The present disclosure belongs to the field of information encryption technology and relates to a linear converter, in particular to a linear converter, block encryption/decryption circuits, and a chip.
Block encryption and decryption techniques, widely adopted as means of data protection in the field of cryptography, play a crucial role in areas such as digital communication, data storage, and computer security. They involve dividing the data to be encrypted into fixed-size data blocks, followed by independently encrypting and decrypting each data block, thereby providing reliable protection for the confidentiality of the data. In the embodiment of block encryption and decryption technology, performing linear transformation process on data blocks are indispensable steps. However, in current existing technologies, the operation pipeline for linear transformations is relatively lengthy, leading to significant delays in the process of block encryption or decryption.
The present disclosure provides a linear converter, block encryption/decryption circuits, and a chip for reducing delay in a block encryption or decryption process.
A first aspect of the present disclosure provides the linear converter, wherein the linear converter is configured to multiply a data block in the block encryption and/or decryption circuits with a constant coefficient matrix in the Galois Field for one time to obtain a linear transformation result, and elements in the constant coefficient matrix are obtained according to transformation coefficients of a basic transformation.
In one embodiment of the first aspect, the linear converter comprises n Exclusive-OR (XOR) combinational logic circuits, each of the XOR combinational logic circuits is configured to perform operations (including XOR operations) on corresponding data bits in the data block in stage to obtain 1 byte of data in the linear transformation result, wherein n is a positive integer, and n is determined by the quantity of data bits comprised in the data block.
In one embodiment of the first aspect, the XOR combinational logic circuits comprise multiple XOR gates, and the quantity of XOR gates and their corresponding data bits are determined by corresponding elements in the constant coefficient matrix.
In one embodiment of the first aspect, the XOR combinational logic circuits comprise multiple stages of XOR combinational logic units, each stage of the XOR combinational logic units comprises at least one XOR gate.
In one embodiment of the first aspect, multiple XOR gates in XOR combinational logic units of the same stage perform XOR operation of the input data bits in a parallel manner.
In one embodiment of the first aspect, the n XOR combinational logic circuits obtain n data bits of the linear transformation result in parallel.
In one embodiment of the first aspect, the length of the data block is 128 bits.
In one embodiment of the first aspect, the constant coefficient matrix is determined by: determining a transformation matrix C based on R(a)=(l(aƒ−1, aƒ−2, . . . , a0)∥aƒ−1∥. . . ∥a1) and the transformation coefficients of the basic transformation l, in stage to get R(a)=[aƒ−1, aƒ−2, . . . , a0]⊗C, wherein R represents the linear transformation, l represents the basic transformation, a represents the data block, ai represents the i-th byte of the data block a, and ƒ represents the quantity of bytes of the data block a; determining the constant coefficient matrix based on the transformation matrix C and a quantity of rounds nr for which R is to be transformed.
In one embodiment of the first aspect, the constant coefficient matrix is equivalent to the transformation matrix C raised to the power of nr.
A second aspect of the present disclosure provides a block encryption circuit comprising: a round function module, configured to perform multiple rounds of operation on plaintext data to obtain encrypted intermediate data; and a key imposition module, configured to process the encrypted intermediate data using a key to obtain a ciphertext; wherein, the round function module comprises a key imposition unit, a non-linear substitution unit, and the linear converter as previously described in any one of the embodiments of the first aspect.
A third aspect of the present disclosure provides a block decryption circuit comprising: an inverse round function module, configured to perform multiple rounds of operation on ciphertext data to obtain decrypted intermediate data; and a key imposition module, configured to process the decrypted intermediate data using a key to obtain plaintext; wherein, the inverse round function module comprises a key imposition unit, a non-linear substitution unit, and an inverse linear transformation unit, wherein the inverse linear transformation unit comprises the linear converter as previously described in any one of the embodiments of the first aspect.
A fourth aspect of the present disclosure provides a chip comprising: the linear converter as previously described in any one of the embodiments of the first aspect, the block encryption circuit as previously described in any one of the embodiments of the second aspect, or the block decryption circuit as previously described in any one of the embodiments of the third aspect.
As previously described, embodiments of the present disclosure provide the linear converter, the block encryption and/or decryption circuits, and the chip. The linear converter has the following advantages:
(1) The presently disclosed linear converter multiplies the data block in the block encryption and/or decryption circuits with the constant coefficient matrix in the Galois Field for one time to obtain the linear transformation result. This method can effectively shorten the length of the linear transformation process, which is conducive to reducing the delay of the block encryption or decryption process.
