Patent Application
20230082339
The present invention relates to methods and systems for performing a cryptographic process in a secured manner and for generating a secured implementation of a cryptographic process.
“White-box” cryptography is a known topic in cryptography. In white-box attacks, a cryptographic scheme is assumed to execute on an untrusted platform and a white-box adversary is assumed to have full control over the internal details of the execution. A white-box environment is, therefore, an execution environment for an item of software in which an attacker of the item of software is assumed to have full access to, and visibility of, the data being operated on (including intermediate values), memory contents and execution/process flow of the item of software. Moreover, in the white-box environment, the attacker is assumed to be able to modify the data being operated on, the memory contents and the execution/process flow of the item of software, for example by using a debugger—in this way, the attacker can experiment on, and try to manipulate the operation of, the item of software, with the aim of circumventing initially intended functionality and/or identifying secret information and/or for other purposes. Indeed, one may even assume that the attacker is aware of the underlying algorithm being performed by the item of software. However, the item of software may need to use secret information (e.g. one or more cryptographic keys), where this information needs to remain hidden from the attacker.
Under white-box attacks, many traditional cryptographic schemes cannot provide protection for private information. White-box cryptography aims at providing robustness of the implementations of cryptographic systems and constructing cryptographic systems that can succeed in their functionality (such as encryption, decryption and authentication) under white-box attacks.
White-box attacks are becoming more diversified and powerful. This enables the adversary to conduct many attacks (both static and dynamic). For example, grey-box attacks such as DPA (Differential Power Analysis) have been repurposed under the name DCA (Differential Computation Analysis) and are directly usable against white-box implementations. The main reason that DCA is successful is due to the nonnegligible correlation between expected values (from the standard cipher specification) and corresponding masked intermediate values (from the white-box implementation). Such correlation is often caused by linear imbalances in encodings used in some white-box implementation.
In many cryptographic processes (such as encryption and decryption algorithms), S-boxes (or substitution boxes) are used as a nonlinear component that is often critical for confusion. S-boxes are well-known—see, for example, https://en.wikipedia.org/wiki/S-box, the entire disclosure of which is incorporated herein by reference. In most white-box implementations, a cryptographic key will be hidden in one or more S-boxes. Therefore, the issue of how to protect the S-boxes is something that needs to be considered in order to have a secured implementation of the cryptographic process. Some protections are proven to be weak under white-box attacks, especially DCA attacks—this includes use of affine transformation, networked encoding, mask injection, etc. Common to these protections is that the statistic distribution of inputs affects the statistic distribution of outputs and there is nonnegligible correlation between the expected values and the masked intermediate values.
Embodiments of the invention aim to address such problems, using an improved/secured implementation of S-boxes.
According to a first aspect of the invention, there is provided a method of performing a cryptographic process in a secured manner, wherein the cryptographic process generates output data based on input data, the generating of the output data involving generating a value y based on an amount of data x, the value y representing a combination, according to a linear transformation L, of respective outputs from a plurality of S-boxes Sn (n=0, . . . , N−1) for integer N>1, wherein each S-box Sn (n=0, . . . , N−1) implements a respective function Hn that is either (a) the composition of a respective first function Fn and a respective linear or affine second function Gn so that Hn=Gn∘Fn, or (b) the composition of a respective first function Fn, a respective linear or affine second function Gn and a respective third function Wn so that Hn=Gn∘Fn∘Wn, wherein the method comprises: performing a first processing stage and a second processing stage to generate the value y based on the amount of data x, wherein: the first processing stage uses a plurality of first lookup tables to generate respective outputs, each output being based on at least part of the amount of data x, wherein, for each S-box Sn (n=0, . . . , N−1), the respective first function Fn is implemented by a corresponding first lookup table; and the second processing stage combines outputs from a plurality of second lookup tables to generate the value y, wherein the input to each second lookup table is formed from the output of a plurality of the first lookup tables, and wherein the set of second lookup tables is based on the second functions Gn (n=0, . . . , N−1) and the linear transformation L.
