SM4 algorithm rapid implementation method and system based on hardware extension instruction set

Abstract

The invention provides an SM4 algorithm rapid implementation method and system based on a hardware extension instruction set, and the method comprises the steps: inputting a key according to 128 bits, and extending the key into a round key RK; performing data conversion on the round key RK to obtain a converted round key; the 16 input SM4 data blocks are cut and converted to obtain converted plaintext data; 32 rounds of iteration are carried out on the converted round key and plaintext data, an AVX512 instruction set instruction is used for achieving affine transformation to convert the data from a finite field where SM4 is located to a finite field where AES is located, then a VAES instruction set instruction is used for executing S box operation in the AES, and then the AVX512 instruction set instruction is used for achieving inverse affine transformation to convert the data from the finite field where the AES is located to the finite field where the SM4 is located; and performing large-end and small-end conversion on the data after the 32-round iteration process of the SM4 algorithm is executed again, taking out the data from the 512-bit register in a blocking manner, arranging the data into 16 blocks of ciphertexts corresponding to 16 blocks of plaintext data according to a specific sequence, and outputting the 16 blocks of ciphertexts.

Description

Technical Field

[0001] The present invention relates to the field of cryptographic technology, and in particular to a method and system for quickly implementing an SM4 algorithm based on a hardware extended instruction set. Background Art

[0002] The National Cryptography Administration publicly released the SM4 block encryption algorithm in 2006 and defined it as the national cryptography industry standard in 2012. Its block length and key length are both 128 bits. The encryption algorithm and key expansion algorithm of SM4 both use a 32-round nonlinear iterative structure. Its decryption algorithm has the same structure as the encryption algorithm, except that the order of using the round keys is reversed. The performance bottleneck of the SM4 block cipher algorithm lies in the 32-round nonlinear iterative process inside the encryption function.

[0003] Single Instruction Multiple Data (SIMD) is a technology that uses one controller to control multiple parallel processing elements, which can achieve data parallel computing. Mainstream processor platforms have launched SIMD hardware extension instruction sets, such as SSE, AVX, AVX2, AVX512, AES-NI, and VAES extension instruction sets under the x64 processor architecture platform. Such hardware extension instruction sets can be combined with parallel optimization technology to accelerate the encryption and decryption process of the SM4 algorithm. Summary of the invention

[0004] In view of the defects in the prior art, the purpose of the present invention is to provide a method and system for quickly implementing the SM4 algorithm based on a hardware extended instruction set.

[0005] According to the present invention, a method for quickly implementing an SM4 algorithm based on a hardware extended instruction set is provided, comprising:

[0006] Step S1: Input a key based on 128 bits and expand it into a round key RK;

[0007] Step S2: performing data conversion on the round key RK to obtain a converted round key, and representing the converted data with 32 512-bit ZMM registers;

[0008] Step S3: Cut and convert the input 16 SM4 data blocks to obtain converted plaintext data, and use 4 512-bit ZMM registers to store the data;

[0009] Step S4: perform 32 rounds of iterations on the converted round key and plaintext data, use AVX512 instruction set instructions to implement affine transformation to convert the data from the finite field where SM4 is located to the finite field where AES is located, then use VAES instruction set instructions to perform the S-box operation in AES, and then use AVX512 instruction set instructions to implement inverse affine transformation to convert the data from the finite field where AES is located back to the finite field where SM4 is located;

[0010] Step S5: re-convert the data after 32 rounds of iterations of the SM4 algorithm into big-endian and small-endian data and take them out from the 512-bit register in blocks, and arrange them into 16 blocks of ciphertext output corresponding to 16 blocks of plaintext data in a specific order.

[0011] Preferably, the step S1 comprises:

[0012] Step S1.1: Obtain a 128-bit SM4 key;

[0013] Step S1.2: Use the key expansion algorithm of the SM4 algorithm to expand the obtained 128-bit SM4 key into a round key RK = (rk0, rk1, ..., rk 31 ), where rk i The data size is 128 bits.

[0014] Preferably, step S2 comprises:

[0015] The round key RK is converted into data and represented by 32 512-bit ZMM registers, where the round key stored in the i-th register is RK′ i =(rk i ,rk i ,rk i ,rk i );

[0016] The RK′ i =(rk i ,rk i ,rk i ,rk i ) Use the vpbroadcastd command to broadcast the 128-bit round key rk of round i i Pad 4 times to expand the data size to 512 bits.

[0017] Preferably, the step S3 comprises:

[0018] Step S3.1: For the 16 input SM4 data blocks D[0…15], where D[i] represents the i-th 128-bit data block, split them into units of 32 bits to obtain P[0…63], where D[i] = (P[4i], P[4i+1, P4i+2, P4i+3), 0≤i≤15;

[0019] Step S3.2: The split data P[0…63] are stored in four 512-bit ZMM registers t0, t1, t2, t3 respectively, where:

[0020] t0=(P[0],P[4],P[8],P

[12] ,P

[16] ,P

[20] ,P

[24] ,P

[28] ,

[0021] P

[32] ,P

[36] ,P

[40] ,P

[44] ,P

[48] ,P

[52] ,P

[56] ,P

[60] )

[0022] t1=(P[1],P[5],P[9],P

[13] ,P

[17] ,P

[21] ,P

[25] ,P

[29] ,

[0023] P

[33] ,P

[37] ,P

[41] ,P

[45] ,P

[49] ,P

[53] ,P

[57] ,P

[61] )

