Method, device and equipment for implementing block cipher algorithm

Abstract

This application discloses a method, apparatus, and device for implementing a block cipher algorithm. The method comprises: mapping acquired first plaintext data and a first-round key into a composite domain to obtain second plaintext data and a second-round key, respectively. The first plaintext data and the first-round key are data in a finite field of the block cipher algorithm, and the first-round key is a key generated using an initial key through a key expansion algorithm. An isomorphic relationship exists between the composite domain and the finite field of the block cipher algorithm; in the composite domain, calculating a round function included in the block cipher algorithm based on the second plaintext data and the second-round key to obtain first ciphertext data; de-mapping the first ciphertext data back into the finite field of the block cipher algorithm to obtain second ciphertext data; and outputting the second ciphertext data. This method can improve the versatility of block cipher algorithm implementations.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to a method, apparatus and device for implementing a block cipher algorithm. Background Art

[0002] A block cipher algorithm processes data in chunks of a specific length at a time. For example, the SM4 algorithm is a commonly used block cipher primarily used for data encryption. The SM4 algorithm includes encryption and decryption algorithms and key expansion algorithms, both of which use a 32-round nonlinear iterative structure.

[0003] Traditionally, block cipher algorithms (e.g., the SM4 algorithm) can be implemented in software. However, this approach relies on a large number of specific instructions to perform operations related to the block cipher algorithm, resulting in poor versatility. Block cipher algorithms can also be implemented in hardware, but this approach requires installing specialized hardware in physical devices to implement the block cipher algorithm, also resulting in poor versatility. Summary of the Invention

[0004] The present application provides a method, apparatus and device for implementing a block cipher algorithm, which can improve the versatility of the block cipher algorithm implementation.

[0005] An embodiment of the present application provides a method for implementing a block cipher algorithm, including: mapping acquired first plaintext data and a first-round key into a composite domain respectively to obtain second plaintext data and a second-round key, wherein the first plaintext data and the first-round key are data in a finite field of the block cipher algorithm, the first-round key is a key generated by a key expansion algorithm using an initial key, and an isomorphic relationship exists between the composite domain and the finite field of the block cipher algorithm; in the composite domain, calculating a round function included in the block cipher algorithm according to the second plaintext data and the second-round key to obtain first ciphertext data; inversely mapping the first ciphertext data into the finite field of the block cipher algorithm to obtain second ciphertext data; and outputting the second ciphertext data.

[0006] An embodiment of the present application provides a device for implementing a block cipher algorithm, including: a processing unit, configured to map acquired first plaintext data and a first-round key to a composite domain respectively, to obtain second plaintext data and a second-round key, wherein the first plaintext data and the first-round key are data in a finite field of the block cipher algorithm, the first-round key is a key generated by a key expansion algorithm using an initial key, and an isomorphic relationship exists between the composite domain and the finite field of the block cipher algorithm; the processing unit is further configured to implement calculation of a round function included in the block cipher algorithm according to the second plaintext data and the second-round key in the composite domain, to obtain first ciphertext data; the processing unit is further configured to de-map the first ciphertext data to the finite field of the block cipher algorithm, to obtain second ciphertext data; and an output unit is configured to output the second ciphertext data.

[0007] An embodiment of the present application provides a method for implementing a block cipher algorithm, including: mapping acquired first ciphertext data and a first-round key into a composite domain respectively to obtain second ciphertext data and a second-round key, wherein the first ciphertext data and the first-round key are data in a finite field of the block cipher algorithm, the first-round key is a key generated by a key expansion algorithm using an initial key, and an isomorphic relationship exists between the composite domain and the finite field of the block cipher algorithm; in the composite domain, calculating a round function included in the block cipher algorithm according to the second ciphertext data and the second-round key to obtain second plaintext data; de-mapping the second plaintext data into the finite field of the block cipher algorithm to obtain first plaintext data; and outputting the first plaintext data.

[0008] Optionally, in some implementations, in the composite domain, the calculation of the round function included in the block cipher algorithm is implemented according to the second ciphertext data and the second round key to obtain the second plaintext data, including: in the composite domain, using the first input data and the second round key to perform multiple rounds of iterative processing on the round function to obtain multiple iterative results corresponding to the multiple rounds of iterative processing; the iterative results obtained from the last N rounds of iterative processing in the multiple rounds of iterative processing are arranged in reverse order to obtain the first ciphertext data, where N is a positive integer; wherein, in the first round of iterative processing, the first input data is the second ciphertext data; in any round of iterative processing other than the first round of iterative processing, the first input data is obtained in the following manner: a predetermined part of the original first input data input to the round function in the previous round of iterative processing is combined in a predetermined manner with the iterative result obtained after the previous round of iteration.

[0009] Optionally, in some other implementations, the round function includes a first operation and a second operation, the first operation includes affine transformation processing and inversion processing, and the second operation includes a shift operation, a bitwise XOR operation and a specified operation α; in the composite domain, the round function is subjected to multiple rounds of iterative processing using the first input data and the second round key to obtain multiple iteration results corresponding to the multiple rounds of iterative processing, wherein any round of iterative processing includes: performing the first operation on the second input data, a first preset matrix and a first preset row vector to obtain a result after the first operation processing, the second input data is data obtained by performing a bitwise XOR operation on the second round key and part of the first input data, and the first preset matrix and the first preset row vector are data in the composite domain; performing a second operation on the result after the first operation processing using a linear matrix set to obtain a result after the second operation processing, the linear matrix set includes a first linear matrix and a second linear matrix which are two different linear matrices in the composite domain; performing a bitwise XOR operation on the result after the second operation processing and part of the data in the first input data to obtain the output result after this round of iteration.

[0010] Optionally, in some other implementations, the affine transformation processing includes a first affine transformation and a second affine transformation, and performing the first operation on the second input data, the first preset matrix and the first preset row vector to obtain the result after the first operation processing includes: performing the first affine transformation on the second input data, the first preset matrix and the first preset row vector to obtain the first affine transformation result; performing the inversion processing on the first affine transformation result to obtain the result after the inversion processing; performing the second affine transformation on the result after the inversion processing, the first preset matrix and the first preset row vector to obtain the result after the first operation processing.

[0011] Optionally, in some other implementations, the prescribed operation α includes a first linear transformation and a second linear transformation, the shift operation includes a first shift operation and a second shift operation, and the using of a linear matrix set to perform the second operation on the result processed by the first operation to obtain the result processed by the second operation includes: using the first linear matrix to perform the first linear transformation on the result processed by the first operation to obtain the first linear transformation result; and using the second linear matrix to perform the second linear transformation on the result processed by the first operation to obtain the second linear transformation result; performing the bitwise exclusive OR operation on the first linear transformation result and the second linear transformation result to obtain the result processed by the bitwise exclusive OR operation; performing the first shift operation on the result processed by the bitwise exclusive OR operation, and performing the second shift operation on the second linear transformation result to obtain the result processed by the first shift operation and the result processed by the second shift operation, respectively; performing the bitwise exclusive OR operation on the first linear transformation result, the result processed by the first shift operation, and the result processed by the second shift operation to obtain the result processed by the second operation.

[0012] Optionally, in some other implementations, the affine transformation processing includes a first affine transformation, and performing the first operation on the second input data, the first preset matrix and the first preset row vector to obtain the result after the first operation processing includes: performing the first affine transformation on the second input data, the first preset matrix and the first preset row vector to obtain the first affine transformation result; performing the inverse processing on the first affine transformation result to obtain the result after the first operation processing.

[0013] Optionally, in some other implementations, performing a second operation on the result after the first operation is processed using a linear matrix set to obtain a result after the second operation is performed includes: performing the second operation on the result after the first operation is processed using the linear matrix set, the first preset matrix and the first preset row vector to obtain a result after the second operation is performed.

[0014] Optionally, in some other implementations, the prescribed operation α includes multiple affine transformations, and the use of the linear matrix set, the first preset matrix and the first preset row vector to perform the second operation on the result after the first operation is processed to obtain the result after performing the second operation includes: using the linear matrix set, the first preset matrix and the first preset row vector to perform the multiple affine transformations on the result after the first operation is processed to obtain the multiple affine transformation results; performing the shift operation on the multiple affine transformation results to obtain the result after the shift operation; performing the bitwise XOR operation on the result after the shift operation to obtain the result after the second operation.

[0015] Optionally, in some other implementations, the multiple affine transformations include a second affine transformation and a third affine transformation, and the use of the linear matrix set, the first preset matrix and the first preset row vector to perform multiple affine transformations on the result after the first operation is processed to obtain the multiple affine transformation results includes: performing the second affine transformation on the result after the first operation is processed, the second preset matrix and the second preset row vector to obtain a second affine transformation result, the second preset matrix is ​​associated with the first linear matrix and the first preset matrix, the second preset row vector is associated with the first linear matrix and the first preset row vector, and the second preset matrix and the second preset row vector are data in the composite domain; performing the third affine transformation on the result after the first operation is processed, the third preset matrix and the third preset row vector to obtain a third affine transformation result, the third preset matrix is ​​associated with the second linear matrix and the first preset matrix association, the third preset row vector is associated with the second linear matrix and the first preset row vector; the performing the shift operation on the multiple affine transformation results to obtain the result after the shift operation processing includes: performing a first shift operation on the first XOR operation result to obtain the result after the first shift operation processing, the first XOR operation is the result obtained by performing the bitwise XOR operation on the second affine transformation result and the third affine transformation result; performing a second shift operation on the third affine transformation result to obtain the result after the second shift operation processing, the shift operation includes the first shift operation and the second shift operation; the performing the bitwise XOR operation on the result after the shift operation processing to obtain the result after the second operation processing includes: performing the bitwise XOR operation on the second affine transformation result, the first shift operation result and the second shift operation result to obtain the result after the second operation processing.

[0016] Optionally, in some other implementations, the shift operation is a circular right shift operation on a 32-bit word, the first shift operation includes a circular right shift of 8 bits and a circular right shift of 16 bits, and the second shift operation includes a circular right shift of 24 bits.

[0017] Optionally, in some other implementations, mapping the acquired first ciphertext data and first-round key to a composite domain respectively to obtain the second ciphertext data and the second-round key includes: using an isomorphic mapping matrix to map the first ciphertext data and the first-round key to the composite domain respectively to obtain the second ciphertext data and the second-round key, and the isomorphic mapping matrix is ​​used to indicate the isomorphic relationship; and de-mapping the second plaintext data to the finite field of the block cipher algorithm to obtain the first plaintext data includes: using an inverse matrix of the isomorphic mapping matrix to de-map the second plaintext data to the finite field of the block cipher algorithm to obtain the first plaintext data.