(2) The presently disclosed linear converter can be implemented using n Exclusive-OR (XOR) combinational logic circuits, wherein the n XOR combinational logic circuits obtain n data bits of the linear transformation result in parallel. In addition, the n XOR combinational logic circuits may be implemented by using the multiple stages of XOR combinational logic units. When the XOR combinational logic circuits contain multiple XOR gates, these XOR gates can perform XOR operation of the input data bits in a parallel manner. In the above manner, the delay of the combinational logic can be effectively reduced, thereby further reducing the delay of the block encryption or decryption process.
(3) The presently disclosed linear converter performs the linear transformations independently of substitution tables, thus eliminating the need for additional resources to calculate and store substitution tables, which is advantageous for reducing resource overhead.
(4) The presently disclosed linear converter also has the advantages of small hardware size and low cost.
The embodiments of the present disclosure will be described below. Those skilled can easily understand disclosure advantages and effects of the present disclosure according to contents disclosed by the specification. The present disclosure can also be implemented or applied through other different specific embodiments. Various details in this specification can also be modified or changed based on different viewpoints and disclosures without departing from the spirit of the present disclosure. It should be noted that the following embodiments and the features of the following embodiments can be combinational with each other if no conflict will result.
It should be noted that the drawings provided in this disclosure only illustrate the basic concept of the present disclosure in a schematic way, so the drawings only show the components closely related to the present disclosure. The drawings are not necessarily drawn according to the number, shape and size of the components in actual embodiment; during the actual embodiment, the type, quantity and proportion of each component can be changed as needed, and the layout of the components can also be more complicated.
There are many standards for block encryption and decryption technology, such as Advanced Encryption Standard (AES), Data Encryption Standard (DES), GOST R 34.12, etc. The following will introduce block encryption and decryption techniques using GOST R 34.12 as an example.
GOST R 34.12 uses a Substitution-Permutation Network (SPN) structure, which includes substitution layers, permutation layers, and round-key addition. In each round of encryption processes, the data is first mapped by eight substitution boxes through the substitution layer. The substitution boxes are configured to map 8-bit input data to another 8-bit data for the purpose of obfuscation. Subsequently, the data passes through the permutation layer, and the data bits at different locations are rearranged by a permutation operation. After the permutation operation is completed, a round key is introduced, and the key of each round is generated by a key scheduling algorithm to ensure that the encryption operation in each round is affected by different keys.
The linear transformation is one of the key steps in GOST R 34.12. It introduces elements of linear operation by performing bitwise XOR operation on the output of the substitution layer and the round key, effectively obfuscating the data bits. Through the linear transformation, the ability of the algorithm to resist attacks such as differential and linear cryptanalysis can be improved. The entire encryption process is implemented through multiple iterations, each of which comprises substitutions, permutations, and the linear transformations.
In the circuit shown in
R(a)=(l(a15, . . . , a0)∥a15∥a14. . . a2∥a1) as shown in
As shown in
In other technical solutions, the linear transformation in GOST R 34.12 can be achieved by the Borodin method/pre-computation tables. Specifically, these technical solutions decompose the linear transformation into a collection of operations that can be independently executed, which then calculate sixteen substitution tables B0˜B15 comprising 256 values in total. The linear transformation can be achieved quickly by aggregating these values. However, the embodiment of such technical solutions relies on sixteen substitution tables, and calculating and storing these substitution tables requires a large amount of resources, resulting in higher implementation costs for these technical solutions.
In light of the above problems, embodiments of the present disclosure provide a linear converter applied to block encryption and/or decryption circuits. For example, the linear converter of the present disclosure can be applied to the circuit shown in
Next, the principle of the embodiments of the present disclosure will be introduced. As mentioned earlier, the expression for the R transformation is as follows: R(a)=(l(a15, . . . , a0)∥a15∥a14. . . a2∥a1)
l(a15, . . . , a0)=q0⊗(a15)+q1⊗(a14)+q2⊗(a13)+q3⊗(a12)+q4⊗(a11)+q5⊗(a10)+q6⊗(a9)+q7⊗(a8)+q8⊗(a7)+q9⊗(a6)+q10⊗(a5)+q11⊗(a4)+q12⊗(a3)+q13⊗(a2)+q14⊗(a1)+q15⊗(a0),
i.e.,
Specifically, l is basic transformation, q0, q1, . . . , q15 are the transformation coefficients and ⊗ is the multiplication symbol of the Galois Field.
