calculate a 128-bit register-based step function, and then produce updated 512-bit chaining variable data which is a basis for the hash value.
2. Description of the Related Art
The provision of integrity of messages is the principal function of a cryptographic application for performing communication between various types of devices and storing the data of the devices. A hash function is a function for guaranteeing the integrity of messages, which is widely used in the signature, authentication, etc. of messages. Generally, in a hash function, chaining variable data is used, and is updated in such a way that a message is divided into units of a specific length and individual message units are input, together with the chaining variable data, to a compression function. Final chaining variable data output from the compression function is processed by various algorithms and then becomes a hash value for the corresponding message.
In relation to this, Korean Patent No. 10-0916805 entitled “Hash algorithm having 256-bit output” presents a hash algorithm technique for calculating a chaining variable by receiving a message bit stream having a predetermined length, converting the bit stream into a word stream, converting an input message into preset bits, and performing a compression operation.
In order to improve the speed efficiency of such a hash function, there is a need to design a compression function which is a core algorithm of the hash function so that the compression function can be optimally implemented for a chip or a Central Processing Unit (CPU) specified for a cryptographic application.
Accordingly, the present invention has been made keeping in mind the above problems occurring in the prior art, and an object of the present invention is to provide a technique for calculating a 128-bit register-based compression function that is applied to a hash function enabling fast message hashing while having a 512-bit output value and guaranteeing security against an existing attack.
In accordance with an aspect of the present invention to accomplish the above object, there is provided an apparatus for performing a compression operation in a hash algorithm, including a message extension unit for receiving a message and generating a plurality of extended messages; a chaining variable initial conversion unit for receiving chaining variable data and converting the chaining variable data into initial state data; a step function operation unit for repeatedly calculating a step function based on the initial state data and the plurality of extended messages and then producing final state data; and a chaining variable final conversion unit for generating updated chaining variable data from the chaining variable data using the final state data, and outputting the updated chaining variable data.
Preferably, the message extension unit may receive a 512-bit message (M=M[0]∥M[1]∥ . . . ∥M[14]∥M[15]) configured by connecting 16, 32-bit sub-messages (M[0], M[1], . . . , M[14], and M[15]), and generate 32, 384-bit extended messages (Wr=Wr[0]∥Wr[1]∥ . . . ∥Wr[10]∥Wr[11]), each being configured by connecting 12, 32-bit sub-extended messages (Wr[0], Wr[1], . . . , Wr[10], and Wr[11]) based on equation (Wr[i]=M[(12r+i) mod 16], 0≦i≦11), where r is an integer satisfying 0≦r≦31, and x mod 16 denotes an operation of outputting a remainder of division when x is divided by 16.
Preferably, the chaining variable initial conversion unit may receive 512-bit chaining variable data (CV=CV[0]∥CV[1]∥ . . . ∥CV[14]∥CV[15]) configured by connecting 16 pieces of 32-bit sub-chaining variable data CV[0], CV[1], . . . , CV[14], and CV[15]), and convert the 512-bit chaining variable data into 512-bit initial state data (X0=X0[0]∥X0[1]∥ . . . ∥X0[14]∥X0[15]) configured by connecting 16 pieces of 32-bit initial sub-state data (X0[0], X0[1], . . . , X0[14], and X0[15]) based on equation (X0[i]=CV[i], 0≦i≦15).
Preferably, the step function operation unit may produce the final state data by repeatedly calculating the step function calculating the following equations Tr[i]=Xr[i]⊕Wr[i], 0≦i≦11; Xr+1[i]=ROL9(Tr[i]Tr[i+4]),0≦i≦3; Xr+1[i]=ROL27(Tr[i]
Tr[i+4]),4≦i≦7; Xr+1[i]=ROL29(Tr[i]
Xr[i+4]),8≦i≦11; and Xr+1[i]=Tr[i−12], 12≦i≦15, based on the 512-bit initial state data (X0=X0[0]∥X0[1]∥ . . . ∥X0[14]∥X0[15]) and the 32, 384-bit extended messages (Wr=Wr[0]∥Wr[1]∥ . . . ∥Wr[10]∥Wr[11]). In this case, x⊕y denotes an exclusive OR operation on x and y which respectively have 32-bit values, x
y denotes an operation of outputting a remainder of division when a sum of values representing the 32-bit x and y by positive integers, respectively, is divided by 232, in 32 bits, and ROLa(x) denotes an operation of cyclically shifting the 32-bit x to left by ‘a’ bits and outputting a shifted value.