[0018] Optionally, in other implementations, the composite domain is GF(2 4 ) 2 The finite field of the block cipher algorithm is GF(2 8 ).

[0019] Optionally, in other implementations, the block cipher algorithm is the SM4 algorithm.

[0020] An embodiment of the present application provides a device for implementing a block cipher algorithm, including: a processing unit, configured to map acquired first ciphertext data and a first-round key to a composite domain respectively to obtain second ciphertext data and a second-round key, wherein the first ciphertext data and the first-round key are data in a finite field of the block cipher algorithm, the first-round key is a key generated by a key expansion algorithm using an initial key, and an isomorphic relationship exists between the composite domain and the finite field of the block cipher algorithm; the processing unit is further configured to implement calculation of a round function included in the block cipher algorithm according to the second ciphertext data and the second-round key in the composite domain to obtain second plaintext data; the processing unit is further configured to de-map the second plaintext data to the finite field of the block cipher algorithm to obtain first plaintext data; and an output unit is configured to output the first plaintext data.

[0021] It can be understood that the device for implementing the block cipher algorithm provided in the embodiment of the present application corresponds to the decryption process corresponding to the above-mentioned block cipher algorithm. For the content not described in detail here, please refer to the relevant description in the above-mentioned method embodiment.

[0022] An embodiment of the present application further provides a storage device, which stores program instructions executable by a processor to perform the method described above.

[0023] An embodiment of the present application further provides an electronic device, comprising: a processor; and a memory for storing a data processing program. After the server is powered on and the program is run by the processor, the method described above is executed.

[0024] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments disclosed in this application, nor is it intended to limit the scope of disclosure of this application. Other features disclosed in this application will become easily understood through the following description.

[0025] The present application provides a method for implementing a block cipher algorithm, comprising: mapping first plaintext data and a first-round key obtained into a composite domain to obtain second plaintext data and a second-round key, respectively; the first plaintext data and the first-round key are data in a finite field of the block cipher algorithm; the first-round key is a key generated by a key expansion algorithm using an initial key; and an isomorphic relationship exists between the composite domain and the finite field of the block cipher algorithm; in the composite domain, calculating a round function included in the block cipher algorithm based on the second plaintext data and the second-round key to obtain first ciphertext data; de-mapping the first ciphertext data back into the finite field of the block cipher algorithm to obtain second ciphertext data; and outputting the second ciphertext data. In the above-mentioned process of implementing the block cipher algorithm, the first plaintext data and the first-round key in the finite field of the block cipher algorithm are first mapped into the composite domain to obtain second plaintext data and the second-round key. Then, in the composite domain, calculating a round function included in the block cipher algorithm based on the second plaintext data and the second-round key to obtain the first ciphertext data. Finally, based on the isomorphism between the composite field and the finite field of the block cipher algorithm, the first ciphertext data is mapped into the finite field of the block cipher algorithm to implement the calculation of the block cipher algorithm. This implementation does not rely on specific instructions and does not require the installation of dedicated hardware in the physical device executing the block cipher algorithm. This method can improve the versatility of block cipher algorithm implementations. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is an application scenario suitable for the method of implementing the block cipher algorithm provided in the embodiment of this application.

[0027] Figure 2 This is a schematic diagram of a method for implementing a block cipher algorithm provided in an embodiment of the present application.

[0028] Figure 3 This is a schematic diagram of the process of round function calculation in a block cipher algorithm provided in an embodiment of the present application.

[0029] Figure 4 This is a schematic diagram of the first method of implementing the first operation provided in an embodiment of the present application.

[0030] Figure 5 This is a schematic diagram of the first method of implementing the second operation provided in an embodiment of the present application.

[0031] Figure 6 This is a schematic diagram of a second method of implementing the first operation provided in an embodiment of the present application.

[0032] Figure 7 This is a schematic diagram of a second method for implementing the second operation provided in an embodiment of the present application.

[0033] Figure 8 This is a schematic diagram of another block cipher algorithm provided in an embodiment of the present application.

[0034] Figure 9 This is a structural diagram of a device for implementing a block cipher algorithm provided in an embodiment of the present application.

[0035] Figure 10 This is a structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0036] The following description sets forth many specific details to facilitate a thorough understanding of the present application. However, the present application can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the scope of the present application. Therefore, the present application is not limited to the specific implementations disclosed below.

[0037] With the rapid development of Internet technology, more and more devices (such as user terminals or servers) are communicating over networks to achieve data transmission. To improve data security and protect privacy, when devices transmit data over a network, the sending device typically encrypts the data to be transmitted according to a pre-agreed algorithm to obtain ciphertext data, and then transmits the ciphertext data over the network to the destination device. After receiving the ciphertext data, the destination device decrypts it according to the corresponding decryption algorithm to obtain the plaintext data.

[0038] Block ciphers are a commonly used data encryption and decryption algorithm. They are a type of cryptographic algorithm that can only process a block of data of a specific length at a time. Examples of block ciphers include the SM4 algorithm, the Data Encryption Algorithm (DEA), and the Advanced Encryption Standard (AES).

[0039] Traditionally, block cipher algorithms can be implemented in software. For example, the SM4 algorithm can be implemented using the AESNI instruction set. Based on the algebraic isomorphism between the S-box operations of the AES algorithm and the S-box operations of the SM4 algorithm, the AESENCLAST instruction in the AESNI instruction set is used to perform the S-box operations of the SM4 algorithm; the entire SM4 algorithm is transformed from the algebraic structure of SM4 to the algebraic structure of AES. Another example is the implementation of the SM4 algorithm using SM4 hardware instructions. This implementation requires hardware instructions supporting the SM4 encryption and decryption algorithms in the processor (e.g., the CPU) to perform the SM4 algorithm calculations. Furthermore, when implementing a block cipher algorithm based on Bitslice technology, the algorithm must aggregate 128 or 256 plaintext data blocks before processing, resulting in limited versatility and practicality. Furthermore, traditional block cipher algorithms can also be implemented in hardware, requiring dedicated hardware to be installed in physical devices to implement the block cipher algorithm. In other words, traditional technologies for implementing block ciphers have the following problems: Software implementations rely on a large number of specific instructions to perform the operations corresponding to the block cipher, resulting in poor versatility, high system overhead, and low computational efficiency. Hardware implementations require the installation of dedicated hardware in devices to implement the block cipher, which also results in poor versatility.

[0040] Based on this, the present application provides a method, apparatus and device for implementing a block cipher algorithm to solve the above-mentioned problems.

[0041] First, a brief introduction to the professional and technical terms involved in the embodiments of this application is given:

[0042] 1. SM4 algorithm

[0043] The SM4 algorithm is a block cipher standard currently in use in China. It was issued by the China National Cryptography Administration on March 21, 2012. The relevant standard is GM / T0002-2012, "SM4 Block Cipher Algorithm." The SM4 algorithm has a block length of 128 bits and a key length of 128 bits. Both the encryption algorithm and the key expansion algorithm use a 32-round nonlinear iterative structure.

[0044] The SM4 algorithm consists of an encryption and decryption algorithm and a key expansion algorithm. The block length and key length of the SM4 algorithm are both 128 bits. Both the encryption and key expansion algorithms use 32 rounds. The encryption and decryption algorithms are identical, but the order of round keys is reversed. Key Expansion Algorithm: The SM4 algorithm uses a 128-bit encryption key and a 32-round iterative encryption structure. Each encryption round uses a 32-bit round key, for a total of 32 round keys. Therefore, a key expansion algorithm is required to generate 32 round keys from the encryption key.

[0045] In order to better understand the implementation of the block cipher algorithm provided by this application, the following briefly describes the encryption and decryption algorithm and key expansion algorithm of the SM4 algorithm. The SM4 algorithm is a 32-round nonlinear iterative structure that performs encryption operations in units of words (32 bits). Each iterative operation is a calculation of the round function F. For example, when the plaintext data input to the SM4 algorithm is (X i ,X i+1 ,X i+2 ,X i+3 ), X i ,X i+1 ,X i+2 and X i+3 When both are 4 words, the encryption algorithm in the SM4 algorithm can be expressed by the following formula:

[0046]

[0047] Among them, the function F() represents the round function; rk i Represents the round key; function R() represents the reverse transformation operation; (X i ,X i+1 ,X i+2 ,X i+3 ) represents the input data of the i-th round iteration function, which is 4 words, a total of 128 bits; (X i+1 ,X i+2 ,X i+3 ,X i+4 ) represents the output data of the round function after the ith round of iteration; (Y0, Y1, Y2, Y3) represents the output data of the round function after the 32nd round of iteration, that is, the ciphertext data, which is 4 words, totaling 128 bits. It can be understood that the function T() in the above formula (1) is a reversible transformation function. The function T() is composed of a nonlinear transformation and a linear transformation, that is, T() = L(r()). The output of the nonlinear transformation is the input of the linear transformation.

[0048] Nonlinear transformation: It is composed of four parallel S-boxes. Let the nonlinear transformation input be A=(a i ,a i+1 ,a i+2 ,a i+3 ), the nonlinear transformation output is B=(b i ,b i+1 ,b i+2 ,b i+3 ), where each of A and B has 8 bits. For example, a i is 8 bits, b i It is 8 bits.

[0049] Linear transformation: The input of linear transformation is the output of nonlinear transformation. Both the input and output of linear transformation are 32 bits. The linear transformation can be expressed by the following formula:

[0050]

[0051] It is understandable that the decryption algorithm principle of the SM4 algorithm is the same as the encryption algorithm principle. The difference is that the order of the round keys used in the decryption algorithm is reversed from the order of the round keys used in the encryption algorithm. For example, when performing 32 rounds of iterative calculations, the order of the round keys used in the encryption algorithm is: (rk0, rk1, ..., rk 31 ), the order of the round keys used by the decryption algorithm when performing 32 rounds of iterative calculations is: (rk 31 ,rk 30 ,......,rk0).

[0052] Key expansion method: Assume that the encryption key is MK = (MK0, MK1, MK2, MK3), the system parameter FK = (FK0, FK1, FK2, FK3), and the fixed parameter CK = (CK0, CK1, ..., CK 31 ).rk i The round key is generated from the encryption key.

[0053] The initial round key can be expressed by the following formula:

[0054]

[0055] round key rk i It can be expressed by the following formula:

[0056]

[0057] Wherein, the function T'() = L'(r()), and the linear transformation L'() can be expressed by the following formula:

[0058]

[0059] It can be understood that the function T'() shown in formula (1.4) in the above key expansion method is obtained by replacing the linear transformation L() in the function T() in the above encryption and decryption method with L'().