According to a second aspect of the invention, there is provided a method of generating a secured implementation of a cryptographic process, wherein the cryptographic process generates output data based on input data, the generating of the output data involving generating a value y based on an amount of data x, the value y representing a combination, according to a linear transformation L, of respective outputs from a plurality of S-boxes Sn (n=0, . . . , N−1) for integer N>1, wherein each S-box Sn (n=0, . . . , N−1) implements a respective function Hn that is either (a) the composition of a respective first function Fn and a respective linear or affine second function Gn so that Hn=Gn∘Fn, or (b) the composition of a respective first function Fn, a respective linear or affine second function Gn and a respective third function Wn so that Hn=Gn∘Fn∘Wn, wherein the method comprises: implementing a first processing stage and a second processing stage that, together, are arranged to generate the value y based on the amount of data x, wherein: implementing the first processing stage comprises generating a plurality of first lookup tables that provide respective outputs, each output being based on at least part of the amount of data x, wherein, for each S-box Sn (n=0, . . . , N−1), the respective first function Fn is implemented by a corresponding first lookup table; and implementing the second processing stage comprises generating a plurality of second lookup tables, the second processing stage arranged to combine outputs from the plurality of second lookup tables to generate the value y, wherein the input to each second lookup table is formed from the output of a plurality of the first lookup tables, and wherein the set of second lookup tables is based on the second functions Gn (n=0, . . . , N−1) and the linear transformation L.
In some embodiments of the first and second aspects, the outputs of the first lookup tables have a larger bit width than the inputs to the first lookup tables.
In some embodiments of the first and second aspects, the first lookup tables implement a corresponding obfuscation transformation that is undone by the plurality of second lookup tables.
In some embodiments of the first and second aspects, the output of each first lookup table being based on at least part of the amount of data x comprises the output of each first lookup table being based on a corresponding portion of bits of the amount of data x.
In some embodiments of the first and second aspects, the output of each first lookup table comprises the sum of a respective plurality of components, and wherein the input to each second lookup table is formed from one or more respective components of each of said plurality of the first lookup tables.
According to a third aspect of the invention, there is provided a system arranged to perform a cryptographic process in a secured manner, wherein the cryptographic process generates output data based on input data, the generating of the output data involving generating a value y based on an amount of data x, the value y representing a combination, according to a linear transformation L, of respective outputs from a plurality of S-boxes Sn (n=0, . . . , N−1) for integer N>1, wherein each S-box Sn (n=0, . . . , N−1) implements a respective function Hn that is either (a) the composition of a respective first function Fn and a respective linear or affine second function Gn so that Hn=Gn∘Fn, or (b) the composition of a respective first function Fn, a respective linear or affine second function Gn and a respective third function Wn so that Hn=Gn∘Fn∘Wn, wherein the system comprises one or more processors configure to: perform a first processing stage and a second processing stage to generate the value y based on the amount of data x, wherein: the first processing stage uses a plurality of first lookup tables to generate respective outputs, each output being based on at least part of the amount of data x, wherein, for each S-box Sn (n=0, . . . , N−1), the respective first function Fn is implemented by a corresponding first lookup table; and the second processing stage combines outputs from a plurality of second lookup tables to generate the value y, wherein the input to each second lookup table is formed from the output of a plurality of the first lookup tables, and wherein the set of second lookup tables is based on the second functions Gn (n=0, . . . , N−1) and the linear transformation L.
According to a fourth aspect of the invention, there is provided a system arranged to generate a secured implementation of a cryptographic process, wherein the cryptographic process generates output data based on input data, the generating of the output data involving generating a value y based on an amount of data x, the value y representing a combination, according to a linear transformation L, of respective outputs from a plurality of S-boxes Sn (n=0, . . . , N−1) for integer N>1, wherein each S-box Sn (n=0, . . . , N−1) implements a respective function Hn that is either (a) the composition of a respective first function Fn and a respective linear or affine second function Gn so that Hn=Gn∘Fn, or (b) the composition of a respective first function Fn, a respective linear or affine second function Gn and a respective third function Wn so that Hn=Gn∘Fn∘Wn, wherein the system comprises one or more processors arranged to: implement a first processing stage and a second processing stage that, together, are arranged to generate the value y based on the amount of data x, wherein: implementing the first processing stage comprises generating a plurality of first lookup tables that provide respective outputs, each output being based on at least part of the amount of data x, wherein, for each S-box Sn (n=0, . . . , N−1), the respective first function Fn is implemented by a corresponding first lookup table; and implementing the second processing stage comprises generating a plurality of second lookup tables, the second processing stage arranged to combine outputs from the plurality of second lookup tables to generate the value y, wherein the input to each second lookup table is formed from the output of a plurality of the first lookup tables, and wherein the set of second lookup tables is based on the second functions Gn (n=0, . . . , N−1) and the linear transformation L.
