Patent Application
20100202608
This application is based upon and claims the benefit of priority from Japanese Patent Application No. 2009-029022, filed Feb. 10, 2009, the entire contents of which are incorporated herein by reference.
1. Field
One embodiment of the invention relates to an encryption device, a decryption device, and a storage device, and more particularly, to an encryption device, a decryption device, and a storage device using an advanced encryption standard scheme.
2. Description of the Related Art
For example, an encryption process with respect to a plain text or a ciphertext of 128 bits is performed in the following manner.
E1: An extended key 1 of 128 bits is calculated from the encryption key of 256 bits.
E2: Data of 128 bits when a first round is completed is calculated from the plain text of 128 bits and the extended key 1 of 128 bits.
E3: An extended key 2 of 128 bits is calculated from the encryption key of 256 bits or the extended key 1 of 128 bits. The extended key 1 and the extended key 2 correspond to the encryption key.
E4: Data of 128 bits when a second round is completed is calculated from the data of 128 bits when the first round is completed and the extended key 2 of 128 bits.
E5: The same process as above is repeated until an N-th round is completed, and data of 128 bits when the N-th round is completed becomes a ciphertext.
For example, a decryption process with respect to the ciphertext of 128 bits is performed in the following manner.
D1: A decryption key of 256 bits, i.e., the extended key N of 128 bits and the extended key N−1 of 128 bits are calculated. The encryption keys N and N−1 correspond to the decryption key.
D2: Data of 128 bits when the (N−1)-th round is completed is calculated from the ciphertext of 128 bits and the extended key N of 128 bits.
D3: The extended key N−1 of 128 bits is calculated from the extended key N of 128 bits.
D4: Data of 128 bits when the (N−2)-th round is completed is calculated from the data of 128 bits when the (N−1)-th round is completed and the extended key (N−1) of 128 bits.
D5: The same process as above is repeated until the 0-th round is completed, and data of 128 bits when the 0-th round is completed becomes a plain text (decrypted text).
In the encryption process and the decryption process, initial values of the extended keys are different from each other. For this reason, when the key extension (so-called On-The-Fly key extension) is performed during the encryption process, the extended keys need to be initialized before the encryption process. Similarly, when the key extension is performed during the decryption process, the extended keys need to be initialized before the decryption process.
Meanwhile, since the process directions of the encryption and the decryption of the AES scheme are frequently switched, overhead at setting the initial values preferably does not exist each time a processor, such as a central processing unit (CPU), switches encryption and decryption. According to encryption modes (Cipher Modes of Operation), an encryption process is performed when an initialization vector used in the encryption or the decryption is generated. Therefore, the process direction may be continuously switched in such a manner as decryption, encryption, and decryption in a one-time start. Even in this case, overhead at setting the initial values preferably does not exist.
First, a CPU 10 sets an extended key 1 and an extended key 2 to a memory 11 and sets an extended key N−1 and an extended key N to a memory 12. A selector 13 selectively outputs the extended keys in the memory 11 or 12 to a selector 14 according to an encryption command or a decryption command. When the encryption process is performed, the selector 13 selectively outputs the extended key 1 and the extended key 2 (i.e., encryption key) to the selector 14 according to the encryption command from the CPU 10. When the decryption process is performed, the selector 13 selectively outputs the extended key N−1 and the extended key N (i.e., decryption key) to the selector 14 according to the decryption command from the CPU 10.
The selector 14 loads the encryption key as an initial value into a memory 15 according on the encryption command and a trigger signal instructing the loading of the initial value into the memory 15, and loads the decryption key as an initial value into the memory 15 according to the decryption command and the trigger signal. An encryption extension calculator 16 sequentially calculates the extended keys based on the encryption key in the memory 15, when the encryption process is performed. A decryption extension calculator 17 sequentially calculates the extended keys based on the decryption key in the memory 15, when the decryption process is performed. In the case other than when the initial value of the key is loaded into the memory 15, the selector 14 loads the extended keys calculated by the encryption extension calculator 16 into the memory 15 according to the encryption command, and loads the extended keys calculated by the decryption extension calculator 17 into the memory 15 according to the decryption command. Therefore, when the encryption process is performed, the encryption key is extended in the order of the extended keys 1 to N, and when the decryption process is performed, the decryption key is extended in the order of the extended keys N to 1. The selector 14, the memory 15, the encryption extension calculator 16, and the decryption extension calculator 17 form a key extension calculation circuit 18.