Preferably, the step function operation unit may repeatedly calculate the step function, for r, 32 times from 0 to 31 rounds and produce 512-bit final state data (X32=X32[0]∥X32[1]∥ . . . ∥X32[14]∥X32[15]) configured by connecting 16 pieces of 32-bit final sub-state data (X32[0], X32[1], . . . , X32[14], and X32 [15]).
Preferably, the chaining variable final conversion unit may update the 512-bit chaining variable data (CV=CV[0]∥CV[1]∥ . . . ∥CV[14]∥CV[15]) based on equation (CV′[i]=CV[i]⊕X32[i], 0≦i≦15), and output the updated 512-bit chaining variable data (CV′=CV′[0]∥CV′[1]∥ . . . ∥CV′[14]∥CV′[15]).
In accordance with another aspect of the present invention to accomplish the above object, there is provided a method of performing a compression operation in a hash algorithm, including receiving a message and generating a plurality of extended messages; receiving chaining variable data and converting the chaining variable data into initial state data; repeatedly calculating a step function based on the initial state data and the plurality of extended messages, and then producing final state data; and generating updated chaining variable data from the chaining variable data using the final state data, and outputting the updated chaining variable data.
Preferably, generating the plurality of extended messages may be configured to receive a 512-bit message (M=M[0]∥M[1]∥ . . . ∥M[14]M[15]) configured by connecting 16, 32-bit sub-messages (M[0], M[1], . . . , M[14], and M[15]), and generate 32, 384-bit extended messages (Wr=Wr[0]∥Wr[1]∥ . . . ∥Wr[10]∥Wr[11]), each being configured by connecting 12, 32-bit sub-extended messages (Wr[0], Wr[1], . . . , Wr[10], and Wr[11]), based on equation (Wr[i]=M[(12r+i) mod 16], 0≦i≦11), where r is an integer satisfying 0≦r≦31, and x mod 16 denotes an operation of outputting a remainder of division when x is divided by 16.
Preferably, receiving the chaining variable data and converting the chaining variable data into the initial state data may be configured to receive 512-bit chaining variable data (CV=CV[0]∥CV[1]∥ . . . ∥CV[14]∥CV[15]) configured by connecting 16 pieces of 32-bit sub-chaining variable data CV[0], CV[1], . . . , CV[14], CV[15]), and convert the 512-bit chaining variable data into 512-bit initial state data (X0=X0[0]∥X0[1]∥ . . . ∥X0[14]∥X0[15]) configured by connecting 16 pieces of 32-bit initial sub-state data (X0[0], X0[1], . . . , X0[14], and X0[15]) based on equation (X0[i]=CV[i], 0≦i≦15).
Preferably, repeatedly calculating the step function and producing the final state data may be configured to produce the final state data by repeatedly calculating the step function calculating the following equations Tr[i]=Xr[i]⊕Wr[i], 0≦i≦11; Xr+1[i]=ROL9(Tr[i]Tr[i+4]),0≦i≦3; Xr+1[i]=ROL27(Tr[i]
Tr[i+4]),4≦i≦7; Xr+1[i]=ROL29(Tr[i]
Xr[i+4]),8≦i≦11; and Xr+1[i]=Tr[i−12], 12≦i≦15, based on the 512-bit initial state data (X0=X0[0]∥X0[1]∥ . . . ∥X0[14]∥X0[15]) and the 32, 384-bit extended messages (Wr=Wr[0]∥Wr[1]∥ . . . ∥Wr[10]∥Wr[11]). In this case, x⊕y denotes an exclusive OR operation on x and y which respectively have 32-bit values, x
y denotes an operation of outputting a remainder of division when a sum of values representing the 32-bit x and y by positive integers, respectively, is divided by 232, in 32 bits, and ROLa(x) denotes an operation of cyclically shifting the 32-bit x to left by ‘a’ bits and outputting a shifted value.