[0060] 2. SM4 finite field

[0061] The SM4 finite field is used to define the finite field of the round function in the SM4 algorithm. Each element in the finite field is 8 bits long and contains 2 8= 256 elements. The elements of this finite field can be represented in the form of bytes. The SM4 finite field is also called GF SM4 (2 8 ) finite field, namely SM4 finite field and GF SM4 (2 8 ) finite fields express the same meaning.

[0062] For example, an element in the SM4 finite field can be viewed as a row vector of length 8, where each component is either 0 or 1. It can also be represented in byte form. For example, an element in the SM4 finite field can be represented as:

[0063] 0x42=(0,1,0,0,0,0,1,0) (1.6)

[0064] Among them, 0x42 is an element of the SM4 finite field. This finite field can be regarded as containing all 0-1 row vectors of length 8, so the number of elements in it is 2 8 =256.

[0065] 3. Addition of SM4 finite fields

[0066] The addition of two elements over the SM4 finite field is defined as performing a bitwise exclusive-or operation on the two row vector representations corresponding to the two elements.

[0067] For example, two elements on the SM4 finite field are 0x31 = (0, 0, 1, 1, 0, 0, 1, 0) and 0xE5 = (1, 1, 1, 0, 0, 1, 0, 1). The result of adding these two elements can be expressed by the following formula:

[0068]

[0069] 4. Multiplication of SM4 finite fields

[0070] To define the multiplication of the SM4 finite field, we first need to regard the elements in the SM4 finite field as a polynomial. The elements in the row vector from right to left are the coefficients of the first term (constant term), the coefficients of the second term (degree 1), ..., the coefficients of the eighth term (degree 7) of the polynomial. For example:

[0071]

[0072] Furthermore, the multiplication of SM4 finite fields is defined on top of polynomial multiplication. Specifically, the multiplication of SM4 finite fields consists of the following two steps:

[0073] (1) Multiply the polynomial forms of two elements to obtain a new polynomial.

[0074] (2) Multiply this new polynomial modulo a fixed polynomial (i.e., take the remainder with respect to this fixed polynomial) to obtain the multiplication result. This fixed polynomial defines this finite field. In the SM4 finite field, this polynomial is:

[0075] f(x)=x 8 +x 7 +x 6 +x 5 +x 4 +x 3 +x 2 +x 1 +1 (1.9)

[0076] It is understood that polynomial multiplication and modular operations between polynomials refer to polynomial operations in the general sense. It should be noted that the coefficients of the polynomials described in the embodiments of the present application are all modulo 2 values, and the addition operation above can also be regarded as an addition operation in the form of a polynomial.

[0077] For example, the multiplication process of two elements in the SM4 finite field is described by taking 0xA0·0x02 as an example, where:

[0078]

[0079] Execute the above step (1) to calculate the following formula:

[0080] x·(x 7 +x 5 )=x 8 +x 6 (1.11)

[0081] Execute the above step (2) to calculate the following formula:

[0082]

[0083] Wherein, mod represents the remainder operation. After executing the above step (2), the result obtained is 0xB5 = (1, 0, 1, 1, 0, 1, 0).

[0084] 5. SM4 S-box

[0085] The SM4 S-box is also known as the SM4 S-box transform, S-box, or S-box transformation. The S-box is an operation within the round function of the SM4 algorithm. Both the input and output of the S-box are 8-bit elements. For a specific definition, refer to the "Non-Linear Transformation" section of the GM / T0002-2012 "SM4 Block Cipher Algorithm" standard. The S-box can be viewed as a superposition of a series of operations over the SM4 finite field, specifically including: an affine transformation of the input data; the inversion of the result of the affine transformation; and another affine transformation of the inverse result.

[0086] 6. SM4 L layer

[0087] The SM4 L-layer is also known as the SM4 L-layer transform or L-layer transformation. The L-layer is another operation within the round function of the SM4 algorithm. Its input consists of the output of the SM4 S-box. Both the input and output of the L-layer are 32-bit elements. For a specific definition, refer to the "Linear Transformation" section of the GM / T0002-2012 "SM4 Block Cipher Algorithm" standard. L-layer operations can be viewed as linear transformations applied to 32-bit words, or they can be broken down into a combination of shifts and linear transformations applied to each byte.

[0088] 7. GF(2 4 ) finite field

[0089] GF(2 4 ) finite field, generally refers to a finite field with an element length of 4, in which each element can be regarded as a binary row vector of length 4 (for comparison, the SM4 finite field is GF(2 8 ) is a specific instance of a finite field, where each element is of length 8 and is defined by the polynomial f(x) mentioned above. The definition rules of addition and multiplication are similar to those of the SM4 finite field introduced above. Each GF(2 4 ) finite field instances are also defined by polynomials of degree up to 4, such as x 4 +x+1 and x 4 +x 3 +1. In summary, GF(2 4 The definition of addition in finite fields is the same as that in SM4 finite fields. 4 The definition of multiplication for the finite field is different from that for the SM4 finite field mentioned above. The difference is that the polynomial f(x) is different.

[0090] 8. GF(2 4 ) 2 Finite fields

[0091] GF(2 4 ) 2 The finite field is GF(2 4) is a quadratic extension of a finite field, so GF(2 4 ) 2 Finite fields are also called composite fields. In short, GF(2 4 ) 2 The elements of the finite field are represented by the same GF(2 4 ) finite field. As mentioned above, GF(2 4 )The length of the element on the finite field is 4, so the GF(2 4 ) 2 The length of the elements in the finite field is 8.

[0092] 9. GF(2 4 ) 2 Addition over finite fields

[0093] GF(2 4 ) 2 Addition over a finite field is also defined as GF(2 4 ) 2 XOR between two elements over a finite field.

[0094] 10. GF(2 4 ) 2 Multiplication over finite fields

[0095] GF(2 4 ) 2 Multiplication over a finite field consists of the following steps:

[0096] (1) GF(2 4 ) 2 The first 4 digits and the last 4 digits of the elements in the finite field are regarded as GF(2 4 ) elements over a finite field.

[0097] Assume that we need to 4 ) 2 The multiplication operation is performed on the elements a and b in the finite field. During the multiplication process, they can be regarded as (a1, a0) and (b1, b0) respectively.

[0098] (2) Consider the two elements separated above as coefficients of the polynomial, that is, a as a1y+a0 and b as b1y+b0. Multiplying these two polynomials yields:

[0099] a1b1y 2 +(a1b0+a0b1)y+a0b0 (1.13)

[0100] The multiplication between coefficients in the above formula is based on GF(2 4 )Multiplication rule calculation over finite fields.

[0101] (3) Modulate the quadratic polynomial obtained in the previous step with a specific quadratic polynomial (i.e., take the remainder with respect to this polynomial). This specific quadratic polynomial and GF(2 4 ) finite fields together define GF(2 4 ) 2 Finite field. The remainder is the result of element-wise multiplication.

[0102] 11. Isomorphism

[0103] Isomorphism means that two finite fields have the same structure, that is, the elements of one finite field can be transformed into the elements of the other finite field, and the operations on the elements of the one finite field can be transformed into the operations on the other finite field. For example, the SM4 finite field and GF(2 4 ) 2 There is an isomorphism between finite fields, that is, the operation of element A on SM4 finite field can be converted into the operation on GF(2 4 ) 2 Operations on elements B over finite fields.

[0104] 12. Linear Transformation

[0105] A linear transformation is an operation that treats the elements of a finite field as an 8-bit row vector consisting of 0s and 1s, multiplies this row vector by an 8×8 binary matrix, and obtains another 8-bit row vector.

[0106] It can be understood that the isomorphism relationship between finite fields A and B can be expressed as a linear transformation, where elements on A are converted to elements on B after transformation, and elements on B are converted to elements on A after inverse transformation.

[0107] 13. Affine Transformation

[0108] An affine transformation is an operation that first performs a linear transformation on the elements of a finite field and then adds a constant element. An affine transformation on a finite field can be mapped to an affine transformation on another finite field through an isomorphism (i.e., a linear transformation).

[0109] 14. Inverse element

[0110] If two elements a and b on the same finite field satisfy a·b=1, then b is called the inverse element of a, usually written as b=a -1 . Where “·” represents the multiplication operation on the finite field. The inverse operation for element x is denoted as x -1 .

[0111] Below, with reference to the accompanying drawings, we will describe in detail the applicable application scenarios of the method for implementing the block cipher algorithm provided by this application, as well as the method, apparatus, and device for implementing the block cipher algorithm provided by this application. It is understood that, to the extent that there is no conflict between the various embodiments provided by this application, the following embodiments and features within these embodiments may be combined with one another. Furthermore, the sequence of steps in the following method embodiments is provided for illustrative purposes only and is not intended to be a strict limitation.

[0112] First, the application scenarios of the method for implementing the block cipher algorithm provided in the embodiment of the present application are introduced with reference to the accompanying drawings. Figure 1 This is an application scenario of the method for implementing the block cipher algorithm provided in the embodiment of this application. Figure 1 , Figure 1 The illustrated application scenario includes at least one server 10 and at least one terminal 20 .

[0113] The server 10 may be a server with storage and computing capabilities, and the server 10 may have a memory and a processor. The processor of the server 10 may be a central processing unit (CPU). Optionally, the server 10 may also have one or more of a graphics processing unit (GPU), a neural network processing unit (NPU), or a field programmable gate array (FPGA). The memory of the server 10 may be a random access memory (RAM) or a solid-state drive (SSD), or other device or memory instance with storage capabilities. The solid-state drive may also be referred to as a solid-state drive (SSD).

[0114] Terminal 20 may be a terminal with storage and computing capabilities. One or more applications may be installed on terminal 20. When an application is run on terminal 20, application data associated with the application is generated. Applications may include chat applications, financial service applications, gaming applications, and video applications (e.g., live video streaming applications or video conferencing applications). For example, terminal 20 may be a personal computer, a smartphone, or a tablet computer.

[0115] In one example, the server 10 may be a physical device deployed in a network. The server 10 and the terminal 20 are connected in communication via a network to achieve data transmission. In some implementations, after the server 10 obtains the plaintext data to be transmitted from the local storage device, it first encrypts the plaintext data using an encryption algorithm to obtain ciphertext data, and then transmits the ciphertext data to the terminal 20 via the network. After receiving the ciphertext data, the terminal 20 decrypts the ciphertext data using a decryption algorithm corresponding to the encryption algorithm to obtain the plaintext data. Optionally, in other implementations, after the terminal 20 obtains the plaintext data to be transmitted from the local storage device, it first encrypts the plaintext data using an encryption algorithm to obtain ciphertext data, and then transmits the ciphertext data to the server 10 via the network. After receiving the ciphertext data, the server 10 decrypts the ciphertext data using a decryption algorithm corresponding to the encryption algorithm to obtain the plaintext data.