The engine (not illustrated) of the AES scheme performs the encryption process using the extended keys stored in the memory 15 with respect to the plain text according to the encryption command, and generates a ciphertext. The engine of the AES scheme performs the decryption process using the extended keys stored in the memory 15 with respect to the ciphertext according to the decryption command, and generates a plain text (decrypted text).
In the conventional encryption/decryption device, to decrease overhead at setting the initial value of the key, the CPU 10 sets the two keys of the encryption key and the decryption key prepared in advance to the memories 11 and 12, initializes a key schedule according to the encryption process or the decryption process of the data, and performs the encryption process or the decryption process. For this reason, the two memories 11 and 12 for the encryption key and the decryption key are needed with respect to one encryption key.
In a method in which the CPU 10 prepares the two keys of the encryption key and the decryption key in advance, when an encryption/decryption device performs an encryption process (or decryption process) of data with respect to a plurality of encryption keys using an engine of a single AES scheme, the CPU 10 needs to the prepare encryption keys and the decryption keys whose number is equal to the number of the encryption keys. For this reason, the CPU 10 may occupy relatively large memory capacities of the memories 11 and 12 to store the encryption keys and the decryption keys. When the encryption keys change, the encryption keys and the decryption keys need to change. Therefore, time may be needed to perform a setting process of the initial values of the encryption keys and the decryption keys, and overhead of the CPU 10 may increase. Reference may be had to, for example, Japanese Patent Application National Publication No. 2007-500376 and Japanese Patent Application Publication (KOKAI) No. 2005-4048.
In the conventional technology, it is difficult to decrease the memory capacity needed to store the encryption key and the decryption key and decrease the overhead of the processor of when the initial value of the encryption key or the decryption key is set.
A general architecture that implements the various features of the invention will now be described with reference to the drawings. The drawings and the associated descriptions are provided to illustrate embodiments of the invention and not to limit the scope of the invention.
Various embodiments according to the invention will be described hereinafter with reference to the accompanying drawings. In general, according to one embodiment of the invention, an encryption device sequentially uses N (N: a natural number not less than 2) extended keys obtained by extending one encryption key in data processing. The encryption device comprises a first memory, a comparison circuit, a second memory, a selector, and an encryption extension calculator. The first memory is configured to store a flag corresponding to an initial value of a key. The comparison circuit is configured to output a comparison result signal indicating a comparison result of matching when a command and the key indicated by the flag stored in the first memory are related to encryption, the command is an encryption command, and the flag indicates the encryption key. The selector is configured to load the key stored in the first memory as an initial value into the second memory, based on the encryption command and a trigger signal, upon receipt of the comparison result signal. The encryption extension calculator is configured to sequentially calculate the extended keys based on the key stored in the second memory and input the extended keys to the selector. Except when loading the initial value of the key into the second memory, the selector is configured to load the extended keys calculated by the encryption extension calculator into the second memory based on the encryption command to extend the encryption key to the extended keys from a first extended key to an N-th extended key.
According to another embodiment of the invention, a decryption device sequentially uses N (N: a natural number not less than 2) extended keys obtained by extending one decryption key in data processing. The decryption device comprises a first memory, a comparison circuit, a second memory, a selector, and a decryption extension calculator. The first memory is configured to store a flag corresponding to an initial value of a key. The comparison circuit is configured to output a comparison result signal indicating a comparison result of matching when a command and the key indicated by the flag stored in the first memory are related to decryption, the command is a decryption command, and the flag indicates the decryption key. The selector is configured to load the key stored in the first memory as an initial value into the second memory, based on the decryption command and a trigger signal, upon receipt of the comparison result signal. The decryption extension calculator is configured to sequentially calculate the extended keys based on the key stored in the second memory and input the extended keys to the selector. Except when loading the initial value of the key into the second memory, the selector is configured to load the extended keys calculated by the decryption extension calculator into the second memory based on the decryption command to extend the decryption key to the extended keys from an N-th extended key to a first extended key.