Preferably, repeatedly calculating the step function and producing the final state data may be configured to repeatedly calculate the step function, for r, 32 times from 0 to 31 rounds and produce 512-bit final state data (X32=X32[0]∥X32 [1]∥ . . . ∥X32 [14]∥X32 [15]) configured by connecting 16 pieces of 32-bit final sub-state data (X32[0], X32[1], . . . , X32 [14], and X32[15]).
Preferably, generating and outputting the updated chaining variable data from the chaining variable data may be configured to update the 512-bit chaining variable data (CV=CV[0]∥CV[1]∥ . . . ∥CV[14]∥CV[15]) based on equation (CV′[i]=CV[i]⊕X32[i], 0≦i≦15), and output the updated 512-bit chaining variable data (CV′=CV′[0]∥CV′[1]∥ . . . ∥CV′[14]∥CV′[15]).
The above and other objects, features and advantages of the present invention will be more clearly understood from the following detailed description taken in conjunction with the accompanying drawings, in which:
The present invention will be described in detail below with reference to the accompanying drawings. In the following description, redundant descriptions and detailed descriptions of known functions and elements that may unnecessarily make the gist of the present invention obscure will be omitted. Embodiments of the present invention are provided to fully describe the present invention to those having ordinary knowledge in the art to which the present invention pertains. Accordingly, in the drawings, the shapes and sizes of elements may be exaggerated for the sake of clearer description.
Hereinafter, the configuration and operation of an apparatus for performing a compression operation in a hash algorithm according to the present invention will be described in detail with reference to
Referring to
The message extension unit 100 receives the message M having 512 bits from a user through an interface (not shown) separately provided in the compression operation performance apparatus 10, and generates 32 extended messages W0, W1, . . . , W30, and W31 (Wr, 0≦r≦31), each having 384 bits, from the message M. In this case, the 512-bit message M input to the message extension unit 100 is configured by connecting 16 sub-messages M[0], M[1], . . . , M[14], and M[15], each having 32 bits, as represented by the following Equation (1):
M=M[0]∥M[1]∥ . . . ∥M[14]∥M[15] (1)
The message extension unit 100 generates extended messages Wr(0≦r≦31), each having 384 bits, which are configured by connecting 12 sub-extended messages Wr[0], Wr[1], . . . , Wr[10], and Wr[11], each having 32 bits, as represented by the following Equation (2) from the input 512-bit message M=M[0]∥M[1]∥ . . . ∥M[14]∥M[15].
W
r
=W
r[0]∥Wr[1]∥ . . . ∥Wr[10]∥Wr[11],0≦r≦31 (2)
In this case, the message extension unit 100 generates a total of 32, 384-bit extended messages W0, W1, . . . , W30, and W31 (Wr=Wr[0]∥Wr[1]∥ . . . ∥Wr[10]∥Wr[11], 0≦r≦31) from the 512-bit message M=M[0]∥M[1]∥ . . . ∥M[14]∥M[15] based on the following Equation (3):
W
r
[i]=M[(12r+i)mod 16],0≦i≦11 (3)
where (12r+1) mod 16 denotes an operation of outputting the remainder of division when (12r+1) is divided by 16. Meanwhile, the message extension unit 100 outputs the 32, 384-bit extended messages W0, W1, . . . , W30, and W31 (Wr=Wr[0]∥Wr[1]∥ . . . ∥Wr[10]∥Wr[11], 0≦r≦31) generated from the input 512-bit message M=M[0]∥M[1]∥ . . . ∥M[14]∥M[15] to the step function operation unit 300.