[0116] It should be understood that the above Figure 1 The application scenarios shown are for illustrative purposes only and do not constitute any limitation on the application scenarios to which the methods for implementing the block cipher algorithm provided in the embodiments of the present application are applicable. Optionally, the above application scenarios may also include a greater number (for example, but not limited to, 2 or 3, etc.) of servers 10 and a greater number (for example, but not limited to, 2 or 3, etc.) of terminals 20. Optionally, the terminals 20 in the above application scenarios may also be replaced with the above servers 10.

[0117] Below, a method for implementing a block cipher algorithm provided in an embodiment of the present application is described with reference to the accompanying drawings.

[0118] Figure 2 Schematic diagram of a method for implementing a block cipher algorithm provided in an embodiment of the present application. The method for implementing a block cipher algorithm provided in an embodiment of the present application can be executed by a device for implementing a block cipher algorithm. It is understood that the device can be implemented as software, or a combination of software and hardware. For example, the device in the embodiment of the present application can be, but is not limited to, a server or a terminal device used by a user. Figure 1 The implementation method of the block cipher algorithm provided in the embodiment of the present application includes S210 to S240. S210 to S240 are described in detail below.

[0119] S210, mapping the obtained first plaintext data and the first-round key to the composite domain respectively to obtain the second plaintext data and the second-round key, the first plaintext data and the first-round key are data in the finite field of the block cipher algorithm, the first-round key is a key generated by the key expansion algorithm using the initial key, and there is an isomorphic relationship between the composite domain and the finite field of the block cipher algorithm.

[0120] Optionally, when the device for implementing a block cipher algorithm executes the method for implementing a block cipher algorithm provided in an embodiment of the present application, before the above-mentioned S210, the device may further perform the following operations: obtaining first plaintext data and a first-round key. There is no specific limitation on the manner in which the device obtains the first plaintext data and the first-round key. For example, the first plaintext data may be data generated by an application running in the device, based on which the device may obtain the first plaintext data. For example, the first-round key may be a key generated by a device other than the device (for example, but not limited to a cloud server or a user terminal device), and the device obtains the first-round key by interacting with the other device. For another example, the first-round key may be a key generated in the device, based on which the device may obtain the first-round key.

[0121] The first plaintext data is the data to be encrypted in the finite field of the block cipher algorithm, that is, the first plaintext data complies with the regulations for data in the finite field of the block cipher algorithm. For example, when the block cipher algorithm is the SM4 algorithm, the first plaintext data is the data in the finite field of SM4. In this case, the first plaintext data complies with the regulations for data in the finite field of SM4. For details, please refer to the definition of elements in the finite field of SM4 above, which will not be described in detail here. There is no specific limitation on the data length of the first plaintext data. In specific implementation, the block cipher algorithm stipulates that plaintext data of a fixed length needs to be encrypted to obtain ciphertext data of a fixed length. When the data length of the first plaintext data is greater than the fixed length, the first plaintext data can be divided into multiple arrays, and the data length included in each group does not exceed the fixed length. For example, when the block cipher algorithm is the SM4 algorithm, the SM4 algorithm needs to encrypt plaintext data with a fixed length of 128 bits to obtain corresponding 128-bit ciphertext data. Based on this, the first plaintext data can be 128-bit plaintext data. At this time, the 128-bit plaintext data can be divided into 4 groups, recorded as (X0, X1, X2, X3), X k (k=0, 1, 2, 3) is 32-bit data. Optionally, when the first plaintext data is Q (Q is a positive integer greater than 128) bits of plaintext data, the Q-bit plaintext data can be encrypted in groups. Specifically, the first 128 bits of plaintext data in the Q-bit plaintext data are first encrypted using the SM4 algorithm to obtain the result of the first encryption process, and then the 128 bits of plaintext data in the Q-bit plaintext data located after the first 128 bits of plaintext data are encrypted to obtain the result of the second encryption process, and so on. Finally, the results obtained by multiple encryption processes are spliced ​​together, which is the result after the Q-bit plaintext data is encrypted using the SM4 algorithm.

[0122] The first-round key is data in the finite field of the block cipher algorithm, that is, the first-round key complies with the data regulations in the finite field of the block cipher algorithm. Specifically, the first-round key can be understood as data in the finite field of the block cipher algorithm by referring to the above definition of the first plaintext data being data in the finite field of the block cipher algorithm. In S210 above, the key generated by the key expansion algorithm using the initial key includes multiple keys. The first-round key is a key generated by the key expansion algorithm using the initial key. It can be understood that the first-round key is one of the multiple keys generated by the key expansion algorithm using the initial key. It should be noted that the number of the multiple keys is associated with the type of block cipher algorithm. In one possible implementation, when the key expansion algorithm in S210 above is the key expansion algorithm shown in Formulas (1.3) to (1.5) above, 32 keys can be generated by the key expansion algorithm shown in Formulas (1.3) to (1.5) above using the initial key. In other words, the first-round key is one of these 32 keys.

[0123] A composite field is a field obtained by expanding a finite field multiple times. Specifically, an element in the composite field is an element obtained by combining multiple elements in the finite field. For example, when a finite field is GF(2 4 ), then the composite field of a finite field can be recorded as GF(2 4 ) 2 Finite field.

[0124] In an embodiment of the present application, there is an isomorphic relationship between the composite domain and the finite field of the block cipher algorithm, wherein the composite domain and the finite field of the block cipher algorithm are Galois fields of the same order. That is, there is at least one isomorphic matrix that can map data in the finite field of the block cipher algorithm to the composite domain. The main difference between the data in the composite domain and the data in the finite field of the block cipher algorithm is that the polynomials defining the two finite fields are different. The isomorphic matrix can eliminate the difference between the polynomials of the two fields and transform the data from one field to the other. Therefore, when an isomorphic matrix between the composite domain and the finite field of the block cipher algorithm is known, this isomorphic matrix can be used to map a data defined in the finite field of the block cipher algorithm to a data defined in the composite domain, and the inverse matrix of this isomorphic matrix can be used to map a data defined in the composite domain to a data defined in the finite field of the block cipher algorithm. The above two mapping relationships can be expressed by the following formulas:

[0125] GF2=M·GF1 (2.1)

[0126] GF1=M -1 GF2 (2.2)

[0127] Wherein, GF1 represents the data in the finite field of the block cipher algorithm, GF2 represents the data in the composite field, M represents the isomorphic matrix, M -1 represents the inverse matrix of the isomorphism matrix.

[0128] In some possible implementations, when the composite domain is GF(2 4 ) 2 Finite field, when the finite field of the block cipher algorithm is the finite field of the SM4 algorithm, the above formula (2.1) can be used to map the obtained first plaintext data and the first round key to the composite field respectively to obtain the second plaintext data and the second round key. Specifically, when GF1 in the above formula (2.1) represents the first plaintext data, GF2 represents the second plaintext data; when GF1 in the above formula (2.1) represents the first round key, GF2 represents the second round key. In this implementation method, the isomorphism matrix M in the above formula (2.1) and the inverse matrix M of the isomorphism matrix in the above formula (2.2) are -1 The definitions are as follows:

[0129]

[0130] S220 , in the composite domain, calculating a round function included in the block cipher algorithm according to the second plaintext data and the second round key to obtain the first ciphertext data.

[0131] In an embodiment of the present application, in a composite domain, a round function included in a block cipher algorithm is calculated based on second plaintext data and a second round key to obtain first ciphertext data, including: in the composite domain, performing multiple rounds of iterative processing on the round function using the first input data and the second round key to obtain multiple iteration results corresponding to the multiple rounds of iterative processing; reversing the iteration results obtained from the last N rounds of iterative processing in the multiple rounds of iterative processing to obtain first ciphertext data, where N is a positive integer; wherein, in the first round of iterative processing, the first input data is the second plaintext data; and in any round of iterative processing other than the first round of iterative processing, the first input data is obtained by combining a predetermined portion of the original first input data input to the round function in the previous round of iterative processing with the iteration result obtained after the previous round of iterative processing in a predetermined manner. It should be noted that the second round key used in any of the above-mentioned multiple rounds of iterative processing is different. The acquisition of the second round key can refer to the relevant description in S210 above and will not be repeated here. In this implementation, the structure of the round function, the value of N, the number of iterations of the multi-round iterative process, and the predetermined portion of the original first input data are related to the type of block encryption algorithm.

[0132] In some possible implementations, when the block encryption algorithm is the SM4 algorithm, N is 4, and the multiple-round iterative processing is 32-round iterative processing. Further, when the original first input data is (X i ,X i+1 ,X i+2 ,X i+3 ), i (i = 0, 1, 2, ..., 31) represents the number of multiple rounds of iterative processing, the predetermined portion of the original first input data can be (X i+1 ,X i+2 ,X i+3 ). Optionally, the combination of the above-mentioned predetermined methods can be a combination of splicing methods, in which case the predetermined part of the original first input data input to the round function during the previous round of iterative processing is spliced ​​with the iterative result obtained after the previous round of iteration to obtain the data obtained after the first input data can be used as the first input data. For example, when the data obtained after the splicing of the iterative result obtained after the previous round of iteration is X i+4 , the predetermined part of the original first input data can be (X i+1 ,X i+2 ,X i+3 ), the first input data can be expressed as (X i+1 ,X i+2 ,X i+3 ,X i+4 ).

[0133] In the above S220, the round function includes a first operation and a second operation, and the output data of the first operation is the input data of the second operation. Figure 3 The diagram shows the structure of the round function of a block encryption algorithm provided by the embodiment of the present application, and the block encryption algorithm is the SM4 algorithm. Figure 3 The dotted box is the structure of the round function provided in the embodiment of the present application, and the data to be encrypted is the second plaintext data, (X i ,X i+1 ,X i+2 ,X i+3 ) represents the first input data used when the round function performs the i-th round of iterative processing, rk i represents the second round key used when performing the i-th round of iteration of the round function, X i+4Represents the iterative result obtained after executing the i-th round of iterative processing on the round function. For example, when i=0, that is, the first round of iterative processing is executed on the round function, and the first input data is (X0, X1, X2, X3), the second round key is rk0, and the iterative result obtained after executing the first round of iterative processing on the round function is X4. For another example, when i=1, that is, the second round of iterative processing is executed on the round function, and the first input data is (X1, X2, X3, X4), the second round key is rk1, and the iterative result obtained after executing the first round of iterative processing on the round function is X5. By analogy, 32 iterative processing results obtained after executing 32 rounds of iterative processing on the round function can be obtained, and the 32 iterative processing results correspond one-to-one to the 32 rounds of iterative processing. Thereafter, the 4 iterative processing results (X 32 ,X 33 ,X 34 ,X 35 ), and then reverse the order to obtain the second ciphertext data (X 35 ,X 34 ,X 33 ,X 32 ).