By substituting the above l(a15, . . . , a0) into R(a)=(l(a15, . . . , a0)∥a15∥a14. . . a2∥a1), we have:
wherein, {right arrow over (a)} represents a vector formed by the various bytes of input data block a. This embodiment of the present disclosure is illustrated using an input data block a containing 16 bytes, where {right arrow over (a)} represents a vector formed by the 16 bytes (a15, a14, . . . , a0) of the input data block a. C represents a matrix formed according to the transformation coefficients.
R2(a) is another round of transformation applied to the result of R(a), i.e.: R2(a)=R(R(a))=({right arrow over (a)}⊗C)⊗C={right arrow over (a)}⊗C2.
Similarly, it can be concluded that L(a)=R16(a)={right arrow over (a)}⊗C16.
From this, it can be observed that in this embodiment of the application, the transformation result is obtained by multiplying vector {right arrow over (a)} with C16.
As shown in
In some embodiments, the quantity of XOR gates included in the XOR combinational logic circuit and their input data bits are determined by corresponding elements in the constant coefficient matrix.
In some embodiments, the XOR combinational logic circuit includes multiple stages of XOR combinational logic units. Each stage of the XOR combinational logic units includes one or more XOR gates.
In some embodiments, the XOR combinational logic units include multiple stages of XOR gates, and multiple XOR gates in XOR combinational logic unit of the same stage may perform XOR operations on the input data bits in a parallel manner.
For example,
In some embodiments, the n XOR combinational logic circuits obtain n data bits of the linear transformation result in parallel. Taking the linear converter shown in
In some embodiments, the constant coefficient matrix is determined by: determining a transformation matrix c based on R(a)=(l(aƒ−1, aƒ−2, . . . , a0)∥aƒ−1∥. . . ∥a1) and transformation coefficients of a basic transformation l, to get R(a)=[aƒ−1, aƒ−2, . . . , a0]⊗C, wherein R represents a linear transformation, l represents the basic transformation, a represents the data block, ai represents the i -th byte of the data block a, and ƒ represents the quantity of bytes of the data block a, determining the constant coefficient matrix based on the transformation matrix C and the quantity of rounds nr for which R is to be transformed.
Specifically, the constant coefficient matrix is equivalent to the transformation matrix C raised to the power of nr. For example, when sixteen rounds of transformation are required, the constant coefficient matrix is C16.
The linear converter provided by the embodiment of the present disclosure and its principle will be described in detail by a specific embodiment. It should be noted that this example does not restrict the scope of this disclosure. In this embodiment, the sixteen transformation coefficients q0, q1, . . . q15 of the basic transformation l can be [148, 32, 133, 16, 194, 192, 1, 251, 1, 192, 194, 16, 133, 32, 148, 1]T. The present disclosure is not limited to this, those skilled in the art can understand that in practice, different transformation coefficients can be selected according to actual needs. The basic transformation l is shown as:
l(a15, . . . , a0)=148⊗(a15)+32⊗(a14)+133⊗(a13)+16⊗(a12)+194⊗(a11)+192⊗(a10)+1⊗(a9)+251⊗(a8)+1⊗(a7)+192⊗(a6)+194⊗(a5)+16⊗(a4)+133⊗(a3)+32⊗(a2)+148⊗(a1)+1⊗(a0)
In the above equation, addition and multiplication operations are performed in the GF(28) Field, where ⊗ represents the symbol for multiplication in the Galois Field.