[0024] t2=(P[2],P[6],P

[10] ,P

[14] ,P

[18] ,P

[22] ,P

[26] ,P

[30] ,

[0025] P

[34] ,P

[38] ,P

[42] ,P

[46] ,P

[50] ,P

[54] ,P

[58] ,P

[62] )

[0026] t3=(P[3],P[7],P

[11] ,P

[15] ,P

[19] ,P

[23] ,P

[27] ,P

[31] ,

[0027] P

[35] ,P

[39] ,P

[43] ,P

[47] ,P

[51] ,P

[55] ,P

[59] ,P

[63] )

[0028] Step S3.3: The data in the four registers t0, t1, t2, and t3 are grouped into 32 bits, and the byte order of each group of 32 bits of data is rearranged using the vpshufb instruction. The result is as follows:

[0029] t0=(P′[0],P′[4],P′[8],P′

[12] ,P′

[16] ,P′

[20] ,P′

[24] ,P′

[28] ,

[0030] P′

[32] ,P′

[36] ,P′

[40] ,P′

[44] ,P′

[48] ,P′

[52] ,P′

[56] ,P′

[60] )

[0031] t1=(P′[1],P′[5],P′[9],P′

[13] ,P′

[17] ,P′

[21] ,P′

[25] ,P′

[29] ,

[0032] P′

[33] ,P′

[37] ,P′

[41] ,P′

[45] ,P′

[49] ,P′

[53] ,P′

[57] ,P′

[61] )

[0033] t2=(P′[2],P′[6],P′

[10] ,P′

[14] ,P′

[18] ,P′

[22] ,P′

[26] ,P′

[30] ,

[0034] P′

[34] ,P′

[38] ,P′

[42] ,P′

[46] ,P′

[50] ,P′

[54] ,P′

[58] ,P′

[62] )

[0035] t3=(P′[3],P′[7],P′

[11] ,P′

[15] ,P′

[19] ,P′

[23] ,P′

[27] ,P′

[31] ,

[0036] P′

[35] ,P′

[39] ,P′

[43] ,P′

[47] ,P′

[51] ,P′

[55] ,P′

[59] ,P′

[63] )

[0037] Among them, P ′ [i] is the result of converting the 32-bit data of P[i] to big-endian and small-endian.

[0038] Preferably, step S4 comprises:

[0039] Step S4.1: According to the SM4 algorithm theory, the converted round key and plaintext data need to be iterated for 32 rounds. In the i-th round of iteration, the round key RK′ obtained by the conversion of the round key data is converted using the vpxord instruction. i Perform an XOR operation with the data t1, t2, t3 obtained in the plaintext data conversion to obtain a 512-bit result x;

[0040] Step S4.2: Use the vpshufb instruction to perform an affine transformation on the result x, converting the data from the finite field where SM4 is located to the finite field where AES is located;

[0041] Step S4.3: Use vpshufb to perform a reverse shift operation on the result converted to the finite field where AES is located, and then use the vaesenclast instruction to perform an S-box lookup table replacement operation of the AES algorithm on the obtained result;

[0042] Step S4.4: Use the vpshufb instruction to perform an inverse affine transformation to convert the data from the finite field where AES is located back to the finite field where SM4 is located;

[0043] Step S4.5: Use the vpxord instruction, the vpshufb instruction, the vpslld instruction, and the vpsrld instruction to perform the L linear transformation of the SM4 algorithm on the result converted to the finite field where SM4 is located, where

[0044] Step S4.6: Use the vpxord instruction to perform an XOR operation on the result obtained after the linear transformation of L and the data t0 obtained in the plaintext data conversion to obtain a 512-bit final result x ′ ;

[0045] Step S4.7: Replace the data with the following values:

[0046] t0=t1

[0047] t1=t2

[0048] t2=t3

[0049] t3=x ′

[0050] Steps S4.1 to S4.7 are triggered repeatedly until 32 rounds of iterations are completed.

[0051] Preferably, step S5 comprises:

[0052] Step S5.1: The obtained four 512-bit register data t0, t1, t2, t3 are divided into blocks according to 32-bit data as a group, and re-constructed into F[0...63] in a specific order, where F[i] (0≤i≤63) is 32-bit length data, as shown below:

[0053] t0=(F[0],F[4],F[8],F

[12] ,F

[16] ,F

[20] ,F

[24] ,F

[28] ,

[0054] F

[32] ,F

[36] ,F

[40] ,F

[44] ,F

[48] ,F

[52] ,F

[56] ,F

[60] )

[0055] t1=(F[1],F[5],F[9],F

[13] ,F

[17] ,F

[21] ,F

[25] ,F

[29] ,

[0056] F

[33] ,F

[37] ,F

[41] ,F

[45] ,F

[49] ,F

[53] ,F

[57] ,F

[61] )

[0057] t2=(F[2],F[6],F

[10] ,F

[14] ,F

[18] ,F

[22] ,F

[26] ,F

[30] ,

[0058] F

[34] ,F

[38] ,F

[42] ,F

[46] ,F

[50] ,F

[54] ,F

[58] ,F

[62] )

[0059] t3=(F[3],F[7],F

[11] ,F

[15] ,F

[19] ,F

[23] ,F

[27] ,F

[31] ,

[0060] F

[35] ,F

[39] ,F

[43] ,F

[47] ,F

[51] ,F

[55] ,F

[59] ,F

[63] )