[0134] Based on the structure of the above-mentioned round function, the first operation in the round function includes affine transformation processing and inversion processing, and the second operation in the round function includes shift operation, bitwise exclusive OR operation, and specified operation α. ​​Based on this, in the composite domain, multiple rounds of iterative processing are performed on the round function using the first input data and the second round key to obtain multiple iterative results corresponding to the multiple rounds of iterative processing, wherein any round of iterative processing includes: performing a first operation on the second input data, a first preset matrix, and a first preset row vector to obtain a result after the first operation processing, the second input data is data obtained by performing a bitwise exclusive OR operation on the second round key and part of the first input data, and the first preset matrix and the first preset row vector are data in the composite domain; performing a second operation on the result after the first operation processing using a linear matrix set to obtain a result after the second operation processing, the linear matrix set including a first linear matrix and a second linear matrix being two different linear matrices in the composite domain; performing a bitwise exclusive OR operation on the result after the second operation processing and part of the first input data to obtain the output result after the current round of iteration. It should be noted that the second input data is data obtained by performing a bitwise exclusive OR operation on the second round key and part of the first input data. In some possible implementations, when the block cipher algorithm is the SM4 algorithm, the current iteration is the i-th iteration, and the first input data is (X i ,X i+1 ,X i+2 ,X i+3 ), the partial input data of the first input data in this step refers to (X i+1 ,Xi+2 ,X i+3 ). Further, a bitwise exclusive OR operation is performed on the result after the second operation and part of the first input data to obtain the output result after this round of iteration. The part of the first input data in this step refers to X i .

[0135] Hereinafter, the second input data used when performing any one of the multiple rounds of iterative processing on the round function in the block cipher algorithm in the above implementation will be described in detail with reference to examples. In the above implementation, the second input data used when performing any one of the multiple rounds of iterative processing on the round function in the block cipher algorithm is the data obtained by performing a bitwise exclusive OR operation on the second round key and part of the first input data. The second input data can be understood as the input data when performing the first operation. In some implementations, when the block cipher algorithm is the SM4 algorithm, when the any one round of iterative processing is the i-th round of iteration, the first input data is (X i ,X i+1 ,X i+2 ,X i+3 ), part of the first input data is (X i+1 ,X i+2 ,X i+3 ), the second round key is rk i When the round function in the SM4 algorithm performs the i-th round of iterative processing, the second input data (x i ,x i+1 ,x i+2 ,x i+3 ) can be expressed as in Represents a bitwise exclusive OR operation. For example, Figure 3 The first input data, part of the first input data, the second round key, and the input data of the first operation in this implementation are shown.

[0136] The first preset matrix, the first preset row vector, and the linear matrix set in the above implementation are described in detail below with reference to examples.

[0137] In some possible implementations, when the block cipher algorithm is the SM4 algorithm and the composite field is GF(2 4 ) 2 In the case of a finite field, the first preset matrix A1 and the first preset row vector C1 can be defined as follows:

[0138]

[0139] C1=M·C SM4 ,C SM4=[1,1,0,1,0,0,1,1] (3.2)

[0140] Among them, M and M -1 The definition of can be found in the above formula (2.3). SM4 and C SM4 is the data in the SM4 finite field. SM4 and C SM4 , which can be understood as the preset matrix and preset row vector specified in the S-box defined in the existing SM4 algorithm standard. The S-box specified in the existing SM4 algorithm standard can be expressed by the following formula:

[0141] SBox(x)=A SM4 (x·A SM4 +C SM4 ) -1 +C SM4 (3.3)

[0142] Among them, SBox(x) represents S box, A SM4 is the preset matrix, C SM4 is the preset row vector, x is the input data of the S-box, and x is an 8-bit binary data.

[0143] In some possible implementations, the first linear matrix and the second linear matrix included in the linear matrix set are two different linear matrices in the composite domain. For example, when the block cipher algorithm is the SM4 algorithm and the composite domain is GF(2 4 ) 2 In the case of finite fields, the first linear matrix L'0 and the second linear matrix L'3 can be defined as follows:

[0144]

[0145]

[0146] Where L0 and L3 are matrix data in the SM4 finite field. L0 and L3 can be understood as part of the linear matrices included in the linear matrix set L specified in the L-layer operation defined in the existing SM4 algorithm standard. Performing a bitwise XOR operation on L0 and L3 can also obtain the following linear matrices L1 and L2:

[0147]

[0148] In the above formula (3.6), “+” represents a bitwise exclusive OR operation. The above L0, L1, L2 and L3 can be understood as all linear matrices included in the linear matrix set L specified in the L-layer operation defined in the existing SM4 algorithm standard. Furthermore, the linear matrices L1 and L2 in the SM4 finite field can be mapped to GF(24 ) 2 In the finite field, the definitions of the mapped linear matrices L1 and L2 are as follows:

[0149]

[0150] Above, the process of performing any round of iterative processing on the round function in the composite domain provided by the embodiment of the present application is introduced in detail. The implementation process specifically involves the calculation of the first operation and the calculation of the second operation in the round function. The embodiment of the present application provides two implementation methods to perform the calculation of the first operation in the round function. Correspondingly, each method of implementing the first operation corresponds to a method of implementing the second operation. For ease of description, the first process of implementing the calculation of the first operation provided by the embodiment of the present application is referred to as the first method of implementing the first operation, and the second operation corresponding to the first method of implementing the first operation can be referred to as the first method of implementing the second operation. The second process of implementing the calculation of the first operation provided by the embodiment of the present application is referred to as the second method of implementing the first operation, and the second operation corresponding to the second method of implementing the first operation can be referred to as the second method of implementing the second operation.

[0151] The following, combined Figure 4 and Figure 5 The first method for implementing the first operation and the second method for implementing the second operation are respectively introduced.

[0152] Figure 4 This is a schematic diagram of the first method of implementing the first operation provided by the embodiment of the present application. Figure 4 The first method for implementing the first operation includes S410 to S430. S410 to S430 are described in detail below. It is understandable that Figure 4 In the first embodiment of the first operation, the first operation includes an affine transformation process and an inversion process, wherein the affine transformation process includes a first affine transformation and a second affine transformation.

[0153] S410 , performing a first affine transformation on second input data, a first preset matrix, and a first preset row vector to obtain a first affine transformation result.

[0154] The definition of the first preset matrix A1 can be found in the above formula (3.1), and the definition of the first preset row vector C1 can be found in the above formula (3.2). The second input data is the input data of the first operation. The second input data is introduced in detail above. For details, please refer to the relevant description above and will not be repeated here.

[0155] The first affine transformation is performed on the second input data X, the first preset matrix A1, and the first preset row vector C1 to obtain a first affine transformation result Y1. The first affine transformation result Y1 can be expressed by the following formula:

[0156] Y1=X·A1+C1 (4.1)

[0157] Wherein, “·” represents a multiplication operation on a composite field. For example, when the block cipher algorithm is the SM4 algorithm, the second input data X in the above formula (4.1) is 128-bit data, which can be expressed as X=(x i ,x i+1 ,x i+2 ,x i+3 Based on this, Y1 is also 128-bit data, which can be expressed as Y1=(y i ,y i+1 ,y i+2 ,y i+3 ). And the “·” in the above formula (4.1) represents GF(2 4 ) 2 Multiplication operations on finite fields, related to GF(2 4 ) 2 The multiplication operation on the finite field can be found in the relevant description above and will not be described in detail here.

[0158] S420: Perform inversion processing on the first affine transformation result to obtain an inversion result.

[0159] Based on the first affine transformation result Y1 obtained in step S410, step S420 is performed, and the result after the inversion process (Y1) is -1 It can be expressed by the following formula:

[0160] (Y1) -1 =(X·A1+C1) -1 (4.2)

[0161] Here, “·” represents a multiplication operation on a composite field.

[0162] For example, continue to take the example described in S410 above as an example. Based on this, (Y1) in the above formula (4.2) -1 It is 128 bits of data and can be expressed as (Y1) -1 =(y i ,y i+1 ,y i+2 ,y i+3 ) -1 =(y i -1 ,y i+1 -1 ,yi+2 -1 ,y i+3 -1 ). In this case, “·” represents GF(2 4 ) 2 Multiplication operation over finite fields.

[0163] S430 , performing a second affine transformation on the result after the inversion processing, the first preset matrix, and the first preset row vector to obtain a result after the first operation processing.

[0164] The result (Y1) after the inversion processing obtained in S420 above -1 , execute the above S430, the result Y2 after the first operation can be expressed by the following formula:

[0165] Y2=(Y1) -1 A1+C1 (4.3)

[0166] Here, “·” represents a multiplication operation on a composite field.

[0167] For example, continue to take the example described in S410 above as an example. Based on this, Y2 in the above formula (4.3) is 128-bit data, which can be expressed as Y2=(y' i ,y' i+1 ,y' i+2 ,y' i+3 ). In this case, “·” represents GF(2 4 ) 2 Multiplication operation over finite fields.

[0168] Based on the above Figure 4 After the first operation in the round function included in the block cipher algorithm is executed in the manner shown, the result of the first operation needs to be used as input data of the second operation to implement the calculation of the second operation in the round function. Figure 5 is a schematic diagram of a first method for implementing the second operation provided in an embodiment of the present application. The first method for implementing the second operation corresponds to the first method for implementing the first operation described above, that is, after executing the first method for implementing the first operation described above, executing Figure 5 The implementation of the second operation shown is shown. Figure 5 The first method for implementing the second operation includes S510 to S540. S510 to S540 are described in detail below.

[0169] It is understandable that Figure 5In the first embodiment of the second operation, the second operation includes a shift operation, a bitwise exclusive OR operation, and a predetermined operation α, wherein the shift operation includes a first shift operation and a second shift operation, and the predetermined operation α includes a first linear transformation and a second linear transformation.

[0170] S510, performing a first linear transformation on the result after the first operation processing using a first linear matrix to obtain a first linear transformation result; and performing a second linear transformation on the result after the first operation processing using a second linear matrix to obtain a second linear transformation result.

[0171] After executing S410 to S430, the result after the first operation is obtained as Y2. The first linear matrix is ​​L'0, and the second linear matrix is ​​L'3. Based on this, the first linear matrix L'0 is used to perform a first linear transformation on the result after the first operation Y2 to obtain a first linear transformation result. The first linear transformation result can be expressed by the following formula:

[0172] Y2·L'0 (5.1)

[0173] Here, “·” represents a multiplication operation on a composite field.