Based on the basic transformation l, it can be seen that
L(a)=R16(a)={right arrow over (a)}⊗C16
The constant coefficient matrix C16 is:
Based on the above constant coefficient matrix, the expression for each byte in the linear transformation result can be obtained as follows:
c15=a15⊗207+a14⊗152+a13⊗116+a12⊗191+a11⊗147+a10⊗142+a9⊗242+a8⊗243+a7⊗10+a6⊗191+a5⊗246+a4⊗169+a3⊗234+a2⊗142+a1⊗77+a0⊗110
c14=a15⊗110+a14⊗32+a13⊗198+a12⊗218+a11⊗144+a10⊗72+a9⊗137+a8⊗156+a7⊗193+a6⊗100+a5⊗184+a4⊗45+a3⊗134+a2⊗68+a1⊗208+a0⊗162
c13=a15⊗162+a14⊗200+a13⊗135+a12⊗112+a11⊗104+a10⊗67+a9⊗28+a8⊗43+a7⊗161+a6⊗99+a5⊗48+a4⊗107+a3⊗159+a2⊗48+a1⊗227+a0⊗118
c12=a15⊗118+a14⊗51+a13⊗16+a12⊗12+a11⊗28+a10⊗17+a9⊗214+a8⊗106+a7⊗166+a6⊗215+a5⊗246+a4⊗73+a3⊗7+a2⊗20+a1⊗232+a0⊗114
c11=a15⊗114+a14⊗242+a13⊗107+a12⊗202+a11⊗32+a10⊗235+a9⊗2+a8⊗164+a7⊗141+a6⊗212+a5⊗196+a4⊗1+a3⊗101+a2⊗221+a1⊗76+a0⊗108
c10=a15⊗108+a14⊗118+a13⊗236+a12⊗12+a11⊗197+a10⊗188+a9⊗175+a8⊗110+a7⊗163+a6⊗225+a5⊗144+a4⊗88+a3⊗14+a2⊗2+a1⊗195+a0⊗72
c9=a15⊗72+a14⊗213+a13⊗98+a12⊗23+a11⊗6+a10⊗45+a9⊗196+a8⊗231+a7⊗213+a6⊗235+a5⊗153+a4⊗120+a3⊗82+a2⊗245+a1⊗22+a0⊗122
c8=a15⊗122+a14⊗230+a13⊗78+a12⊗26+a11⊗187+a10⊗46+a9⊗241+a8⊗190+a7⊗212+a6⊗175+a5⊗55+a4⊗177+a3⊗212+a2⊗42+a1⊗110+a0⊗184
c7=a15⊗184+a14⊗73+a13⊗135+a12⊗20+a11⊗203+a10⊗141+a9⊗171+a8⊗73+a7⊗9+a6⊗108+a5⊗42+a4⊗1+a3⊗96+a2⊗142+a1⊗75+a0⊗93
c6=a15⊗93+a14⊗212+a13⊗184+a12⊗47+a11⊗141+a10⊗18+a9⊗238+a8⊗246+a7⊗8+a6⊗84+a5⊗15+a4⊗243+a3⊗152+a2⊗200+a1⊗127+a0⊗39
c5=a15⊗39+a14⊗159+a13⊗190+a12⊗104+a11⊗26+a10⊗124+a9⊗173+a8⊗201+a7⊗132+a6⊗47+a5⊗235+a4⊗254+a3⊗198+a2⊗72+a1⊗162+a0⊗189
c4=a15⊗189+a14⊗149+a13⊗94+a12⊗48+a11⊗233+a10⊗96+a9⊗191+a8⊗16+a7⊗239+a6⊗57+a5⊗236+a4⊗145+a3⊗127+a2⊗72+a1⊗137+a0⊗16
c3=a15⊗6+a14⊗233+a13⊗208+a12⊗217+a11⊗243+a10⊗148+a9⊗61+a8⊗175+a7⊗123+a6⊗255+a5⊗100+a4⊗145+a3⊗82+a2⊗248+a1⊗13+a0⊗221
c2=a15⊗221+a14⊗153+a13⊗117+a12⊗202+a11⊗151+a10⊗68+a9⊗90+a8⊗224+a7⊗48+a6⊗166+a5⊗49+a4⊗211+a3⊗223+a2⊗72+a1⊗100+a0⊗132
c1=a15⊗132+a14⊗45+a13⊗116+a12⊗150+a11⊗93+a10⊗119+a9⊗111+a8⊗222+a7⊗84+a6⊗180+a5⊗141+a4⊗209+a3⊗68+a2⊗60+a1⊗165+a0⊗148
c0=a15⊗148+a14⊗32+a13⊗133+a12⊗16+a11⊗194+a10⊗192+a9⊗1+a8⊗251+a7⊗1+a6⊗192+a5⊗194+a4⊗16+a3⊗133+a2⊗32+a1⊗148+a0⊗1
In the above expressions, ci represents the i-th byte in the linear transformation result, which contains eight data bits. For each ci, eight XOR combinational logic circuits can be configured to obtain eight data bits in the ci, the quantity of XOR gates contained in each XOR combinational logic circuit and the input data bits are determined by the ci expression. In this embodiment, 128 XOR combinational logic circuits can be configured to obtain a total of 128 data bits in c0 to C15 in a parallel manner to obtain the linear transformation result.