[0061] Step S5.2: The divided data t0, t1, t2, and t3 are all grouped as 32-bit data, and the vpshufb instruction is used to rearrange the byte order to achieve the big-endian and small-endian conversion effect. The result is as follows:

[0062] t0=(F′[0],F′[4],F′[8],F′

[12] ,F′

[16] ,F′

[20] ,F′

[24] ,F′

[28] ,

[0063] F′

[32] ,F′

[36] ,F′

[40] ,F′

[44] ,F′

[48] ,F′

[52] ,F′

[56] ,F′

[60] )

[0064] t1=(F′[1],F′[5],F′[9],F′

[13] ,F′

[17] ,F′

[21] ,F′

[25] ,F′

[29] ,

[0065] F′

[33] ,F′

[37] ,F′

[41] ,F′

[45] ,F′

[49] ,F′

[53] ,F′

[57] ,F′

[61] )

[0066] t2=(F′[2],F′[6],F′

[10] ,F′

[14] ,F′

[18] ,F′

[22] ,F′

[26] ,F′

[30] ,

[0067] F′

[34] ,F′

[38] ,F′

[42] ,F′

[46] ,F′

[50] ,F′

[54] ,F′

[58] ,F′

[62] )

[0068] t3=(F′[3],F′[7],F′

[11] ,F′

[15] ,F′

[19] ,F′

[23] ,F′

[27] ,F′

[31] ,

[0069] F′

[35] ,F′

[39] ,F′

[43] ,F′

[47] ,F′

[51] ,F′

[55] ,F′

[59] ,F′

[63] )

[0070] Among them, F ′ [i] is the result of converting the 32-bit data of F[i] to big-endian and small-endian.

[0071] Step S5.3: Data F ′ [0…63] is divided and arranged again according to the 128-bit data to obtain 16 ciphertext output blocks OUT[0…15] corresponding to the 16 input data blocks, where OUT[i]=(F ′ [4i],F ′ [4i+1],F ′ [4i+2,F′4i+3,0≤i≤15.

[0072] According to the present invention, a fast implementation system of an SM4 algorithm based on a hardware extended instruction set is provided, comprising:

[0073] Module M1: takes the 128-bit input key and expands it into the round key RK;

[0074] Module M2: convert the round key RK into data to obtain the converted round key, and represent the converted data with 32 512-bit ZMM registers;

[0075] Module M3: Cuts and converts the input 16 SM4 data blocks to obtain converted plaintext data, and uses four 512-bit ZMM registers to store the data;

[0076] Module M4: Perform 32 rounds of iterations on the converted round key and plaintext data, use AVX512 instruction set instructions to implement affine transformation to convert data from the finite field where SM4 is located to the finite field where AES is located, then use VAES instruction set instructions to perform S-box operations in AES, and then use AVX512 instruction set instructions to implement inverse affine transformation to convert data from the finite field where AES is located back to the finite field where SM4 is located;

[0077] Module M5: re-convert the data after 32 rounds of iteration of the SM4 algorithm into big-endian and small-endian data and take them out from the 512-bit register in blocks, and arrange them into 16 blocks of ciphertext corresponding to 16 blocks of plaintext data in a specific order for output.

[0078] Preferably, the module M1 comprises:

[0079] Module M1.1: Get 128-bit SM4 key;

[0080] Module M1.2: Use the key expansion algorithm of the SM4 algorithm to expand the obtained 128-bit SM4 key into a round key RK = (rk0, rk1, ..., rk 31 ), where rk i The data size is 128 bits;

[0081] The module M2 comprises:

[0082] The round key RK is converted into data and represented by 32 512-bit ZMM registers, where the round key stored in the i-th register is RK′ i =(rk i ,rk i ,rk i ,rk i );

[0083] The RK′ i =(rk i ,rk i ,rk i ,rk i ) Use the vpbroadcastd command to broadcast the 128-bit round key rk of round i i Pad 4 times to expand the data size to 512 bits.

[0084] Preferably, the module M3 comprises:

[0085] Module M3.1: For the 16 SM4 data blocks D[0…15] input, where D[i] represents the i-th 128-bit data block, split them into units of 32 bits to obtain P[0…63], where D[i] = (P[4i], P[4i+1, P4i+2, P4i+3), 0≤i≤15;

[0086] Module M3.2: Store the split data P[0…63] into four 512-bit ZMM registers t0, t1, t2, t3, where:

[0087] t0=(P[0],P[4],P[8],P

[12] ,P

[16] ,P

[20] ,P

[24] ,P

[28] ,

[0088] P

[32] ,P

[36] ,P

[40] ,P

[44] ,P

[48] ,P

[52] ,P

[56] ,P

[60] )

[0089] t1=(P[1],P[5],P[9],P

[13] ,P

[17] ,P

[21] ,P

[25] ,P

[29] ,

[0090] P

[33] ,P

[37] ,P

[41] ,P

[45] ,P

[49] ,P

[53] ,P

[57] ,P

[61] )

[0091] t2=(P[2],P[6],P

[10] ,P

[14] ,P

[18] ,P

[22] ,P

[26] ,P

[30] ,

[0092] P

[34] ,P

[38] ,P

[42] ,P

[46] ,P

[50] ,P

[54] ,P

[58] ,P

[62] )

[0093] t3=(P[3],P[7],P

[11] ,P

[15] ,P

[19] ,P

[23] ,P

[27] ,P

[31] ,

[0094] P

[35] ,P

[39] ,P

[43] ,P

[47] ,P

[51] ,P

[55] ,P

[59] ,P

[63] )