In some embodiments of the third and fourth aspect, the outputs of the first lookup tables have a larger bit width than the inputs to the first lookup tables.
In some embodiments of the third and fourth aspect, the first lookup tables implement a corresponding obfuscation transformation that is undone by the plurality of second lookup tables.
In some embodiments of the third and fourth aspect, the output of each first lookup table being based on at least part of the amount of data x comprises the output of each first lookup table being based on a corresponding portion of bits of the amount of data x.
In some embodiments of the third and fourth aspect, the output of each first lookup table comprises the sum of a respective plurality of components, and wherein the input to each second lookup table is formed from one or more respective components of each of said plurality of the first lookup tables.
According to a fifth aspect of the invention, there is provided a computer program which, when executed by one or more processors, causes the one or more processors to carry out the method of the first or second aspect (or any embodiment thereof). The computer program may be stored on a computer readable medium.
Embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings, in which:
In the description that follows and in the figures, certain embodiments of the invention are described. However, it will be appreciated that the invention is not limited to the embodiments that are described and that some embodiments may not include all of the features that are described below. It will be evident, however, that various modifications and changes may be made herein without departing from the broader spirit and scope of the invention as set forth in the appended claims.
The storage medium 104 may be any form of non-volatile data storage device such as one or more of a hard disk drive, a magnetic disc, a solid-state-storage device, an optical disc, a ROM, etc. The storage medium 104 may store an operating system for the processor 108 to execute in order for the computer 102 to function. The storage medium 104 may also store one or more computer programs (or software or instructions or code).
The memory 106 may be any random access memory (storage unit or volatile storage medium) suitable for storing data and/or computer programs (or software or instructions or code).
The processor 108 may be any data processing unit suitable for executing one or more computer programs (such as those stored on the storage medium 104 and/or in the memory 106), some of which may be computer programs according to embodiments of the invention or computer programs that, when executed by the processor 108, cause the processor 108 to carry out a method according to an embodiment of the invention and configure the system 100 to be a system according to an embodiment of the invention. The processor 108 may comprise a single data processing unit or multiple data processing units operating in parallel, separately or in cooperation with each other. The processor 108, in carrying out data processing operations for embodiments of the invention, may store data to and/or read data from the storage medium 104 and/or the memory 106.
The interface 110 may be any unit for providing an interface to a device 122 external to, or removable from, the computer 102. The device 122 may be a data storage device, for example, one or more of an optical disc, a magnetic disc, a solid-state-storage device, etc. The device 122 may have processing capabilities—for example, the device may be a smart card. The interface 110 may therefore access data from, or provide data to, or interface with, the device 122 in accordance with one or more commands that it receives from the processor 108.
The user input interface 114 is arranged to receive input from a user, or operator, of the system 100. The user may provide this input via one or more input devices of the system 100, such as a mouse (or other pointing device) 126 and/or a keyboard 124, that are connected to, or in communication with, the user input interface 114. However, it will be appreciated that the user may provide input to the computer 102 via one or more additional or alternative input devices (such as a touch screen). The computer 102 may store the input received from the input devices via the user input interface 114 in the memory 106 for the processor 108 to subsequently access and process, or may pass it straight to the processor 108, so that the processor 108 can respond to the user input accordingly.