The chaining variable initial conversion unit 200 receives chaining variable data CV having 512 bits from an interface separately provided in the compression operation performance apparatus 10 or a chaining variable generation means (not shown) located outside of the apparatus, and converts the chaining variable data into initial state data X0 having 512 bits. In this case, the 512-bit chaining variable data CV that is input to the chaining variable initial conversion unit 200 is configured by connecting 16 pieces of sub-chaining variable data CV[0], CV[1], . . . , CV[14], and CV[15], each having 32 bits, as represented by the following Equation (4):
CV=CV[0]∥CV[1]∥ . . . ∥CV[14]∥CV[15] (4)
The chaining variable initial conversion unit 200 converts the input 512-bit chaining variable data CV=CV[0]∥CV[1]∥ . . . ∥CV[14]∥CV[15] into initial state data X0 having 512 bits, configured by connecting 16 pieces of initial sub-state data X0[0], X0[1], . . . , X0[14], and X0[15], each having 32 bits, as represented by the following Equation (5):
X
0
=X
0[0]∥X0[1]∥ . . . X0[14]∥X0[15] (5)
In this case, the chaining variable initial conversion unit 200 converts the 512-bit chaining variable data CV=CV[0]∥CV[1]λ . . . CV[14]∥CV[15] into 512-bit initial state data X0=X0[0]∥X0[1]∥ . . . ∥X0[14]∥X0[15] based on the following Equation (6):
X
0
[i]=CV[i],0≦i≦15 (6)
The chaining variable initial conversion unit 200 outputs the 512-bit initial state data X0=X0[0]∥X0[1]∥ . . . ∥X0[14]∥X0[15] converted from the input 512-bit chaining variable data CV=CV[0]∥CV[1]∥ . . . ∥CV[14]∥CV[15] to the step function operation unit 300.
The step function operation unit 300 repeatedly calculates the step function on which operations in the following Equations (7) to (11) are performed by setting the 512-bit initial state data X0=X0[0]∥X0[1]∥ . . . ∥X0[14]∥X0[15] received from the chaining variable initial conversion unit 200 to an initial value and by utilizing the 32, 384-bit extended messages W0, W1, . . . , W30, and W31 (Wr=Wr[0]∥Wr[1]∥ . . . ∥Wr[10]∥Wr[11], 0≦r≦31) received from the message extension unit 100, and thus produces the final state data.
T
r
[i]=X
r
[i]⊕W
r
[i],0≦i≦11 (7)
X
r+1
[i]=ROL
9(Tr[i]Tr[i+4]),0≦i≦3 (8)
X
r+1
[i]=ROL
27(Tr[i]Tr[i+4]),4≦i≦7 (9)
X
r+1
[i]=ROL
29(Tr[i]Xr[i+4]),8≦i≦11 (10)
X
r+1
[i]=T
r
[i−12],12≦i≦15 (11)
In this case, x⊕y denotes an Exclusive OR (XOR) operation on x and y which have 32-bit values, xy denotes an operation of outputting the remainder of division when the sum of values representing the 32-bit x and y by positive integers, respectively, is divided by 232, in 32 bits, and ROLa(x) denotes an operation of cyclically shifting the 32-bit variable x to the left by ‘a’ bits and outputting a shifted value. In this case, the step function operation unit 300 may first perform an operation based on Equation (7) in the step function in an n(1≦n≦32)-th round and may subsequently perform operations based on Equations (8) to (11) in parallel. The step function operation unit 300 repeatedly calculates the step function, shown in Equations (7) to (11), 32 times, and connects resulting values X32[0]X32[1], . . . , X32[14], and X32[15] obtained by calculating the step function in a 32-th round, as given by the following Equation (12), and thus produces the final state data X32. The step function operation unit 300 outputs the final state data X32 produced by repeatedly calculating the step function to the chaining variable final conversion unit 400.
X
32
=X
32[0]∥X32[1]∥ . . . ∥X32[14]∥X32[15] (12)
Meanwhile, an operation performed by the step function operation unit 300 to produce pieces, of sub-state data Xr+1[0], Xr+1[1], . . . , Xr+1[14], and Xr+1[15] by calculating the step function in an (r+1)-th round using both the pieces of sub-state data Xr[0], Xr[1], . . . , Xr[14], and Xr[15] and the sub-extended messages Wr[0], Wr[1], . . . , Wr[10], and Wr[11] as input values may be illustrated in
The chaining variable final conversion unit 400 updates the chaining variable data CV=CV[0]∥CV[1]∥ . . . ∥CV[14]∥CV[15] input to the chaining variable initial conversion unit 200 using the final state data X32=X32[0]∥X32[1]∥ . . . ∥X32[14]∥X32[15] received from the step function operation unit 300, and outputs the updated chaining variable data CV′=CV′[0]∥CV′[1]∥ . . . ∥CV′[14]∥CV′[15]. In this case, the chaining variable final conversion unit 400 generates the chaining variable data CV′=CV′[0]∥CV′[1]∥ . . . ∥CV′[14]∥CV′[15] by updating the 512-bit chaining variable data CV=CV[0]∥CV[1]∥ . . . ∥CV[14]∥CV[15], based on the following Equation (13).