[0095] Module M3.3: The data in the four registers t0, t1, t2, and t3 are grouped into 32 bits. The vpshufb instruction is used to rearrange the byte order of each group of 32 bits of data. The results are as follows:

[0096] t0=(P′[0],P′[4],P′[8],P′

[12] ,P′

[16] ,P′

[20] ,P′

[24] ,P′

[28] ,

[0097] P′

[32] ,P′

[36] ,P′

[40] ,P′

[44] ,P′

[48] ,P′

[52] ,P′

[56] ,P′

[60] )

[0098] t1=(P′[1],P′[5],P′[9],P′

[13] ,P′

[17] ,P′

[21] ,P′

[25] ,P′

[29] ,

[0099] P′

[33] ,P′

[37] ,P′

[41] ,P′

[45] ,P′

[49] ,P′

[53] ,P′

[57] ,P′

[61] )

[0100] t2=(P′[2],P′[6],P′

[10] ,P′

[14] ,P′

[18] ,P′

[22] ,P′

[26] ,P′

[30] ,

[0101] P′

[34] ,P′

[38] ,P′

[42] ,P′

[46] ,P′

[50] ,P′

[54] ,P′

[58] ,P′

[62] )

[0102] t3=(P′[3],P′[7],P′

[11] ,P′

[15] ,P′

[19] ,P′

[23] ,P′

[27] ,P′

[31] ,

[0103] P′

[35] ,P′

[39] ,P′

[43] ,P′

[47] ,P′

[51] ,P′

[55] ,P′

[59] ,P′

[63] )

[0104] Among them, P ′ [i] is the result of converting the 32-bit data of P[i] to big-endian and small-endian.

[0105] Preferably, the module M4 comprises:

[0106] Module M4.1: According to the SM4 algorithm theory, it is necessary to perform 32 rounds of iterations on the converted round key and plaintext data. In the i-th round of iteration, the round key RK′ obtained by the conversion of the round key data is converted using the vpxord instruction. i Perform an XOR operation with the data t1, t2, t3 obtained in the plaintext data conversion to obtain a 512-bit result x;

[0107] Module M4.2: Use the vpshufb instruction to perform an affine transformation on the result x, converting the data from the finite field where SM4 is located to the finite field where AES is located;

[0108] Module M4.3: Use vpshufb to perform a reverse shift operation on the result converted to the finite field where AES is located, and then use the vaesenclast instruction to perform an S-box lookup table replacement operation of the AES algorithm on the result;

[0109] Module M4.4: Use the vpshufb instruction to perform an inverse affine transformation to convert data from the finite field where AES is located back to the finite field where SM4 is located;

[0110] Module M4.5: Use vpxord, vpshufb, vpslld, and vpsrld instructions to perform the L linear transformation of the SM4 algorithm on the result converted to the finite field where SM4 is located, where

[0111] Module M4.6: Use the vpxord instruction to perform an XOR operation on the result obtained after the linear transformation of L and the data t0 obtained in the plaintext data conversion to obtain the 512-bit final result x ′ ;

[0112] Module M4.7: Replace the data with the following values:

[0113] t0=t1

[0114] t1=t2

[0115] t2=t3

[0116] t3=x ′

[0117] Repeat triggering modules M4.1 to M4.7 until 32 rounds of iterations are completed;

[0118] The module M5 comprises:

[0119] Module M5.1: The obtained four 512-bit register data t0, t1, t2, t3 are divided into blocks according to 32-bit data as a group, and re-constructed into F[0...63] in a specific order, where F[i] (0≤i≤63) is 32-bit length data, as shown below:

[0120] t0=(F[0],F[4],F[8],F

[12] ,F

[16] ,F

[20] ,F

[24] ,F

[28] ,

[0121] F

[32] ,F

[36] ,F

[40] ,F

[44] ,F

[48] ,F

[52] ,F

[56] ,F

[60] )

[0122] t1=(F[1],F[5],F[9],F

[13] ,F

[17] ,F

[21] ,F

[25] ,F

[29] ,

[0123] F

[33] ,F

[37] ,F

[41] ,F

[45] ,F

[49] ,F

[53] ,F

[57] ,F

[61] )

[0124] t2=(F[2],F[6],F

[10] ,F

[14] ,F

[18] ,F

[22] ,F

[26] ,F

[30] ,

[0125] F

[34] ,F

[38] ,F

[42] ,F

[46] ,F

[50] ,F

[54] ,F

[58] ,F

[62] )

[0126] t3=(F[3],F[7],F

[11] ,F

[15] ,F

[19] ,F

[23] ,F

[27] ,F

[31] ,

[0127] F

[35] ,F

[39] ,F

[43] ,F

[47] ,F

[51] ,F

[55] ,F

[59] ,F

[63] )

[0128] Module M5.2: The divided data t0, t1, t2, and t3 are all grouped as 32-bit data. The vpshufb instruction is used to rearrange the byte order to achieve the big-endian and small-endian conversion effect. The results are as follows:

[0129] t0=(F′[0],F′[4],F′[8],F′

[12] ,F′

[16] ,F′

[20] ,F′

[24] ,F′

[28] ,

[0130] F′

[32] ,F′

[36] ,F′

[40] ,F′

[44] ,F′

[48] ,F′

[52] ,F′

[56] ,F′

[60] )

[0131] t1=(F′[1],F′[5],F′[9],F′

[13] ,F′

[17] ,F′

[21] ,F′

[25] ,F′

[29] ,

[0132] F′

[33] ,F′

[37] ,F′

[41] ,F′

[45] ,F′

[49] ,F′

[53] ,F′

[57] ,F′

[61] )