The user output interface 112 is arranged to provide a graphical/visual and/or audio output to a user, or operator, of the system 100. As such, the processor 108 may be arranged to instruct the user output interface 112 to form an image/video signal representing a desired graphical output, and to provide this signal to a monitor (or screen or display unit) 120 of the system 100 that is connected to the user output interface 112. Additionally or alternatively, the processor 108 may be arranged to instruct the user output interface 112 to form an audio signal representing a desired audio output, and to provide this signal to one or more speakers 121 of the system 100 that is connected to the user output interface 112.
Finally, the network interface 116 provides functionality for the computer 102 to download data from and/or upload data to one or more data communication networks.
It will be appreciated that the architecture of the system 100 illustrated in
The SM4 encryption and decryption algorithms are well-known—details of SM4 can be found at http://www.gmbz.org.cn/upload/2018-04-04/1522788048733065051.pdf, the entire disclosure of which is incorporated herein by reference.
SM4 encryption operates on a 128-bit input dIn and produces a corresponding 128-bit encrypted output dOut using a 128-bit encryption key. SM4 encryption involves performing a round 32 times—the input to the first round (round 0) is dIn, and the input to the (r+1)th round is the output of the preceding rth round (for r=0, 1, . . . , 30). The rth round (for r=0, 1, . . . , 31) makes use of a corresponding 32-bit round key kr that is derived from the 128-bit encryption key using a key expansion algorithm.
The output of the last round is, therefore, the four 32-bit quantities v32, v33, v34, v35. The 128-bit encrypted output dOut is formed by reversing the order of these four 32-bit quantities, i.e. the 128-bit quantity represented by the concatenation of v35, v34, v33, v32.
SM4 decryption may be implemented similarly, as is well-known.
The S-boxes S0, S1, S2, S3 for SM4 encryption each implement the lookup table set out in Table 1 below. In particular, for an 8-bit input with hexadecimal representation αβ, the corresponding 8-bit value that is output/provided by the S-box is as per Table 1 below.
The S-box of Table 1 implements the S-box function H(x)=(A2((A1(x⊕C1))−1))⊕C2, where x, C1, C2∈28 (i.e. are represented by respective 8×1 vectors of bits), and A1, A2 are 8×8 matrices over
2. It will be appreciated, of course, that there are other equivalent ways of mathematically representing the S-box function H(x).
If the 32-bit round key kr is viewed as a concatenation of four 8-bit subkeys kr,0, kr,1, kr,2, kr,3, then each of the subkeys kr,n (n=0, 1, 2, 3) may be implemented as part of the corresponding S-box Sn. This results in four bespoke S-boxes for the rth round, namely Sr,n (n=0, 1, 2, 3) that correspond, respectively, to the 8-bit subkeys kr,n. In particular, for any 8-bit input x, the S-box Sr,n generates an 8-bit output y that equals the output of the standard S-box for SM4 encryption when provided with the 8-bit input x⊕kr,n. Thus, the S-box Sr,n implements the S-box function Hr,n(x)=(A2((A1(x⊕kr,n⊕C1))−1))⊕C2.
The AES encryption and decryption algorithms are well-known—details of AES are given in Federal Information Processing Standards Publication 197 (found at http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf), the entire disclosure of which is incorporated herein by reference.
AES encryption operates on a 128-bit input dIn and produces a corresponding 128-bit encrypted output dOut. There are three variations of AES, known as AES-128, AES-192 and AES-256: for AES-n, the size of the encryption key is n bits. AES encryption involves performing a round a number of times, R—for AES-128, R=10; for AES-192, R=12; for AES-256, R=14. A key expansion algorithm is used to generate R+1 128-bit subkeys kr (r=0, 1, . . . , R). The rth round makes use of kr (r=1, 2, . . . , R). The input to AES encryption is dIn, which gets XOR-ed with k0, following which the sequence of R rounds (rounds 1, 2, . . . , R) is performed.
AES decryption may be implemented similarly, as is well-known.
The S-boxes S0, S1, . . . S15 for AES encryption each implement the lookup table set out in Table 2 below. In particular, for an 8-bit input with hexadecimal representation αβ, the corresponding 8-bit value that is output/provided by the S-box is as per Table 2 below.