According to still another embodiment of the invention, a storage device comprises a controller and an encryption and decryption device. The controller is configured to control recording of data on the storage device and reproducing of data from the storage device. The encryption and decryption device is configured to sequentially use N (N: a natural number not less than 2) extended keys obtained by extending one encryption key in data processing, encrypt the data to be recorded on the storage device, and decrypt the data reproduced from the storage device. The encryption and decryption device comprises a first memory, a comparison circuit, a second memory, a selector, an encryption extension calculator, and a decryption extension calculator. The first memory is configured to store a flag corresponding to an initial value of a key. The comparison circuit is configured to output a comparison result signal indicating a comparison result of matching when a command and the key indicated by the flag stored in the first memory are related to encryption, the command is an encryption command, and the flag indicates the encryption key, or when the command and the key are related to decryption, the command is a decryption command, and the flag indicates a decryption key. The selector is configured to load the key stored in the first memory as an initial value into the second memory, based on the command and a trigger signal, upon receipt of the comparison result signal. The encryption extension calculator is configured to sequentially calculate the extended keys based on the key stored in the second memory and input the extended keys to the selector. The decryption extension calculator is configured to sequentially calculate the extended keys based on the key stored in the second memory and input the extended keys to the selector. Except when loading the initial value of the key into the second memory, the selector is configured to load the extended keys calculated by the encryption extension calculator into the second memory based on the encryption command to extend the encryption key to the extended keys from a first extended key to an N-th extended key, and load the extended keys calculated by the decryption extension calculator into the second memory based on the decryption command to extend the decryption key to the extended keys from the N-th extended key to the first extended key.
According to still another embodiment of the invention, an encryption and decryption device sequentially uses N (N: a natural number not less than 2) extended keys obtained by extending one encryption key in data processing. The encryption and decryption device comprises a first memory, a comparison circuit, a second memory, a selector, an encryption extension calculator, and a decryption extension calculator. The first memory is configured to store a flag corresponding to an initial value of a key. The comparison circuit is configured to output a comparison result signal indicating a comparison result of matching when a command and the key indicated by the flag stored in the first memory are related to encryption, the command is an encryption command, and the flag indicates the encryption key, or when the command and the key are related to decryption, the command is a decryption command, and the flag indicates a decryption key. The selector is configured to load the key stored in the first memory as an initial value into the second memory, based on the command and a trigger signal, upon receipt of the comparison result signal. The encryption extension calculator is configured to sequentially calculate the extended keys based on the key stored in the second memory and input the extended keys to the selector. The decryption extension calculator is configured to sequentially calculate the extended keys based on the key stored in the second memory and input the extended keys to the selector. Except when loading the initial value of the key into the second memory, the selector is configured to load the extended keys calculated by the encryption extension calculator into the second memory based on the encryption command to extend the encryption key to the extended keys from a first extended key to an N-th extended key, and load the extended keys calculated by the decryption extension calculator into the second memory based on the decryption command to extend the decryption key to the extended keys from the N-th extended key to the first extended key.