[0133] t2=(F′[2],F′[6],F′

[10] ,F′

[14] ,F′

[18] ,F′

[22] ,F′

[26] ,F′

[30] ,

[0134] F′

[34] ,F′

[38] ,F′

[42] ,F′

[46] ,F′

[50] ,F′

[54] ,F′

[58] ,F′

[62] )

[0135] t3=(F′[3],F′[7],F′

[11] ,F′

[15] ,F′

[19] ,F′

[23] ,F′

[27] ,F′

[31] ,

[0136] F′

[35] ,F′

[39] ,F′

[43] ,F′

[47] ,F′

[51] ,F′

[55] ,F′

[59] ,F′

[63] )

[0137] Among them, F ′ [i] is the result of converting the 32-bit data of F[i] to big-endian and small-endian.

[0138] Module M5.3: Data F ′[0…63] is divided and arranged again according to the 128-bit data to obtain 16 ciphertext output blocks OUT[0…15] corresponding to the 16 input data blocks, where OUT[i]=(F ′ [4i],F ′ [4i+1],F ′ [4i+2,F′4i+3,0≤i≤15.

[0139] Compared with the prior art, the present invention has the following beneficial effects:

[0140] 1. The present invention accelerates the SM4 algorithm by using SIMD hardware extended instruction set AVX512 and VAES, and supports parallel encryption of 16 data blocks;

[0141] 2. The present invention uses hardware extended instruction sets including AVX512 and VAES instruction sets, and combines parallelization technology to accelerate the SM4 algorithm, realize fast finite field affine transformation, and replaces the SM4 table lookup operation with the AES table lookup operation, so as to achieve the effect of parallel processing of 16 data blocks and improve the throughput of the SM4 algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0142] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0143] Figure 1 Flowchart of the method for quickly implementing the SM4 algorithm based on the hardware extended instruction set. DETAILED DESCRIPTION

[0144] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0145] Example 1

[0146] According to the present invention, a fast implementation method and system of the SM4 algorithm based on a hardware extended instruction set are provided, including: using a hardware extended instruction set including AVX512 and VAES instruction sets, and combining parallelization technology to accelerate the SM4 algorithm, to achieve fast finite field affine transformation, and to replace the SM4 table lookup operation with an AES table lookup operation, to achieve the effect of parallel processing of 16 data blocks, thereby improving the throughput of the SM4 algorithm.

[0147] The invention provides a fast implementation method of SM4 algorithm based on hardware extended instruction set, uses SIMD hardware extended instruction set AVX512 and VAES to accelerate the SM4 algorithm, and supports parallel encryption of 16 data blocks.

[0148] The SM4 algorithm fast implementation method based on the hardware extended instruction set is as follows: Figure 1 As shown, including:

[0149] Step 1: SM4 key expansion;

[0150] Specifically, according to the 128-bit input key, the key expansion algorithm of the SM4 algorithm is used to expand it into a round key RK=(rk0,rk1,…,rk 31 ), where rk i The data size is 128 bits.

[0151] Step 2: round key data conversion;

[0152] Specifically, the round key RK is converted into data and represented by 32 512-bit ZMM registers, where the round key stored in the i-th register is RK′ i =(rk i ,rk i ,rk i ,rk i ), that is, use the vpbroadcastd instruction (the corresponding intrinsic instruction is _mm512_set1_epi32) to fill the 128-bit round key of the i-th round 4 times and expand it to 512 bits of data size.

[0153] Step 3: Plaintext data conversion;

[0154] Specifically, the 16 input SM4 data blocks are cut and converted, and four 512-bit ZMM registers are used to store the data, which are recorded as t0, t1, t2, and t3 respectively, including:

[0155] Step 3.1: For the 16 input SM4 data blocks D[0…15], where D[i] represents the i-th 128-bit data block, split them into units of 32 bits in length to obtain P[0…63], where D[i] = (P[4i], P[4i+1, P4i+2, P4i+3), 0≤i≤15.

[0156] Step 3.2: Store the split data P[0…63] into four 512-bit ZMM registers t0, t1, t2, and t3 respectively, where

[0157] t0=(P[0],P[4],P[8],P

[12] ,P

[16] ,P

[20] ,P

[24] ,P

[28] ,

[0158] P

[32] ,P

[36] ,P

[40] ,P

[44] ,P

[48] ,P

[52] ,P

[56] ,P

[60] )

[0159] t1=(P[1],P[5],P[9],P

[13] ,P

[17] ,P

[21] ,P

[25] ,P

[29] ,

[0160] P

[33] ,P

[37] ,P

[41] ,P

[45] ,P

[49] ,P

[53] ,P

[57] ,P

[61] )

[0161] t2=(P[2],P[6],P

[10] ,P

[14] ,P

[18] ,P

[22] ,P

[26] ,P

[30] ,

[0162] P

[34] ,P

[38] ,P

[42] ,P

[46] ,P

[50] ,P

[54] ,P

[58] ,P

[62] )

[0163] t3=(P[3],P[7],P

[11] ,P

[15] ,P

[19] ,P

[23] ,P

[27] ,P

[31] ,

[0164] P

[35] ,P

[39] ,P

[43] ,P

[47] ,P

[51] ,P

[55] ,P

[59] ,P

[63] )