The S-box of Table 2 implements the S-box function H(x)=(A1(x−1))⊕C1, where x, C1∈28 (i.e. are represented by respective 8×1 vectors of bits), and A1 is an 8×8 matrix over
2. It will be appreciated, of course, that there are other equivalent ways of mathematically representing the S-box function H(x).
If the 128-bit subkey kr−1 is viewed as a concatenation of sixteen 8-bit subkeys kr−1,0, kr−1,1, . . . , kr−1,15, (r=1, 2, . . . , R), then each of the subkeys kr−1,n (n=0, 1, . . . , 15) may be implemented as part of the corresponding S-box S, in the rth round. In other words, the initial XOR of the input dIn with k0 may be implemented as part of the S-boxes for round 1. Likewise, the XOR at the end of the rth round (r=1, 2, . . . , R−1) may be implemented as part of the S-boxes for the following round, i.e. the (r+1)th round. This results in sixteen bespoke S-boxes for the rth round, namely Sr,n (n=0, 1, . . . , 15) that correspond, respectively, to the 8-bit subkeys kr−1,n. In particular, for any 8-bit input x, the S-box Sr,n generates an 8-bit output y that equals the output of the standard S-box for AES encryption when provided with the 8-bit input x⊕kr−1,n. Thus, the S-box Sr,n implements the S-box function Hr,n(x)=(A1((x⊕kr−1,n)−1))⊕C1.
As can be seen from the above, SM4 encryption, SM4 decryption, AES encryption and AES decryption may be viewed as a cryptographic process that comprises generating output data dOut based on input data dIn. The generation of the output data involves generating an amount of data y based on an amount of data x, the amount of data y representing a combination, according to a linear transformation L, of N S-box outputs for some integer N>1. In some implementations of such a cryptographic process, the S-box may be implemented once and used N times to provide the N S-box outputs; in other implementations of such a cryptographic process, the S-box may be implemented separately more than once (e.g. N times), with the N S-box outputs being provided from the plurality of implementations of the S-boxes—this is particularly true when the S-boxes are different for each S-box output, e.g. when a key (or a part thereof) has been combined with the S-box, as discussed above. Regardless of the actual implementation, in the following this may be regarded as equivalent to using a plurality N of S-boxes Sn (n=0, 1, . . . , N−1) for integer N>1, wherein each S-box Sn (n=0, 1, . . . , N−1) implements a respective function Hn (which may or may not be the same of the other functions Hj for j≠n). As illustrated above, the generation of an amount of data y based on an amount of data x occurs in each round of SM4 encryption, SM4 decryption, AES encryption and AES decryption, but it will be appreciated that this need not be the case for other cryptographic processes. It will be appreciated that embodiments of the invention are not limited to SM4 encryption/decryption or AES encryption/decryption as the cryptographic process, but that other algorithms could be used instead (such as Serpent encryption/decryption). Based on the above, it will be appreciated that embodiments of the invention are particularly suited to cryptographic processes that are, or that involve use of, a substitution-permutation network (such networks being well-known, and more details of which can be found at https://en.wikipedia.org/wiki/Substitution%E2%80%93permutation_network, the entire disclosure of which is incorporated herein by reference).
More generally, then, suppose there are N S-boxes Sn (n=0, 1, . . . , N−1), where N is an integer greater than 1. Each S-box Sn (n=0, 1, . . . , N−1) implements, or represents, an S-box function Hn, i.e. for each valid input x, for the S-box Sn, the corresponding output from the S-box Sn is Hn(xn). Thus, the amount of data x may comprise (or provide or represent) the inputs xn for the S-boxes Sn (n=0, 1, . . . , N−1), and the linear transformation L may operates on the outputs Hn(xn) from the S-boxes Sn (n=0, 1, . . . , N−1) to generate the amount of data y. For example (e.g. as in the SM4 encryption and decryption and AES encryption and decryption discussed above), the inputs xn (n=0, 1, . . . , N−1) may be formed from corresponding bits (e.g. blocks of consecutive bits) of the amount of data x.