For example, c15 contains eight data bits, respectively c15[0], c15[1], . . . , c15[7], of which the 8th data bit c15[7] is the 128th data bit in the linear transformation result. According to the expression of c15, the XOR combinational logic circuit A128 for acquiring c15[7] contains 71 XOR gates, the 71 XOR gates are configured to perform the following XOR operation to obtain c15[7]:
The above mentioned XOR combinational logic circuit A128 can be implemented using the multiple stages of XOR combinational logic units.
For example, the first-stage XOR combinational logic unit implements the following XOR operations:
In the operations performed in the first-stage XOR combinational logic unit described above, the maximum quantity of combinational logic XOR units used in each step is 8.
The second-stage XOR combinational logic unit is configured to implement the following XOR operations:
In the operations performed in the second-stage XOR combinational logic unit described above, the quantity of the XOR combinational logic unit used in each step is 1.
The third-stage XOR combinational logic unit is configured to implement the following XOR operations:
In the operations performed in the third-stage XOR combinational logic unit described above, the quantity of the XOR combinational logic unit used in each step is 1.
The fourth-stage XOR combinational logic unit is configured to implement the following XOR operations:
In the operations performed in the fourth-stage XOR combinational logic unit described above, the quantity of the XOR combinational logic unit used in each step is 1.
The fifth-stage XOR combinational logic unit is configured to implement the following XOR operations:
In the operations performed in the fifth-stage XOR combinational logic unit described above, the quantity of the XOR combinational logic unit used in each step is 1. A5.1 is the result of the computation of the XOR combinational logic circuit A128. From this, a total of 8+1+1+1+1=12 stages of XORs are required to implement the XOR combinational logic circuit A128.
In summary, the present disclosure provides the linear converter. The linear converter multiplies the data block with the constant coefficient matrix in the Galois Field for one time to obtain the linear transformation result. The present disclosure effectively shortens the length of the linear transformation process, which is conducive to reducing the delay of the block encryption or block decryption process.
In addition, the linear converter of the present disclosure can be implemented using n XOR combinational logic circuits, the n XOR combinational logic circuits can provide n data bits of the linear transformation result in a parallel manner. In addition, n XOR combinational logic circuits may be implemented using multi-stage XOR combinational logic units, when the XOR combinational logic unit contains multiple XOR gates, these XOR gates can process the input data bits in a parallel manner. In the above manner, the delay of the combinational logic can be effectively reduced, thereby further reducing the delay of the block encryption or decryption process.
Furthermore, the linear converter provided by the embodiment of the present disclosure does not rely on substitution tables when performing the linear transformation, and thus does not require additional resources to calculate and store substitution tables, which is conducive to reducing the resource overhead.
The present disclosure also provides a block encryption circuit.
The present disclosure also provides a block decryption circuit.
The present disclosure also provides a chip comprising at least a portion of the linear converter, the block encryption circuit, or the block decryption circuit. The chip may be represented as a marketable active device that encapsulates the linear converter, the block encryption circuit, or the block decryption circuit manufactured on a wafer using semiconductor technology; or as a marketable active device that encapsulates the linear converter, the block encryption circuit, or the block decryption circuit using printed circuit board (PCB) packaging technology.
The descriptions of the processes or structures corresponding to the various Figs may emphasize different aspects. Parts not detailed in a particular process or structure can be referenced in the descriptions of other relevant processes or structures.
The above-mentioned embodiments are merely illustrative of the principle and effects of the present disclosure instead of restricting the scope of the present disclosure. Any person skilled in the art may modify or change the above embodiments without violating the principle of the present disclosure. Therefore, all equivalent modifications or changes made by those who have common knowledge in the art without departing from the spirit and technical concept disclosed by the present disclosure shall be still covered by the claims of the present disclosure.
Number | Date | Country | Kind |
---|---|---|---|
2023118256401 | Dec 2023 | CN | national |