[0165] Step 3.3: Use the vpshufb instruction (corresponding to the intrinsic instruction _mm512_shuffle_epi8) to convert the data in the four registers t0, t1, t2, and t3 into big-endian and small-endian data in groups of 32 bits. That is, use the vpshufb instruction to rearrange the byte order of each group of 32-bit data. The result is as follows:

[0166] t0=(P′[0],P′[4],P′[8],P′

[12] ,P′

[16] ,P′

[20] ,P′

[24] ,P′

[28] ,

[0167] P′

[32] ,P′

[36] ,P′

[40] ,P′

[44] ,P′

[48] ,P′

[52] ,P′

[56] ,P′

[60] )

[0168] t1=(P′[1],P′[5],P′[9],P′

[13] ,P′

[17] ,P′

[21] ,P′

[25] ,P′

[29] ,

[0169] P′

[33] ,P′

[37] ,P′

[41] ,P′

[45] ,P′

[49] ,P′

[53] ,P′

[57] ,P′

[61] )

[0170] t2=(P′[2],P′[6],P′

[10] ,P′

[14] ,P′

[18] ,P′

[22] ,P′

[26] ,P′

[30] ,

[0171] P′

[34] ,P′

[38] ,P′

[42] ,P′

[46] ,P′

[50] ,P′

[54] ,P′

[58] ,P′

[62] )

[0172] t3=(P′[3],P′[7],P′

[11] ,P′

[15] ,P′

[19] ,P′

[23] ,P′

[27] ,P′

[31] ,

[0173] P′

[35] ,P′

[39] ,P′

[43] ,P′

[47] ,P′

[51] ,P′

[55] ,P′

[59] ,P′

[63] )

[0174] Among them, P ′ [i] is the result of converting the 32-bit data of P[i] to big-endian and small-endian.

[0175] Step 4: 32 rounds of iterations of the SM4 algorithm: Perform 32 rounds of iterations on the converted round key and plaintext data, use AVX512 instruction set instructions to implement affine transformation to convert the data from the finite field where SM4 is located to the finite field where AES is located, then use VAES instruction set instructions to perform the S-box operation in AES, and then use AVX512 instruction set instructions to implement inverse affine transformation to convert the data from the finite field where AES is located back to the finite field where SM4 is located; this process can be expressed by the following equation:

[0176]

[0177] A1(x) and A2(x) are the affine transformation and inverse affine transformation of the finite field where SM4 is located and the finite field where AES is located, respectively. M1 and M2 are two different 8*8 binary matrices, respectively. C1 and C2 are two 8-bit binary constants, respectively. SM4 and S AESThey represent the S-box table lookup replacement operations of the SM4 algorithm and the AES algorithm respectively. Given an 8-bit input, an 8-bit replacement data is output. This involves the multiplication operation of an 8*8 binary matrix and an 8-bit binary vector data. Since the matrix data is known, a lookup table can be constructed and simplified to a table lookup operation, which is implemented using the vpshufb instruction (the corresponding intrinsic instruction is _mm512_shuffle_epi8). Since the vpshufb instruction can only support 4-bit data as a lookup index, a matrix multiplication needs to be converted into two table lookups, one for the high-order 4-bit data operation lookup table and the other for the low-order 4-bit data operation lookup table.

[0178] With the help of two affine changes A1(x) and A2(x), the present invention can convert the S-box table lookup operation of SM4 into the AES table lookup operation, so the vaesenclast instruction (corresponding to the intrinsic instruction _mm512_aesenclast_epi128) can be used to accelerate the operation process; however, since the vaesenclast instruction further includes the row shift operation of AES, the vpshufb instruction needs to be used to perform the reverse row shift operation to offset the row shift operation in the vaesenclast instruction;

[0179] The 32-round iteration process of the SM4 algorithm specifically includes:

[0180] Step 4.1: According to the SM4 algorithm theory, the converted round key and plaintext data need to be iterated for 32 rounds. In the i-th round of iteration, the round key RK′ obtained by the conversion of the round key data is converted using the vpxord instruction (corresponding to the intrinsic instruction _mm512_xor_si512). i Perform an XOR operation with the data t1, t2, t3 obtained in the plaintext data conversion to obtain a 512-bit result x;

[0181] Step 4.2: Use the vpshufb instruction to perform an affine transformation on the result x obtained in step 4.1, and convert the data from the finite field where SM4 is located to the finite field where AES is located;

[0182] Step 4.3: Use vpshufb to perform a reverse shift operation on the result obtained in step 4.2, and then use the vaesenclast instruction to perform an S-box lookup table replacement operation of the AES algorithm on the obtained result;

[0183] Step 4.4: Use the vpshufb instruction to perform an inverse affine transformation on the result obtained in step 4.3, and convert the data from the finite field where AES is located back to the finite field where SM4 is located;

[0184] Step 4.5: Use the vpxord instruction, vpshufb instruction, vpslld instruction (corresponding to the intrinsic instruction _mm512_slli_epi32) and vpsrld instruction (corresponding to the intrinsic instruction _mm512_srli_epi32) to perform the L linear transformation of the SM4 algorithm on the result obtained in step 4.4, where

[0185] Step 4.6: Use the vpxord instruction to perform an XOR operation on the result obtained in step 4.5 and the data t0 obtained in the plaintext data conversion to obtain a 512-bit final result x ′ ;

[0186] Step 4.7: Replace the data with the following values:

[0187] t0=t1

[0188] t1=t2

[0189] t2=t3

[0190] t3=x ′

[0191] If the current number of iterations is less than 32, repeat steps 4.1 to 4.7, otherwise terminate the SM4 algorithm iteration.