Now, for each S-box Sn (n=0, 1, . . . , N−1), the corresponding S-box function Hn may be represented as a composition of a corresponding first function Fn and a corresponding second function Gn, so that Hn=Gn∘Fn. In the following discussion and embodiments, the corresponding second function Gn is an affine function/transformation or possibly a linear function/transformation. Indeed, the corresponding S-box function Hn may be represented as a composition of more than two functions, which may be represented as a composition of a corresponding first function Fn, a corresponding second function Gn and a corresponding third function Wn so that Hn=Gn∘Fn∘Wn. If, on the face of it, the corresponding S-box function Hn does not appear to be representable as a composition of two or more functions, then note that Hn=Gn∘(Gn−1∘Hn) for any affine (or possibly linear) function Gn having the same codomain as Hn's codomain—thus, the corresponding S-box function Hn may be represented as a composition of a corresponding first function, namely (Gn−1∘Hn), and a corresponding second function Gn.
Thus, each S-box Sn (n=0, 1, . . . , N−1) implements a respective function Hn that is either (a) the composition of a respective first function Fn and a respective second function Gn so that Hn=Gn∘Fn, or (b) the composition of a respective first function Fn, a respective second function Gn and a respective third function Wn so that Hn=Gn∘Fn∘Wn. It will be appreciated that, for any S-box function Hn, there may be multiple ways of writing Hn as a composition of two or more functions.
For each S-box Sn (n=0, 1, . . . , N−1), the corresponding S-box function Hn may be an algebraic function, but this is not essential. Likewise, the corresponding first function Fn (and, where used, the corresponding third function Wn) may be algebraic functions, but this is not essential. As mentioned, the corresponding second function Gn is an affine function/transformation (or possibly a linear function/transformation).
As discussed, the third functions Wn (n=0, 1, . . . , N−1) are optional, hence they are shown in dotted lines in
In
Now, Fn(xn) (n=0, 1, . . . , N−1) may be written, or represented as, a plurality of components (or parts), i.e. Fn(xn)=Σd=0D2B
2B
2B
As a linear transformation, L may be represented as a matrix
so that the first processing stage and the second processing stage together implement
It will be appreciated that, in some embodiments, Gn(Fn(xn)) (n=0, 1, . . . , N−1) may be represented as Bn×1 a vector (e.g. a vector from 2B
, in which case each of lq,n (n, q=0, 1, . . . , N−1) may be an element of the field
.
Now:
Here,
to
Thus, each component en,d (n=0, 1, . . . , N−1; d=0, 1, . . . , Dn−1) contributes the vector
to the computation of the amount of data y, with y being the sum of these vector contributions (and potentially with the addition of
The set of components E={en,d: n=0, 1, . . . , N−1; d=0, 1, . . . , Dn−1} may be partitioned into a plurality of disjoint partitions, each having a respective plurality of the components en,d. Let there be M such partitions (for integer M>1), namely Em (m=0, 1, . . . , M−1), where Um=0M−1Em=E and Em1∩Em2=Ø if m1≠m2. In some embodiments, the partitions have the same number of components; in other embodiments, some or all of the partitions may have different numbers of components from each other. Each partition Em contributions the vector
to the computation of the amount of data y.
Based on the above,
(or a representation thereof), i.e. the contribution that the partition Em makes to the computation of y. The outputs from the plurality of second lookup tables Ωm (m=0, 1, . . . , M−1) may then be combined (i.e. summed/added) to generate y (and potentially with the addition of
Thus, as can be seen from
In some embodiments, the second stage may be arranged to generate a masked version of the amount of data y. For example, the second stage may be arranged to generate the amount of data y+
In
A specific example of this is set out below, and is illustrated schematically in
H
r,n(x)=(A2((A1(x⊕kr,n⊕C1))−1))⊕C2
In this case, one may write Hr,n=Gr,n∘Fr,n, where Fr,n(x)=(A1(x⊕kr,n⊕C1))−1 and Gr,n(x)=A2x⊕C2.