[0174] For example, continuing with the example described in S410 to S430 above, based on this, Y2·L'0 shown in the above formula (5.1) can be expressed as: (y' i ,y' i+1 ,y' i+2 ,y' i+3 )·L'0. In this case, "·" represents GF(2 4 ) 2 Multiplication operation over finite fields.

[0175] Based on this, the second linear transformation is performed on the result Y2 after the first operation using the second linear matrix L'3 to obtain a second linear transformation result, which can be expressed by the following formula:

[0176] Y2·L′3 (5.2)

[0177] Here, “·” represents a multiplication operation on a composite field.

[0178] For example, continuing with the example described in S410 to S430 above, based on this, Y2·L'3 shown in the above formula (5.2) can be expressed as: (y' i ,y' i+1 ,y' i+2 ,y' i+3 )·L'3. In this case, "·" represents GF(2 4 ) 2Multiplication operation over finite fields.

[0179] S520 , performing a bitwise exclusive OR operation on the first linear transformation result and the second linear transformation result to obtain a result after the bitwise exclusive OR operation.

[0180] Based on the first linear transformation result Y2·L'0 and the second linear transformation result Y2·L'3 obtained after executing the above S510, a bitwise exclusive OR operation is performed on the two linear transformation results. The result obtained after the bitwise exclusive OR operation can be expressed by the following formula:

[0181] (Y2·L'0)+(Y2·L'3) (5.3)

[0182] Where, “+” represents a bitwise exclusive OR operation, and “·” represents a multiplication operation on a composite field.

[0183] For example, continuing with the example described in S410 to S430 above, based on this, the (Y2·L'0)+(Y2·L'3) shown in the above formula (5.3) can be further expressed as (y' i ,y' i+1 ,y' i+2 ,y' i+3 )·L'0+(y' i ,y' i+1 ,y' i+2 ,y' i+3 )·L'3. In this case, "·" represents GF(2 4 ) 2 Multiplication operation over finite fields.

[0184] S530 , performing a first shift operation on the result processed by the bitwise XOR operation, and performing a second shift operation on the second linear transformation result, to obtain a result processed by the first shift operation and a result processed by the second shift operation, respectively.

[0185] In some possible implementations, when the block cipher algorithm is the SM4 algorithm and the composite field is GF(2 4 ) 2 In the case of a finite field, the first shift operation in S530 includes a circular right shift of 8 bits and a circular right shift of 16 bits, and the second shift operation includes a circular right shift of 24 bits. For ease of description, the result of the bitwise XOR operation obtained in S520 (Y2·L'0)+(Y2·L'3) is recorded as P0. Based on this, the first shift operation performed on P0 can be expressed by the following formula:

[0186] P0>>>8,P0>>>16 (5.4)

[0187] Among them, ">>>8" means performing a circular right shift of 8 bits on the left data, and ">>>16" means performing a circular right shift of 16 bits on the left data.

[0188] For ease of description, the second linear transformation result Y2·L'3 obtained in the above steps is recorded as P1. Further, in this implementation, the second shift operation is performed on the second linear transformation result P1, which can be expressed by the following formula:

[0189] P1>>>24 (5.5)

[0190] S540 , performing a bitwise exclusive OR operation on the first linear transformation result, the result after the first shift operation, and the result after the second shift operation to obtain a result after the second operation.

[0191] Based on the first linear transformation result P0 obtained in S510, the result after the first shift operation (i.e., P0>>>8 and P0>>>16) obtained in S510, and the result after the second shift operation P1>>>24, S540 is performed. The result after the first operation can be expressed by the following formula:

[0192] P0+P0>>>8+P0>>>16+P1>>>24 (5.6)

[0193] Here, “+” represents the bitwise exclusive OR operation.

[0194] Above, combined Figure 5 The detailed process of the first implementation method of the first operation and the second operation in the round function of the block cipher algorithm provided by the present application is introduced. Figure 6 and Figure 7 A second method for implementing the first operation and a third method for implementing the second operation are respectively introduced.

[0195] Figure 6 Schematic diagram of the second method of implementing the first operation provided by the embodiment of the present application. Figure 6 The second method for implementing the first operation includes S610 and S620. S610 and S620 are described in detail below. It is understandable that Figure 6 In the second embodiment of the first operation, the first operation includes an affine transformation process and an inversion process, wherein the affine transformation process includes a first affine transformation and a second affine transformation.

[0196] S610 , performing a first affine transformation on second input data, a first preset matrix, and a first preset row vector to obtain a first affine transformation result.

[0197] It can be understood that the method described in the above S610 is the same as the method described in the above S410. For matters not described in detail here, please refer to the relevant description of S410 above.

[0198] S620: Perform inverse processing on the first affine transformation result to obtain a result after the first operation processing.

[0199] Based on the first affine transformation result Y1 obtained in S610, after executing S620, the result after the first operation processing can be expressed by the following formula:

[0200] Y2=(Y1) -1 (6.1)

[0201] For example, when the block cipher algorithm is SM4 algorithm and the composite domain is GF(2 4 ) 2 When the field is finite, the above Y2 and (Y1) -1 It can be 128-bit data, and Y2 and (Y1) -1 is GF(2 4 ) 2 Data in finite fields.

[0202] Based on the above Figure 6 After the first operation in the round function included in the block cipher algorithm is executed in the manner shown, the result of the first operation needs to be used as input data of the second operation in the round function to implement calculation of the second operation. Figure 7 This is a schematic diagram of a second method for implementing the second operation provided in an embodiment of the present application. The second method for implementing the second operation is similar to the above method. Figure 6 The second method for implementing the first operation shown corresponds to the following method: after executing the second method for implementing the first operation, executing Figure 7 The implementation of the second operation shown is shown. Figure 7 The second method for implementing the second operation includes S710, which further includes S710-1 to S710-3. S710 and S710-1 to S710-3 are described in detail below.

[0203] S710 , performing a second operation on a result processed by the first operation using a linear matrix set, a first preset matrix, and a first preset row vector to obtain a result processed by the second operation.

[0204] The definition of the first preset matrix can be found in the above formula (3.1), and the definition of the first preset row vector can be found in the above formula (3.2). In some possible implementations, the above S710 may include S710-1 to S710-3. S710-1 to S710-3 are described in detail below.

[0205] S710 - 1 , performing multiple affine transformations on the result after the first operation processing using a linear matrix set, a first preset matrix, and a first preset row vector to obtain multiple affine transformation results.

[0206] In some possible implementations, the multiple affine transformations in S710-1 above include a second affine transformation and a third affine transformation, and multiple affine transformations are performed on the result after the first operation using a linear matrix set, a first preset matrix, and a first preset row vector to obtain multiple affine transformation results, including: performing a second affine transformation on the result after the first operation, the second preset matrix, and the second preset row vector to obtain a second affine transformation result, the second preset matrix is ​​associated with the first linear matrix and the first preset matrix, the second preset row vector is associated with the first linear matrix and the first preset row vector, and the second preset matrix and the second preset row vector are data in a composite domain; performing a third affine transformation on the result after the first operation, the third preset matrix, and the third preset row vector to obtain a third affine transformation result, the third preset matrix is ​​associated with the second linear matrix and the first preset matrix, and the third preset row vector is associated with the second linear matrix and the first preset row vector. In this implementation, the second preset matrix is ​​associated with the first linear matrix and the first preset matrix, that is, the second preset matrix is ​​a matrix obtained by performing a dot product of the first linear matrix and the first preset matrix. The second preset row vector is associated with the first linear matrix and the first preset row vector, that is, the second preset row vector is a row vector obtained by dot product processing of the first linear matrix and the first preset row vector. The third preset row matrix is ​​associated with the second linear matrix and the first preset matrix, that is, the third preset matrix is ​​a matrix obtained by dot product processing of the second linear matrix and the first preset matrix. The third preset row vector is associated with the second linear matrix and the first preset row vector, that is, the third preset row vector is a row vector obtained by dot product processing of the second linear matrix and the first preset row vector. Among them, the definitions of the above-mentioned first linear matrix L'0 and the second linear matrix L'3 can be referred to the above-mentioned formula (3.7) and formula (3.5). Based on this, the definitions of the second preset matrix A1·L'0, the second preset row vector C1·L'0, the third preset matrix A1·L'3 and the third preset row vector C1·L'3 are as follows:

[0207]

[0208] Among them, A SM4 and C SM4 The definition of can be found in the above formula (3.1) and the above formula (3.2). M and M -1 The definition of can be found in the above formula (2.3). The definition of L'0 and L0 can be found in the above formula (3.4). The definition of L'3 and L3 can be found in the above formula (3.5).

[0209] Based on the result Y2 after the first operation processing obtained in S620, the second affine transformation is performed on the result after the first operation processing, the second preset matrix and the second preset row vector to obtain a second affine transformation result. The second affine transformation result can be expressed by the following formula:

[0210] Y2·A2+C2(6.3)

[0211] Wherein, “·” represents a multiplication operation on a composite field. The second preset matrix A2 and the second preset row vector C2 are defined as follows:

[0212] A2=M -1 A1 L0 M (6.4)

[0213] C2=C1·L0·M (6.5)

[0214] Where L0 represents the data mapped from the first linear matrix L'0 to the finite field of the block cipher algorithm. The definition of L0 can be found in the above formula (3.4). A1 represents the first preset matrix. The definition of A1 can be found in the above formula (3.1). C1 represents the first preset row vector. The definition of C1 can be found in the above formula (3.2).

[0215] Based on the result Y2 after the first operation processing obtained in S620, the third affine transformation is performed on the result after the first operation processing, the third preset matrix and the third preset row vector to obtain a third affine transformation result. The third affine transformation result can be expressed by the following formula:

[0216] Y2·A3+C3 (6.6)

[0217] The third preset matrix A3 and the third preset row vector C3 are defined as follows:

[0218] A3=M -1 A1 L3 M (6.7)

[0219] C3=C1·L3·M (6.8)

[0220] Wherein, L3 represents the data mapped from the second linear matrix L'3 to the finite field of the block cipher algorithm. The definition of L3 can be found in the above formula (3.5). A1 represents the first preset matrix. The definition of A1 can be found in the above formula (3.1). C1 represents the first preset row vector. The definition of C1 can be found in the above formula (3.2).

[0221] S710 - 2 , performing a shift operation on the multiple affine transformation results to obtain a result after the shift operation.