[0192] Step 5: Ciphertext data integration: re-convert the data after executing the 32-round iteration process of the SM4 algorithm in step 4 into big-endian and small-endian, and take them out from the 512-bit register in blocks, and arrange them into 16 blocks of ciphertext output corresponding to 16 blocks of plaintext data in a specific order; the ciphertext data integration process specifically includes:

[0193] Step 5.1: First, the four 512-bit register data t0, t1, t2, t3 obtained in step 4 are divided into blocks according to 32-bit data as a group, and re-constructed into F[0...63] in a specific order, where F[i] (0≤i≤63) is 32-bit length data, as shown below:

[0194] t0=(F[0],F[4],F[8],F

[12] ,F

[16] ,F

[20] ,F

[24] ,F

[28] ,

[0195] F

[32] ,F

[36] ,F

[40] ,F

[44] ,F

[48] ,F

[52] ,F

[56] ,F

[60] )

[0196] t1=(F[1],F[5],F[9],F

[13] ,F

[17] ,F

[21] ,F

[25] ,F

[29] ,

[0197] F

[33] ,F

[37] ,F

[41] ,F

[45] ,F

[49] ,F

[53] ,F

[57] ,F

[61] )

[0198] t2=(F[2],F[6],F

[10] ,F

[14] ,F

[18] ,F

[22] ,F

[26] ,F

[30] ,

[0199] F

[34] ,F

[38] ,F

[42] ,F

[46] ,F

[50] ,F

[54] ,F

[58] ,F

[62] )

[0200] t3=(F[3],F[7],F

[11] ,F

[15] ,F

[19] ,F

[23] ,F

[27] ,F

[31] ,

[0201] F

[35] ,F

[39] ,F

[43] ,F

[47] ,F

[51] ,F

[55] ,F

[59] ,F

[63] )

[0202] Step 5.2: For the divided data t0, t1, t2, and t3, each of them is grouped into 32-bit data. Use the vpshufb instruction to rearrange the byte order to achieve the big-endian and small-endian conversion effect. The result is as follows:

[0203] t0=(F′[0],F′[4],F′[8],F′

[12] ,F′

[16] ,F′

[20] ,F′

[24] ,F′

[28] ,

[0204] F′

[32] ,F′

[36] ,F′

[40] ,F′

[44] ,F′

[48] ,F′

[52] ,F′

[56] ,F′

[60] )

[0205] t1=(F′[1],F′[5],F′[9],F′

[13] ,F′

[17] ,F′

[21] ,F′

[25] ,F′

[29] ,

[0206] F′

[33] ,F′

[37] ,F′

[41] ,F′

[45] ,F′

[49] ,F′

[53] ,F′

[57] ,F′

[61] )

[0207] t2=(F′[2],F′[6],F′

[10] ,F′

[14] ,F′

[18] ,F′

[22] ,F′

[26] ,F′

[30] ,

[0208] F′

[34] ,F′

[38] ,F′

[42] ,F′

[46] ,F′

[50] ,F′

[54] ,F′

[58] ,F′

[62] )

[0209] t3=(F′[3],F′[7],F′

[11] ,F′

[15] ,F′

[19] ,F′

[23] ,F′

[27] ,F′

[31] ,

[0210] F′

[35] ,F′

[39] ,F′

[43] ,F′

[47] ,F′

[51] ,F′

[55] ,F′

[59] ,F′

[63] )

[0211] Among them, F ′ [i] is the result of converting the 32-bit data of F[i] to big-endian and small-endian.

[0212] Step 5.3: The data F obtained after the conversion in step 5.2 ′ [0…63] is divided and arranged again according to the 128-bit data to obtain 16 ciphertext output blocks OUT[0…15] corresponding to the 16 input data blocks, where OUT[i]=(F ′ [4i],F ′ [4i+1],F ′ [4i+2],F ′ [4i+3]),(0≤i≤15).

[0213] The present invention also provides an SM4 algorithm rapid implementation system based on a hardware extended instruction set. The SM4 algorithm rapid implementation system based on a hardware extended instruction set can be implemented by executing the process steps of the SM4 algorithm rapid implementation method based on a hardware extended instruction set, that is, those skilled in the art can understand the SM4 algorithm rapid implementation method based on a hardware extended instruction set as a preferred implementation mode of the SM4 algorithm rapid implementation system based on a hardware extended instruction set.

[0214] Those skilled in the art know that, in addition to realizing the system and its various devices, modules, and units provided by the present invention in a purely computer-readable program code, it is entirely possible to realize the same functions in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered as a hardware component, and the devices, modules, and units included therein for realizing various functions can also be regarded as structures within the hardware component; the devices, modules, and units for realizing various functions can also be regarded as both software modules for realizing the method and structures within the hardware component.

[0215] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A fast implementation method of the SM4 algorithm based on a hardware extended instruction set, characterized in that: include: Step S1: Input a key based on 128 bits and expand it into a round key RK; Step S2: performing data conversion on the round key RK to obtain a converted round key, and representing the converted data with 32 512-bit ZMM registers; Step S3: Cut and convert the input 16 SM4 data blocks to obtain converted plaintext data, and use 4 512-bit ZMM registers to store the data; Step S4: perform 32 rounds of iterations on the converted round key and plaintext data, use AVX512 instruction set instructions to implement affine transformation to convert the data from the finite field where SM4 is located to the finite field where AES is located, then use VAES instruction set instructions to perform the S-box operation in AES, and then use AVX512 instruction set instructions to implement inverse affine transformation to convert the data from the finite field where AES is located back to the finite field where SM4 is located; Step S5: re-convert the data after 32 rounds of iterations of the SM4 algorithm into big-endian and small-endian data and take them out from the 512-bit register in blocks, and arrange them into 16 blocks of ciphertext output corresponding to 16 blocks of plaintext data in a specific order.