The 128-bit input to the rth round comprises, or is treated as a concatenation of, four 32-bit quantities (or values): vr, vr+1, vr+2, vr+3. For the first processing stage shown in
The outputs Fr,n(xr,n) from the lookup tables Φr,n (n=0, 1, 2, 3) for the rth round are 8-bit values, each of which may be viewed as having three respective components, namely: er,n,0 is the 8-bit value whose 3 most significant bits match those of Fr,n(xr,n) and whose other bits are 0; er,n,1 is the 8-bit value whose 2 middle bits match those of Fr,n(xr,n) and whose other bits are 0; and er,n,2 is the 8-bit value whose 3 least significant bits match those of Fr,n(xr,n) and whose other bits are 0. Thus Fr,n(xr,n)=er,n,0+er,n,1+er,n,2. Of course, the way in which components are chosen/selected may change from one Type 1 table to another Type 1 table. Likewise, the way in which components are chosen/selected may change from one round to another round.
The set of components Er={er,n,j: n=0, . . . , 3; j=0, 1, 2} could be partitioned in a variety of ways, but suppose that five partitions are used so that M=5, e.g. Er,0={er,0,0, er,1,2}, Er,1={er,0,1, er,1,0, er,3,2}, Er,2={er,0,2, er,2,1}, Er,3={er,2,0, er,3,1} and Er,4={er,1,1, er,2,2, er,3,0}. Of course, the way in which components are partitioned may change from one round to another round.
Then, for the rth round there will be five respective Type 2 lookup tables Ωr,m (m=0, . . . , M−1), where:
As mentioned, each S-box Sn (n=0, 1, . . . , N−1) implements a respective function Hn that can be written as either (a) the composition of a respective first function Fn and a respective second function Gn so that Hn=Gn∘Fn, or (b) the composition of a respective first function Fn, a respective second function Gn and a respective third function Wn so that Hn=Gn∘Fn∘Wn. There may be multiple ways of writing Hn as a composition of two or more functions. For example, as discussed above for the SM4 encryption example of
The invertible linear transformations Tn (n=0, 1, . . . , N−1) could be any linear transformations and could, for example, be randomly generated. In some embodiments, Tn1 is different from Tn2 for some n1≠n2; in other embodiments, Tn is the same for all n=0, 1, . . . , N−1. In embodiments that make use of the invertible linear transformations Tn (n=0, 1, . . . , N−1), the first lookup tables Φn (n=0, 1, . . . , N−1) implement a corresponding obfuscation transformation that is undone by the plurality of second lookup tables Ωm (m=0, 1, . . . , M−1).
An example of bit-expansion-function Jn (n=0, 1, . . . , N−1) is as follows. Suppose Bn,1=8 and Bn,2=12. If the input to the bit-expansion function Jn is z (as an 8-bit vector or element of 28), then let γ0 and γ1 be 4-bit values made from different bits of z, so that z can be reformed from γ0 and γ1 (e.g. γ0 is the value made from the 4 most significant bits of z and γ1 is the value made from the 4 least significant bits of z). Jn may generate two 4-bit random numbers α1 and β1, and define two 4-bit numbers α0 and β0 as α0=γ0⊕α1 and β0=γ1⊕β1. Then Jn(z)=(δ0, δ1, δ2), i.e. a triple of three 4-bit numbers, where δ0=α0⊕β0, δ1=α1⊕β1 and δ2=α1⊕β0. Here we note that γ0=δ0⊕δ2 and γ1=δ1⊕δ2, so that γ0 and γ1 (and hence z) may be recovered from (δ0, δ1, δ2), thereby defining the inverse mapping Jn−1 over the codomain of Jn. Thus, one could represent Jn(z) with three 12-bit vectors or components, namely
(with 0, δ0, δ1, δ2 viewed here as 4-bit vectors), so that Jn(z) (as an 12-bit vector or element of 212) is Jn(z)=e0+e1+e2. It will be appreciated, of course, that other bit-expansion functions could be used instead. Regardless, in embodiments that make use of bit-expansion-functions Jn (n=0, 1, . . . , N−1), the outputs of the first lookup tables Φn (n=0, 1, . . . , N−1) have a larger bit width than the inputs to the first lookup tables Φn (n=0, 1, . . . , N−1).
At a step 702, the method 700 comprises performing a first processing stage. The first processing stage uses a plurality of first lookup tables Φn (n=0, 1, . . . , N−1) to generate respective outputs, each output being based on at least part of the amount of data x. For each S-box Sn (n=0, . . . , N−1), the respective first function Fn is implemented by a corresponding first lookup table Φn.