[0222] Among them, performing a shift operation on multiple affine transformation results to obtain the results after the shift operation processing includes: performing a first shift operation on the first XOR operation result to obtain the result after the first shift operation processing, the first XOR operation result is the result obtained by performing a bitwise XOR operation on the second affine transformation result and the third affine transformation result; performing a second shift operation on the third affine transformation result to obtain the result after the second shift operation processing, and the shift operation includes the first shift operation and the second shift operation.

[0223] In some possible implementations, when the block cipher algorithm is the SM4 algorithm and the composite field is GF(2 4 ) 2 In the case of a finite field, the first shift operation involved in the above S710-2 includes a circular right shift of 8 bits and a circular right shift of 16 bits, and the second shift operation includes a circular right shift of 24 bits. For the convenience of description, the second affine transformation result Y2·A2+C2 obtained by the above S710-1 is recorded as S0; the third affine transformation result Y2·A3+C3 obtained is recorded as S1. Based on this, a bitwise XOR operation is performed on the second affine transformation result and the third affine transformation result, and the obtained first XOR operation result can be expressed as S0+S1, and "+" represents a bitwise XOR operation. For the convenience of description, hereinafter, the first XOR operation result S0+S1 is recorded as K0. Based on this, the first shift operation performed on K0 can be expressed by the following formula:

[0224] K0>>>8,K0>>>16 (6.9)

[0225] Among them, ">>>8" means performing a circular right shift of 8 bits on the left data, and ">>>16" means performing a circular right shift of 16 bits on the left data.

[0226] A second shift operation is performed on the third affine transformation result to obtain a result after the second shift operation. The result after the second shift operation can be expressed by the following formula:

[0227] S1>>>24 (6.10)

[0228] Among them, “>>>8” means performing a circular right shift of 8 bits on the left data.

[0229] S710-3, performing a bitwise exclusive OR operation on the result after the shift operation to obtain a result after the second operation.

[0230] The step of performing a bitwise exclusive OR operation on the result after the shift operation to obtain the result after the second operation includes performing a bitwise exclusive OR operation on the second affine transformation result, the first shift operation result, and the second shift operation result to obtain the result after the second operation. The step of performing a bitwise exclusive OR operation on the second affine transformation result S0 obtained in step S710-2, the first shift operation result (i.e., K0>>>8 and K0>>>16), and the second shift operation result S1>>>24 can be represented by the following formula:

[0231] S0+K0>>>8+K0>>>16+S1>>>24 (6.11)

[0232] It is understood that after executing S220 above, the first ciphertext data corresponding to the first plaintext data can be obtained. This first ciphertext data is data in the composite field. Next, it is necessary to map the first ciphertext data in the composite field to the finite field of the block cipher algorithm. That is, after executing S220 above, S230 is continued.

[0233] S230 , inversely map the first ciphertext data into a finite field of a block cipher algorithm to obtain second ciphertext data.

[0234] In S230 above, the first ciphertext data is data in a composite field. Based on this, de-mapping the first ciphertext data to a finite field of the block cipher algorithm to obtain the second ciphertext data includes: de-mapping the first ciphertext data to a finite field of the block cipher algorithm using the inverse matrix of the isomorphism matrix. When the block cipher algorithm is the SM4 algorithm, the second ciphertext data obtained after executing S230 above can be expressed by the following formula:

[0235] A=M -1 B (6.12)

[0236] Wherein, B represents the first ciphertext data, A represents the second ciphertext data, and both the first ciphertext data and the second ciphertext data are 128-bit data. -1 Represents the inverse matrix of the isomorphic matrix, M -1 The definition of can be found in the above formula (2.3).

[0237] S240: Output the second ciphertext data.

[0238] It should be understood that the above Figure 2 The method for implementing the block cipher algorithm shown is for illustration only and does not constitute any limitation on the method for implementing the block cipher algorithm provided in the embodiments of the present application. Figure 2 The SM4 algorithm in the protocol can also be replaced by a block cipher algorithm with a similar algorithm principle to the SM4 algorithm.

[0239] In an embodiment of the present application, during the implementation of a block cipher algorithm, the first plaintext data and the first-round key in the finite field of the block cipher algorithm are first mapped to a composite field to obtain the second plaintext data and the second-round key. Then, in the composite field, the round function included in the block cipher algorithm is calculated based on the second plaintext data and the second-round key to obtain the first ciphertext data. Finally, through the isomorphism between the composite field and the finite field of the block cipher algorithm, the first ciphertext data is mapped to the finite field of the block cipher algorithm to implement the calculation of the block cipher algorithm. The above implementation process does not rely on specific instructions, nor does it require the installation of dedicated hardware in the device executing the block cipher algorithm. This method can improve the versatility of the block cipher algorithm implementation.

[0240] Above, combined Figures 2 to 7 The present invention provides a block cipher algorithm implementation method, specifically, the algorithm is used to encrypt data. Correspondingly, the present invention also provides another block cipher implementation method, specifically, the algorithm is used to decrypt data. Figure 8 This paper introduces the method of implementing this block cipher.

[0241] Figure 8 This is another schematic diagram of implementing a block cipher algorithm provided in an embodiment of the present application. Figure 8 The implementation method of the block cipher algorithm shown can be executed by a device that implements the block cipher algorithm. It is understood that the device can be implemented as software, or a combination of software and hardware. For example, the device in the embodiment of the present application can be, but is not limited to, a server or a terminal device used by a user. Figure 8 The implementation method of the block cipher algorithm provided in the embodiment of the present application includes S810 to S840. S810 to S840 are introduced below.

[0242] S810, mapping the obtained first ciphertext data and the first-round key to the composite domain respectively to obtain the second ciphertext data and the second-round key, the first ciphertext data and the first-round key are data in the finite field of the block cipher algorithm, the first-round key is a key generated by the key expansion algorithm using the initial key, and there is an isomorphic relationship between the composite domain and the finite field of the block cipher algorithm.

[0243] S820: In the composite domain, calculate a round function included in the block cipher algorithm according to the second ciphertext data and the second round key to obtain second plaintext data.

[0244] S830: De-map the second plaintext data into a finite field of a block cipher algorithm to obtain the first plaintext data.

[0245] S840: Output the first plaintext data.

[0246] Among them, the above-mentioned calculation of the round function included in the block cipher algorithm is implemented in the composite domain according to the second ciphertext data and the second round key to obtain the second plaintext data, including: in the composite domain, using the first input data and the second round key to perform multiple rounds of iterative processing on the round function to obtain multiple iterative results corresponding to the multiple rounds of iterative processing; the iterative results obtained by the last N rounds of iterative processing in the multiple rounds of iterative processing are arranged in reverse order to obtain the first ciphertext data, where N is a positive integer; wherein, in the first round of iterative processing, the first input data is the second ciphertext data; in any round of iterative processing other than the first round of iterative processing, the first input data is obtained in the following manner: a predetermined part of the original first input data input to the round function in the previous round of iterative processing is combined in a predetermined manner with the iterative result obtained after the previous round of iteration.

[0247] It is understandable that Figure 8 The working principle of the method provided by the block cipher algorithm implementation is the same as Figure 2 The working principle of the methods provided for implementing the block cipher algorithms are the same, except that, Figure 2 The definition of the first input data in the provided method is the same as Figure 8 The first input data is defined differently in the provided method; and Figure 8 The order of the multiple round keys used when performing multiple rounds of iterative processing on the round function in the method for implementing the block cipher algorithm provided is the same as Figure 2 The order of the multiple round keys used when performing multiple rounds of iterative processing on the round function in the provided block cipher algorithm implementation method is reversed. For example, when Figure 2 and Figure 8 When the block cipher algorithm shown is SM4 algorithm, Figure 2 In the method shown, the order of the 32 round keys used when performing 32 rounds of iterative processing on the round function is (rk0, rk1, ..., rk 31 )hour, Figure 8 The order of the 32 round keys used when performing 32 rounds of iterative processing on the round function in the method shown is (rk 31 ,rk 30 ,......,rk0). In other words, Figure 8 The other implementation steps in the method shown are the same as those described above. Figure 2 The other implementation steps in the method shown are the same. For the contents not described in detail in the above S810 to S840, please refer to the relevant descriptions in the above S210 to S240.

[0248] It should be understood that the above Figures 2 to 8The method for implementing the block cipher algorithm shown is only for illustration and does not constitute any limitation on the method for implementing the block cipher algorithm provided in this application. In other words, those skilled in the art can Figures 2 to 8 The method for implementing the block cipher algorithm shown can obviously be subjected to various equivalent modifications or changes, and such modifications and changes also fall within the scope of the embodiments of the present application.

[0249] Above, combined Figures 1 to 8 The application scenarios applicable to the embodiments of this application and the method for implementing the block cipher algorithm provided by this application are introduced in detail. Figure 9 and Figure 10 This application introduces the apparatus and electronic device for implementing a block cipher algorithm. It should be understood that the method for implementing a block cipher algorithm described above corresponds to the apparatus and electronic device for implementing a block cipher algorithm described below. Therefore, for any details not described below, reference can be made to the relevant descriptions in the aforementioned method embodiments.

[0250] Corresponding to the method for implementing a block cipher algorithm provided in an embodiment of the present application, an embodiment of the present application provides a device for implementing a block cipher algorithm. Figure 9 This is a structural diagram of a device for implementing a block cipher algorithm provided in an embodiment of the present application. Figure 9 As shown, the device includes a processing unit 901 and an output unit 902.

[0251] In some implementations, the device is used to implement the encryption algorithm process corresponding to the block cipher algorithm in the above method embodiment. Below, the steps in the encryption algorithm executed by the processing unit 901 and the output unit 902 when executing the encryption algorithm are described.

[0252] The processing unit 901 is used to map the obtained first plaintext data and the first round key to a composite domain respectively to obtain the second plaintext data and the second round key, wherein the first plaintext data and the first round key are data in the finite field of the block cipher algorithm, the first round key is a key generated by a key expansion algorithm using an initial key, and there is an isomorphic relationship between the composite domain and the finite field of the block cipher algorithm; the processing unit 901 is also used to implement the calculation of the round function included in the block cipher algorithm according to the second plaintext data and the second round key in the composite domain to obtain the first ciphertext data; the processing unit 901 is also used to de-map the first ciphertext data to the finite field of the block cipher algorithm to obtain the second ciphertext data; the output unit 902 is used to output the second ciphertext data.

[0253] In other implementations, the device is used to implement the decryption algorithm process corresponding to the block cipher algorithm in the above method embodiment. The following describes the steps in the decryption algorithm executed by the processing unit 901 and the output unit 902 when executing the decryption algorithm.