First, a CPU 20 sets an initial value of an encryption key corresponding to an extended key 1 and an extended key 2 to a memory 21, and sets a 1-bit flag indicating that the extended key 1 and the extended key 2 set to the memory 21 are the encryption key to a memory 22. Alternatively, the CPU 20 sets an initial value of a decryption key corresponding to an extended key N−1 and an extended key N to the memory 21, and sets a 1-bit flag indicating that the extended key N−1 and the extended key N set to the memory 21 are the decryption key to the memory 22. The memory 21 may have a memory capacity that can store an initial value of a key schedule. The memory 22 may have a memory capacity that can store the 1-bit flag. The memory 21 stores the initial value of the key schedule set by the CPU 20 or the initial value of the key schedule finally used by the engine of the AES scheme, and the memory 22 stores a flag indicating a state of the memory 21 (indicating which of the initial value of the encryption key and the initial value of the decryption key is stored in the memory 21).
The encryption process starts in response to an encryption command issued by the CPU 20. The decryption process starts in response to a decryption command issued by the CPU 20. The encryption command or the decryption command issued by the CPU 20 is supplied to a control circuit 100.
The control circuit 100 comprises a command memory 101, a process block number counter 102, an internal command generation circuit 103, a key extension round counter 104, and a trigger signal generation circuit 29.
The command memory 101 stores the command issued by the CPU 20 to recognize whether the command issued by the CPU 20 is the encryption command or the decryption command. The process block number counter 102 increments a count, each time an encryption process or a decryption process of data of 128 bits is completed based on the command issued by the CPU 20, and counts a process block from 0 to M (M: a natural number not less than 2). If a count value reaches M, the count value is initialized to 0. When the count value of the process block number counter 102 is in a range of 1 to M−1, the internal command generation circuit 103 executes the command stored in the command memory 101. When the count value of the process block number counter 102 is M, the internal command generation circuit 103 generates a 1-bit internal command that executes a command opposite to the command stored in the command memory 101.
The key extension round counter 104 counts a round of the extended keys 1 to N (i.e., first to N-th extended keys). When the count value of the process block number counter 102 is in a range of 0 to M−1, the trigger signal generation circuit 29 generates a trigger signal in response to an output of a comparison circuit 23, for every N rounds of the extended keys counted by the key extension round counter 104, i.e., every decryption process of data of 128 bits, and outputs the trigger signal to a selector 24 in a key extension calculation circuit 28 to be described in detail below. Meanwhile, when the count value of the process block number counter 102 is M, the trigger signal generated by the trigger signal generation circuit 29 is masked and is not output to the selector 24.
When the encryption process is performed, if a 1-bit encryption command obtained through the command memory 101 from the CPU 20 and the key indicated by the flag stored in the memory 22 are related to the encryption, the comparison circuit 23 outputs a 1-bit comparison result signal indicating that the compared bits match each other to the selector 24. When the decryption process is performed, if a 1-bit decryption command obtained through the command memory 101 from the CPU 20 and the key indicated by the flag stored in the memory 22 are related to the decryption, the comparison circuit 23 outputs a comparison result signal indicating that the compared bits match each other to the selector 24.
When the encryption process is performed, if the selector 24 receives the comparison result signal indicating matching, the selector 24 loads the encryption key stored in the memory 21 as the initial value into a memory 25 according to the encryption command and the 1-bit trigger signal instructing the loading of the initial value into the memory 25, and contents stored in the memories 21 and 22 do not change. The trigger signal is output from the trigger signal generation circuit 29 in response to the output of the comparison circuit 23, as described above. When the encryption process is performed, an encryption extension calculator 26 sequentially calculates the extended keys 1 to N (i.e., first to N-th extended keys) based on the encryption key in the memory 25. In the case other than when the initial value of the key is loaded into the memory 25, the selector 24 loads the extended keys calculated by the encryption extension calculator 26 into the memory 25 according to the encryption command. Therefore, when the encryption process is performed, the encryption key is extended in the order of the extended keys 1 to N.
When the decryption process is performed, if the selector 24 receives the comparison result signal indicating matching, the selector 24 loads the decryption key as the initial value into the memory 25 according to the decryption command and the trigger signal, and contents stored in the memories 21 and 22 do not change. When the decryption process is performed, a decryption extension calculator 27 sequentially calculates the extended keys N to 1 (i.e., N-th to first extended keys) based on the decryption key in the memory 25. In the case other than when the initial value of the key is loaded into the memory 25, the selector 24 loads the extended keys calculated by the decryption extension calculator 27 into the memory 25 according to the decryption command. Therefore, when the decryption process is performed, the decryption key is extended in the order of the extended keys N to 1.