CV′[i]=CV[i]⊕X
32
[i],0≦i≦15 (13)
The updated 512-bit chaining variable data CV′=CV′[0]∥CV′[1]∥ . . . ∥CV′[14]∥CV′[15] output from the chaining variable final conversion unit 400 is processed using various types of known algorithms and is used as a hash value for the 512-bit message M=M[0]∥M[1]∥ . . . ∥M[14]∥M[15] that is input to the message extension unit 100.
Hereinafter, a compression operation performance method performed by the apparatus for performing the compression operation in the hash algorithm according to the present invention will be described in detail with reference to
Referring to
Next, the message extension unit 100 generates 32, 384-bit extended messages W0, W1, . . . , W30, and W31 (Wr=Wr[0]∥Wr[1]∥ . . . ∥Wr[10]∥Wr[11], 0≦r≦31), each being configured by connecting 12, 32-bit sub-extended messages Wr[0], Wr[1], . . . , Wr[10], and Wr[11], from the 512-bit message M=M[0]∥M[1]∥ . . . ∥M[14]∥M[15] that is configured by connecting 16, 32-bit sub-messages M[0], M[1], . . . , M[14], and M[15], based on Equation (3) at step S200. In this case, the message extension unit 100 outputs the generated 32, 384-bit extended messages of Wr (0≦r≦31) to the step function operation unit 300.
Meanwhile, the chaining variable initial conversion unit 200 receives 512-bit chaining variable data CV=CV[0]∥CV[1]∥ . . . ∥CV[14]∥CV[15] configured by connecting 16 pieces of 32-bit sub-chaining variable data CV[0], CV[1], . . . , CV[14], and CV[15] from the user interface or an external chaining variable generation means, and converts the 512-bit chaining variable data CV=CV[0]∥CV[1]∥ . . . ∥CV[14]∥CV[15] into 512-bit initial state data X0=X0[0]∥X0[1]∥ . . . X0[14]∥X0[15] configured by connecting 16 pieces of 32-bit initial sub-state data X0[0], X0[1], . . . , X0[14], and X0[15] based on Equation (6) at step S300. In this case, the chaining variable initial conversion unit 200 outputs the converted 512-bit initial state data X0=X0[0]∥X0[1]∥ . . . ∥X0[15] to the step function operation unit 300.
Next, the step function operation unit 300 repeatedly calculates the step function represented by Equations (7) to (11) based on the 32, 384-bit extended messages Wr (0≦r≦31) received from the message extension unit 100 and the 512-bit initial state data X0=X0[0]∥X0[1]∥ . . . ∥X0[14]∥X0[15] received from the chaining variable initial conversion unit 200 at step S400. In this case, the step function operation unit 300 sets 16 pieces of 32-bit initial sub-state data X0[0], X0[1], . . . , X0[14], and X0[15] to the input value of a step function in a first round, applies 12, 32-bit sub-extended messages Wr[0], Wr[1], . . . , Wr[10], and Wr[11] to the step function upon calculating the step function in an (r+1)-th round, and then repeatedly calculates the step function 32 times.
Further, the step function operation unit 300 produces 512-bit final state data X32=X32[0]∥X32[1]∥ . . . ∥X32[14]∥X32[15] by connecting the results of the finally calculated step function (that is, the results of the step function calculated in a 32nd round; X32[0], X32[1], . . . , X32[14], and X32[15]) at step S500. In this case, the step function operation unit 300 outputs the produced 512-bit final state data X32=X32[0]∥X32[1]∥ . . . ∥X32[14]∥X32[15] to, the chaining variable final conversion unit 400.