At a step 704, the method 700 comprises performing a second processing stage. The second processing stage combines outputs from a plurality of second lookup tables Ωm (m=0, 1, . . . , M−1) to generate the value y (and potentially with the addition of
The first processing stage and the second processing stage generate the value y based on the amount of data x.
At a step 802, the method 800 comprises implementing a first processing stage. This involves generating a plurality of first lookup tables Φn (n=0, 1, . . . , N−1) that provide respective outputs, each output being based on at least part of the amount of data x. For each S-box Sn (n=0, . . . , N−1), the respective first function Fn is implemented by a corresponding first lookup table Φn.
At a step 804, the method 800 comprises performing a second processing stage. This involves generating a plurality of second lookup tables Ωm (m=0, 1, . . . , M−1). The second processing stage is arranged or configured to combine outputs from the plurality of second lookup tables Ωm (m=0, 1, . . . , M−1) to generate the value y. The input to each second lookup table Ωm (m=0, 1, . . . , M−1) is formed from the output of a plurality of the first lookup tables (namely the components en,d∈Em). The set of second lookup tables is based on the second functions Gn (n=0, . . . , N−1) and the linear transformation L.
The first processing stage and the second processing stage, together, are arranged to generate the value y based on the amount of data x.
It will be appreciated that the methods described have been shown as individual steps carried out in a specific order. However, the skilled person will appreciate that these steps may be combined or carried out in a different order whilst still achieving the desired result.
It will be appreciated that embodiments of the invention may be implemented using a variety of different information processing systems. In particular, although the figures and the discussion thereof provide an exemplary computing system and methods, these are presented merely to provide a useful reference in discussing various aspects of the invention. Embodiments of the invention may be carried out on any suitable data processing device, such as a personal computer, laptop, personal digital assistant, mobile telephone, set top box, television, server computer, etc. Of course, the description of the systems and methods has been simplified for purposes of discussion, and they are just one of many different types of system and method that may be used for embodiments of the invention. It will be appreciated that the boundaries between logic blocks are merely illustrative and that alternative embodiments may merge logic blocks or elements, or may impose an alternate decomposition of functionality upon various logic blocks or elements.
It will be appreciated that the above-mentioned functionality may be implemented as one or more corresponding modules as hardware and/or software. For example, the above-mentioned functionality may be implemented as one or more software components for execution by a processor of the system. Alternatively, the above-mentioned functionality may be implemented as hardware, such as on one or more field-programmable-gate-arrays (FPGAs), and/or one or more application-specific-integrated-circuits (ASICs), and/or one or more digital-signal-processors (DSPs), and/or one or more graphical processing units (GPUs), and/or other hardware arrangements. Method steps implemented in flowcharts contained herein, or as described above, may each be implemented by corresponding respective modules; multiple method steps implemented in flowcharts contained herein, or as described above, may be implemented together by a single module.
It will be appreciated that, insofar as embodiments of the invention are implemented by a computer program, then one or more storage media and/or one or more transmission media storing or carrying the computer program form aspects of the invention. The computer program may have one or more program instructions, or program code, which, when executed by one or more processors (or one or more computers), carries out an embodiment of the invention. The term “program” as used herein, may be a sequence of instructions designed for execution on a computer system, and may include a subroutine, a function, a procedure, a module, an object method, an object implementation, an executable application, an applet, a servlet, source code, object code, byte code, a shared library, a dynamic linked library, and/or other sequences of instructions designed for execution on a computer system. The storage medium may be a magnetic disc (such as a hard drive or a floppy disc), an optical disc (such as a CD-ROM, a DVD-ROM or a BluRay disc), or a memory (such as a ROM, a RAM, EEPROM, EPROM, Flash memory or a portable/removable memory device), etc. The transmission medium may be a communications signal, a data broadcast, a communications link between two or more computers, etc.
| Number | Date | Country | Kind |
|---|---|---|---|
| 21193193.6 | Aug 2021 | EP | regional |