The selector 24, the memory 25, the encryption extension calculator 26, and the decryption extension calculator 27 form the key extension calculation circuit 28.
In the conventional device illustrated in
If one of the command issued from the CPU 20 and the key indicated by the flag stored in the memory 22 is related to the encryption and the other is related to the decryption, the comparison circuit 23 outputs a comparison result signal indicating that the compared bits mismatch each other to the selector 24.
When the selector 24 receives the comparison result signal indicating mismatching, if the command issued from the CPU 20 is the encryption command, the selector 24 loads the decryption key stored in the memory 21 as the initial value into the memory 25 in response to the trigger signal. The decryption extension calculator 27 sequentially calculates the extended keys based on the decryption key in the memory 25, and the decryption key is extended in the order of the extended keys N to 1 and the encryption key is obtained. The obtained encryption key is set from the memory 25 to the memory 21, and the flag indicating that the key set to the memory 21 is the encryption key is set from the CPU 20 to the memory 22. As a result, the contents of the memories 21 and 22 are updated with the contents for the encryption process.
When the selector 24 receives the comparison result signal indicating that the compared bits mismatch each other, if the command issued from the CPU 20 is the decryption command, the selector 24 loads the encryption key stored in the memory 21 as the initial value into the memory 25 in response to the trigger signal. The encryption extension calculator 26 sequentially calculates the extended keys based on the encryption key in the memory 25, and the encryption key is extended in the order of the extended keys 1 to N and the decryption key is obtained. The obtained decryption key is set from the memory 25 to the memory 21, and the flag indicating that the key set to the memory 21 is the decryption key is set from the CPU 20 to the memory 22. As a result, the contents of the memories 21 and 22 are updated with the contents for the decryption process.
That is, if the comparison result obtained by the comparison circuit 23 indicates mismatching, the initial value of the key stored in the memory 22 is set to the memory 25, the initial value of the key in the memory 25 obtained by extending the key in the encryption extension calculator 26 or the decryption extension calculator 27 is set to the memory 22, and the flag corresponding to the initial value of the key set to the memory 22 is set to the memory 22. In this way, the contents of the memory 22 are updated. Thus, the update of the flag of the memory 22 does not need to be set by the CPU 20, and can be automatically set by the 1-bit command obtained through the command memory 101 at update timing of the initial value of the key of the memory 21.
As described above, in the embodiment, if one of the command issued from the CPU 20 and the key indicted by the flag stored in the memory 22 is related to the encryption and the other is related to the decryption, the key extension needs to be performed once in the encryption extension calculator 26 or the decryption extension calculator 27 to set the initial value of the key. However, the key extension that needs to be performed even when the key length is 256 bits can be completed with 14 cycles. Since an operation speed of each of the encryption extension calculator 26 and the decryption extension calculator 27 having the known configuration is faster than that of the CPU 20, the key extension needed to set the initial value of the key does not become the overhead of the CPU 20. Accordingly, the overhead of the CPU 20 does not become larger than that in the conventional device by the key extension to needed to set the initial value of the key.
The engine (not illustrated) of the AES scheme performs an encryption process using the extended keys stored in the memory 25 with respect to the plain text according to the encryption command, and generates a ciphertext. The engine of the AES scheme performs a decryption process using the extended keys stored in the memory 25 with respect to the ciphertext according to the decryption command, and generates a plain text (decrypted text).
When the decryption process is performed immediately after the encryption process is performed, if the N-th extended key stored in the memory 25 and used in the encryption process is used as the initial value of the subsequently used decryption key, the overhead of the decryption process can be reduced. Similarly, when the encryption process is performed immediately after the decryption process is performed, if the N-th extended key stored in the memory 25 and used in the decryption process is used as the initial value of the subsequently used decryption key, the overhead of the encryption process can be reduced.