Finally, the chaining variable final conversion unit 400 updates the 512-bit chaining variable data CV=CV[0]∥CV[1]∥ . . . ∥CV[14]∥CV[15] that is input to the chaining variable initial conversion unit 200 by using the 512-bit final state data X32=X32[0]∥X32[1]∥ . . . ∥X32[14]∥X32[15] received from the step function operation unit 300, and outputs the updated 512-bit chaining variable data at step S600. In this case, the chaining variable final conversion unit 400 updates the 512-bit chaining variable data CV=CV[0]∥CV[1]∥ . . . ∥CV[14]∥CV[15] that is input to the chaining variable initial conversion unit 200 based on Equation (13), and generates and outputs the updated 512-bit chaining variable data CV′=CV′[0]∥CV′[1]∥ . . . ∥CV′[14]∥CV′[15] at step S600.
Referring to
Next, the step function operation unit 300 sets the value of r to 0, sets the pieces of initial-sub state data X0[0], X0[1], . . . , X0[14], and X0[15] to input values, and starts to calculate the step function in a first round at step S420.
Further, upon calculating the step function in an (r+1)-th round, the step function operation unit 300 first calculates Tr[i] based on Equation (7) (Tr[i]=Xr[i]⊕Wr[i], 0≦i≦11) at step S430, and calculates resulting values Xr+1[0], Xr+1[1], . . . , Xr+1[14], and Xr+1[15](Xr+1[i], 0≦i≦15) based on Equation (8) (Xr+1[i]=ROL9(Tr[i]Tr[i+4]),0≦i≦3), Equation (9) Xr+1[i]=ROL27(Tr[i]
Tr[i+4]),4≦i≦7), Equation (10) (Xr+1[i]=ROL29(Tr[i]
Xr[i+4]),8≦i≦11), and Equation (11) (Xr+1[i]=Tr[i−12], 12≦i≦15) at step S440.
Based on steps S430 and S440, the step function in the (r+1)-th round is calculated, and then it is determined whether the value of r is 31 at step S450.
If it is determined at step S450 that the value of r is not 31 (that is, if the value of r is less than 31), the step function operation unit 300 increases the value of r by 1 at step S460, and repeatedly calculates the step function at steps S430 and S440.
In contrast, if it is determined at step S450 that the value of r is 31, the resulting values X32[0], X32[1], . . . , X32[14], and X32[15] output at the calculation of the step function in a 32-th round are connected, and then 512-bit final state data X32=X32[0]∥X32[1]∥ . . . ∥X32[14]X32[15] is output at step S470.
In accordance with the present invention, there is an advantage in that a simple message extension algorithm is provided and in that a compression operation algorithm is provided in which only bit addition, bit cyclic shift (rotation), and bit Exclusive OR (XOR) operators which are generally used in most CPUs are combined, so that high-speed parallel processing using a 128-bit register is possible, thus enabling the CPUs to perform compression operations using a low computational load.
Meanwhile, the method of performing a compression operation in a hash algorithm according to the present invention may be implemented in the form of program instructions that are executable by various types of computer means, and may be recorded in a computer-readable storage medium. The computer-readable storage medium may include program instructions, data files, and data structures either alone or in combination. The program instructions stored in the medium may be designed and configured especially for the present invention or may be known to and usable by those skilled in the art of computer software. Examples of the computer-readable storage medium may include a magnetic medium such as a hard disk, a floppy disk, or magnetic tape, an optical medium such as Compact Disk-Read Only Memory (CD-ROM) or a Digital Versatile Disk (DVD), a magneto-optical medium such as a floptical disk, and a hardware device such as ROM, Random Access Memory (RAM), or flash memory which is especially configured to store and execute program instructions. Examples of the program instructions include not only such machine language code as created by a compiler, but also such high-level language code as being executable by a computer using an interpreter or the like.
As described above, optimal embodiments of the present invention have been disclosed in the drawings and the specification. Although specific terms have been used in the present specification, these are merely intended to describe the present invention and are not intended to limit the meanings thereof or the scope of the present invention described in the accompanying claims. Therefore, those skilled in the art will appreciate that various modifications and other equivalent embodiments are possible from the embodiments. Therefore, the technical scope of the present invention should be defined by the technical spirit of the claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 10-2013-0060863 | May 2013 | KR | national |