[0254] The processing unit 901 is used to map the obtained first ciphertext data and the first round key to a composite domain respectively to obtain the second ciphertext data and the second round key, wherein the first ciphertext data and the first round key are data in a finite field of a block cipher algorithm, and the first round key is a key generated by a key expansion algorithm using an initial key, and there is an isomorphic relationship between the composite domain and the finite field of the block cipher algorithm; the processing unit 901 is also used to implement the calculation of the round function included in the block cipher algorithm according to the second ciphertext data and the second round key in the composite domain to obtain the second plaintext data; the processing unit 901 is also used to de-map the second plaintext data to the finite field of the block cipher algorithm to obtain the first plaintext data; the output unit 902 is used to output the first plaintext data.

[0255] It should be noted that for the detailed description of the device embodiment provided in the embodiment of the present application, reference can be made to the relevant description of the method for implementing the block cipher algorithm provided in the embodiment of the present application, which will not be repeated here.

[0256] Corresponding to a method for implementing a block cipher algorithm provided in an embodiment of the present application, an embodiment of the present application provides an electronic device. Figure 10 This is a structural diagram of an electronic device provided in an embodiment of the present application. Figure 10 As shown, the system includes a memory 1001, a processor 1002, a communication interface 1003 and a communication bus 1004. The memory 1001, the processor 1002 and the communication interface 1003 are connected to each other via the communication bus 1004.

[0257] The memory 1001 may be a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1001 may store a program. When the program stored in the memory 1001 is executed by the processor 1002, the processor 1002 and the communication interface 1003 are used to perform the various steps of the method for implementing the block cipher algorithm in the embodiment of the present application.

[0258] The processor 1002 can be a general-purpose processor (central processing unit, CPU), a microprocessor, an application specific integrated circuit (ASIC), a graphics processing unit (GPU) or one or more integrated circuits to execute relevant programs to implement the functions required to be performed by the units in the device for implementing the block cipher algorithm of the embodiment of the present application, or to execute the various steps of the method for implementing the block cipher algorithm of the embodiment of the present application.

[0259] Processor 1002 may also be an integrated circuit chip with signal processing capabilities. During implementation, the various steps of the method for implementing the block cipher algorithm provided herein may be performed by hardware integrated logic circuits or software instructions within processor 1002. The aforementioned processor 1002 may also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component. The various methods, steps, and logic block diagrams disclosed in the embodiments of this application may be implemented or executed. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in conjunction with the embodiments of this application may be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules within the decoding processor. The software modules may be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or the like. The storage medium is located in the memory 1001, and the processor 1002 reads the information in the memory 1001, and combines its hardware to complete the functions required to be performed by the units included in the device for implementing the block cipher algorithm of the embodiment of the present application, or executes the method for implementing the block cipher algorithm of the method embodiment of the present application.

[0260] The communication interface 1003 uses a transceiver such as, but not limited to, a transceiver to implement Figure 10 The device shown may communicate with other devices or communication networks. For example, encrypted data may be output via the communication interface 1003.

[0261] The communication bus 1004 may include Figure 10 The pathway for transmitting information between the various components of the device (e.g., memory 1001, processor 1002, communication interface 1003) is shown.

[0262] An embodiment of the present application further provides a storage device, which stores program instructions executable by a processor, and the program instructions are used to implement the various steps of the method for implementing the block cipher algorithm provided in the present application.

[0263] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored on a computer-readable medium and includes several instructions to enable a computing device (which can be a personal computer, server, terminal device, or network device, etc.) to execute the method according to the embodiments of the present disclosure.

[0264] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0265] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0266] 1. Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage media, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include non-transitory media such as modulated data signals and carrier waves.

[0267] 2. Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0268] Although the present application is disclosed as above with the preferred embodiments, it is not intended to limit the present application. Any person skilled in the art may make possible changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be based on the scope defined by the claims of the present application.

Claims

1. A method for implementing a block cipher algorithm, characterized in that: include: Mapping the obtained first plaintext data and the first-round key into a composite domain respectively to obtain second plaintext data and a second-round key, wherein the first plaintext data and the first-round key are data in a finite field of a block cipher algorithm, the first-round key is a key generated by a key expansion algorithm using an initial key, and there is an isomorphism between the composite domain and the finite field of the block cipher algorithm; In the composite domain, calculating a round function included in the block cipher algorithm according to the second plaintext data and the second round key to obtain first ciphertext data, the round function including a first operation and a second operation, the first operation including an affine transformation process and an inversion process, and the second operation including a shift operation, a bitwise exclusive OR operation, and a specified operation α; Performing the second operation on the result processed by the first operation using a linear matrix set to obtain a result processed by the second operation; De-mapping the first ciphertext data into the finite field of the block cipher algorithm to obtain second ciphertext data; The second ciphertext data is output.

2. The method according to claim 1, characterized in that The step of calculating a round function included in the block cipher algorithm according to the second plaintext data and the second round key in the composite domain to obtain first ciphertext data includes: In the composite domain, performing multiple rounds of iterative processing on the round function using the first input data and the second round key to obtain multiple iteration results corresponding to the multiple rounds of iterative processing; Rearranging the iterative results obtained from the last N rounds of iterative processing in the multiple rounds of iterative processing in reverse order to obtain the first ciphertext data, where N is a positive integer; In which, in the first round of iterative processing, the first input data is the second plaintext data; in any round of iterative processing other than the first round of iterative processing, the first input data is obtained in the following manner: a predetermined portion of the original first input data input to the round function in the previous round of iterative processing is combined in a predetermined manner with the iterative result obtained after the previous round of iteration.

3. The method according to claim 2, characterized in that In the composite domain, performing multiple rounds of iterative processing on the round function using the first input data and the second round key to obtain multiple iteration results corresponding to the multiple rounds of iterative processing, wherein any one round of iterative processing includes: performing the first operation on second input data, a first preset matrix, and a first preset row vector to obtain a result of the first operation, wherein the second input data is data obtained by performing a bitwise exclusive OR operation on the second-round key and part of the first input data, and the first preset matrix and the first preset row vector are data in the composite field; The first linear matrix and the second linear matrix included in the linear matrix set are two different linear matrices in the composite domain; A bitwise exclusive OR operation is performed on the result after the second operation processing and part of the data in the first input data to obtain an output result after this round of iteration.

4. The method according to claim 3, characterized in that The affine transformation processing includes a first affine transformation and a second affine transformation, and performing the first operation on the second input data, the first preset matrix, and the first preset row vector to obtain a result after the first operation processing includes: Performing the first affine transformation on the second input data, the first preset matrix, and the first preset row vector to obtain the first affine transformation result; Performing the inversion process on the first affine transformation result to obtain a result after the inversion process; The second affine transformation is performed on the result after the inversion processing, the first preset matrix and the first preset row vector to obtain the result after the first operation processing.

5. The method according to claim 4, characterized in that The prescribed operation α includes a first linear transformation and a second linear transformation, the shift operation includes a first shift operation and a second shift operation, and performing a second operation on a result processed by the first operation using a linear matrix set to obtain a result processed by the second operation includes: Performing the first linear transformation on the result after the first operation processing using the first linear matrix to obtain the first linear transformation result; and performing the second linear transformation on the result after the first operation processing using the second linear matrix to obtain the second linear transformation result; Performing the bitwise exclusive OR operation on the first linear transformation result and the second linear transformation result to obtain a result after the bitwise exclusive OR operation; Performing the first shift operation on the result of the bitwise XOR operation, and performing the second shift operation on the second linear transformation result, to obtain a result of the first shift operation and a result of the second shift operation, respectively; The bitwise exclusive OR operation is performed on the first linear transformation result, the result after the first shift operation, and the result after the second shift operation to obtain a result after the second operation.

6. The method according to claim 3, characterized in that The affine transformation processing includes a first affine transformation, and performing the first operation on the second input data, a first preset matrix, and a first preset row vector to obtain a result after the first operation processing includes: Performing the first affine transformation on the second input data, the first preset matrix, and the first preset row vector to obtain the first affine transformation result; The inverse process is performed on the first affine transformation result to obtain a result after the first operation process.

7. The method according to claim 6, characterized in that The performing a second operation on the result processed by the first operation using a linear matrix set to obtain a result processed by the second operation includes: The second operation is performed on the result after the first operation is processed using the linear matrix set, the first preset matrix and the first preset row vector to obtain a result after the second operation is processed.

8. The method according to claim 6, characterized in that The prescribed operation α includes a plurality of affine transformations, and performing the second operation on the result after the first operation processing using the linear matrix set, the first preset matrix, and the first preset row vector to obtain the result after the second operation processing includes: Performing the plurality of affine transformations on the results of the first operation processing using the linear matrix set, the first preset matrix, and the first preset row vector to obtain the plurality of affine transformation results; Performing the shift operation on the multiple affine transformation results to obtain results processed by the shift operation; The bitwise exclusive OR operation is performed on the result after the shift operation to obtain a result after the second operation.

9. The method according to claim 8, characterized in that The multiple affine transformations include a second affine transformation and a third affine transformation, and performing the multiple affine transformations on the result after the first operation processing using the linear matrix set, the first preset matrix, and the first preset row vector to obtain the multiple affine transformation results includes: performing the second affine transformation on a result of the first operation, a second preset matrix, and a second preset row vector to obtain a second affine transformation result, wherein the second preset matrix is ​​associated with the first linear matrix and the first preset matrix, the second preset row vector is associated with the first linear matrix and the first preset row vector, and the second preset matrix and the second preset row vector are data in the composite domain; performing the third affine transformation on the result of the first operation, a third preset matrix, and a third preset row vector to obtain a third affine transformation result, wherein the third preset matrix is ​​associated with the second linear matrix and the first preset matrix, and the third preset row vector is associated with the second linear matrix and the first preset row vector; The performing the shift operation on the plurality of affine transformation results to obtain a result after the shift operation includes: performing a first shift operation on a first XOR operation result to obtain a result processed by the first shift operation, wherein the first XOR operation is a result obtained by performing the bitwise XOR operation on the second affine transformation result and the third affine transformation result; performing a second shift operation on the third affine transformation result to obtain a result processed by the second shift operation, wherein the shift operation includes the first shift operation and the second shift operation; The performing the bitwise exclusive OR operation on the result after the shift operation to obtain the result after the second operation includes: The bitwise exclusive OR operation is performed on the second affine transformation result, the first shift operation result, and the second shift operation result to obtain a result after the second operation processing.

10. The method according to any one of claims 1 to 3, characterized in that The composite domain is GF(2 4 ) 2 The finite field of the block cipher algorithm is GF(2 8 ).

11. An electronic device, characterized in that: include: processor; A memory for storing a computer program, wherein the computer program is executed by a processor to perform the method according to any one of claims 1 to 10.

Images