The memories 21 and 22 do not need to be separated memories, and may be configured as a single memory having different memory areas. The initial value of the encryption key or the decryption key and the flag may be processed as one data. The CPU 20 may be allowed to have access to the memory 21 and handle the encryption key or the decryption key as the bit length of the encryption key+1 bit (flag). In this case, the CPU 20 and the key extension calculation circuit 28 can use the encryption key or the decryption key (encryption extended key+1 bit or decryption extended key+1 bit) as a key used as the encryption key and the decryption key. In particular, in the encryption/decryption device that uses the plural encryption keys, when an encryption process and a decryption process are performed using an engine of a single AES scheme, the stored key may be the encryption key or the decryption key. Therefore, the memory capacity needed to set the initial value of the key can be reduced as compared with that of the conventional technology. The key length of the set initial value of the key may be the encryption key+1 bit or the decryption key+1 bit. Therefore, the overhead to set the initial value of the key can be reduced as compared with the conventional technology.
The memory 33 corresponds to the memories 21 and 22 illustrated in
In the embodiment, the storage device that is used when the data is recorded and reproduced is formed of the disk device having the head 36 and the disk 37. However, the storage device is not limited to the device using the head, and a semiconductor storage device, such as a flash memory, may be used when the data is recorded and reproduced. Even when the semiconductor storage device is used in recording and reproducing of data, the data is recorded on the storage device and is reproduced from the storage device, under the control of the CPU 20 that functions as the controller.
In the example of
Meanwhile, when the bits of the command issued from the CPU 20 and the flag stored in the memory 33 mismatch each other, the key extension block 34 loads the key stored in the memory 33 as the initial value into the memory 25 according to the command issued from the CPU 20 and the trigger signal from the trigger signal generation circuit 29. When the key stored in the memory 33 is the decryption key, the decryption extension calculator 27 sequentially calculates the extended keys N to 1 based on the decryption key. When the key is the encryption key, the encryption extension calculator 26 sequentially calculates the extended keys 1 to N based on the encryption key. Thereby, the obtained encryption key or decryption key is set from the memory 25 to the memory 33, the flag corresponding to the key set to the memory 33 is set, and the contents of the memory 33 are updated.
The AES engine 35 performs the encryption process illustrated in
When the storage device 30 is the HDD, a continuous process of data of several megabits (Mbit) is performed using the same key in the encryption process and the decryption process. This continuous process is realized by repetitively executing the encryption process and the decryption process, as described above.
Next, a generation sequence of the extended keys according to the embodiment will be described with reference to
In the CPU 20, the flag corresponding to the encryption key or the decryption key is set to the memory 33 (S1). Thereby, in the key extension block 34, the flag corresponding to the encryption key or the decryption key is stored in the memory 33 (S11). The CPU 20 issues an encryption command and starts an encryption process or issues a decryption command and starts a decryption process (S2). The key extension block 34 compares the command issued by the CPU 20 and the flag in the memory 33 (S12). The key extension block 34 determines whether the command and the flag match as the comparison result (S13). When they match (YES at S13), the process proceeds to S14. When they do not match (NO at S13), the process proceeds to S16.
The key extension block 34 generates a trigger signal by the trigger signal generation circuit 29, and stores the key in the memory 33 in the memory 25 in response to the trigger signal. The key extension block 34 performs encryption extension calculation of data of 128 bits by the encryption extension calculator 26 when the command issued from the CPU 20 is the encryption command, and performs decryption extension calculation of data of 128 bits by the decryption extension calculator 27 when the command is the decryption command (S14). At this time, the AES engine 35 performs encryption or decryption of data using each extended key and calculates data when a corresponding round is completed. The key extension block 34 determines whether the encryption or decryption process is continuously performed N times (S15). If not (NO at S15), the process returns to 14. When the encryption or decryption process is continuously performed N times (YES at S15), the process ends.
Meanwhile, When the command and the flag do not match (NO at S13), the key extension block 34 generates a trigger signal by the trigger signal generation circuit 29, and stores the key in the memory 33 in the memory 25 in response to the trigger signal. The key extension block 34 performs decryption extension calculation of data of 128 bits by the decryption extension calculator 27 when the command issued from the CPU 20 is the encryption command, and performs encryption extension calculation of data of 128 bits by the encryption extension calculator 26 when the command is the decryption command (S16). At S16, the calculated encryption key or decryption key is stored in the memory 33, and the flag corresponding to the encryption key or the decryption key in the memory 33 is stored in the memory 33. At this time, the AES engine 35 does not perform encryption or decryption of data using each extended key.
Meanwhile, a sequence that is used when the encryption process is performed once immediately after the decryption process may be used in block cipher modes of operation. For example, a cipher block chain (CBC) mode, a method that uses a result obtained by encrypting a nonce word by the same key as an initialization vector is recommended. The initialization vector is an initial value used in first data processing when the CBC mode starts. In the case of a process of data of 128 bits, an initial value is also 128 bits. When the recommended method is applied to the storage device where an encryption process or a decryption process is performed in a sector unit of the HDD and continuous sector write or continuous sector read is performed and the decryption is performed, a series of processes for encrypting a nonce word of 128 bits after decrypting data of 128 bits of a tail of the sector, generating the initialization vector, and decrypting data of 128 bits of a head of a next sector needs to be continuously performed without using the CPU. Meanwhile, when the encryption is performed, the encryption of the initialization vector and the encryption of the sector are performed. Therefore, the AES always performs the encryption. The description of the encryption is omitted herein.
Next, a sequence of when a process of L sectors is performed without using the CPU 20 in the case where a process of one sector is performed by the one-time encryption process of the nonce word and the decryption processes to be continuously performed M times will be described with reference to
In
As described above, when the count value of the process block number counter 102 that counts the process block number is in a range of 0 to M−1, the internal command executes the decryption command set by the CPU 20. When the count value is M, the internal command executes the encryption command. The process block number counter 102 increments a count each time the encryption process or the decryption process of data of 128 bits is completed. When the count value reaches M, the count value of the process block number counter 102 is initialized to 0. When the count value of the process block number counter 102 is in a range of 0 to M−1, the trigger signal generated by the trigger signal generation circuit 29 is output in response to the output of the comparison circuit 23 for every N rounds of the key extension counted by the key extension round counter 104, i.e., the decryption process of data of 128 bits. When the count value of the process block number counter 102 is M, the trigger signal generated by the trigger signal generation circuit 29 is masked and is not output.
The AES engine 35 determines whether the decryption is performed M times (S24). If not (NO at S24), the process returns to S23. When the decryption is performed M times (YES at S24), the AES engine 35 determines whether the process until the L sector is completed (S25). If not NO at S25), the process returns to S22. When the process until the L sector is completed (YES at S25), the process ends.
Next, the block cipher modes of operation will be described with reference to
In general, when data of at least 128 bits is encrypted by the same encryption key, a method that is called the block cipher modes of operation is used. As an example of a preferable mode, a mode that is called a CBC mode is used. In the CBC mode, the process of one sector is performed according to the sequence illustrated in
As a recommended generation method of an initialization vector, a method that encrypts the nonce word by the encryption key and uses the nonce word as the initialization vector is exemplified. In this case, the process of one sector in the CBC mode is performed according to the sequence illustrated in
While certain embodiments of the inventions have been described, these embodiments have been presented by way of example only, and are not intended to limit the scope of the inventions. Indeed, the novel methods and systems described herein may be embodied in a variety of other forms; furthermore, various omissions, substitutions and changes in the form of the methods and systems described herein may be made without departing from the spirit of the inventions. The accompanying claims and their equivalents are intended to cover such forms or modifications as would fall within the scope and spirit of the inventions.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2009-029022 | Feb 2009 | JP | national |