2. The method for quickly implementing the SM4 algorithm based on the hardware extended instruction set according to claim 1, characterized in that: The step S1 comprises: Step S1.1: Obtain a 128-bit SM4 key; Step S1.2: Use the key expansion algorithm of the SM4 algorithm to expand the obtained 128-bit SM4 key into a round key RK = (rk0, rk1, ..., rk 31 ), where rk i The data size is 128 bits.

3. The method for quickly implementing the SM4 algorithm based on the hardware extended instruction set according to claim 1, characterized in that: The step S2 comprises: The round key RK is converted into data and represented by 32 512-bit ZMM registers, where the round key stored in the i-th register is RK′ i =(rk i ,rk i ,rk i ,rk i ); The RK′ i =(rk i ,rk i ,rk i ,rk i ) Use the vpbroadcastd command to broadcast the 128-bit round key rk of round i i Pad 4 times to expand the data size to 512 bits.

4. The method for quickly implementing the SM4 algorithm based on the hardware extended instruction set according to claim 1, characterized in that: The step S3 comprises: Step S3.1: For the 16 input SM4 data blocks D[0…15], where D[i] represents the i-th 128-bit data block, split them into units of 32 bits to obtain P[0…63], where D[i] = (P[4i], P[4i+1], P[4i+2], P[4i+3]), (0≤i≤15); Step S3.2: The split data P[0…63] are stored in four 512-bit ZMM registers t0, t1, t2, t3 respectively, where: t0=(P[0],P[4],P[8],P[12],P[16],P[20],P[24],P[28], P[32],P[36],P[40],P[44],P[48],P[52],P[56],P[60]) t1=(P[1],P[5],P[9],P[13],P[17],P[21],P[25],P[29], P[33],P[37],P[41],P[45],P[49],P[53],P[57],P[61]) t2=(P[2],P[6],P[10],P[14],P[18],P[22],P[26],P[30], P[34],P[38],P[42],P[46],P[50],P[54],P[58],P[62]) t3=(P[3],P[7],P[11],P[15],P[19],P[23],P[27],P[31], P[35],P[39],P[43],P[47],P[51],P[55],P[59],P[63]) Step S3.3: The data in the four registers t0, t1, t2, and t3 are grouped into 32 bits, and the byte order of each group of 32 bits of data is rearranged using the vpshufb instruction. The result is as follows: t0=(P′[0],P′[4],P′[8],P′[12],P′[16],P′[20],P′[24],P′[28], P′[32],P′[36],P′[40],P′[44],P′[48],P′[52],P′[56],P′[60]) t1=(P′[1],P′[5],P′[9],P′[13],P′[17],P′[21],P′[25],P′[29], P′[33],P′[37],P′[41],P′[45],P′[49],P′[53],P′[57],P′[61]) t2=(P′[2],P′[6],P′[10],P′[14],P′[18],P′[22],P′[26],P′[30], P′[34],P′[38],P′[42],P′[46],P′[50],P′[54],P′[58],P′[62]) t3=(P′[3],P′[7],P′[11],P′[15],P′[19],P′[23],P′[27],P′[31], P′[35],P′[39],P′[43],P′[47],P′[51],P′[55],P′[59],P′[63]) Among them, P ′ [i] is the result of converting the 32-bit data of P[i] to big-endian and small-endian.

5. The method for quickly implementing the SM4 algorithm based on the hardware extended instruction set according to claim 1, characterized in that: The step S4 comprises: Step S4.1: According to the SM4 algorithm theory, the converted round key and plaintext data need to be iterated for 32 rounds. In the i-th round of iteration, the round key RK′ obtained by the conversion of the round key data is converted using the vpxord instruction. i Perform an XOR operation with the data t1, t2, t3 obtained in the plaintext data conversion to obtain a 512-bit result x; Step S4.2: Use the vpshufb instruction to perform an affine transformation on the result x, converting the data from the finite field where SM4 is located to the finite field where AES is located; Step S4.3: Use vpshufb to perform a reverse shift operation on the result converted to the finite field where AES is located, and then use the vaesenclast instruction to perform an S-box lookup table replacement operation of the AES algorithm on the obtained result; Step S4.4: Use the vpshufb instruction to perform an inverse affine transformation to convert the data from the finite field where AES is located back to the finite field where SM4 is located; Step S4.5: Use the vpxord instruction, the vpshufb instruction, the vpslld instruction, and the vpsrld instruction to perform the L linear transformation of the SM4 algorithm on the result converted to the finite field where SM4 is located, where Step S4.6: Use the vpxord instruction to perform an XOR operation on the result obtained after the linear transformation of L and the data t0 obtained in the plaintext data conversion to obtain a 512-bit final result x ′ ; Step S4.7: Replace the data with the following values: t0=t1 t1=t2 t2=t3 t3=x ′ Steps S4.1 to S4.7 are triggered repeatedly until 32 rounds of iterations are completed.

6. The method for quickly implementing the SM4 algorithm based on the hardware extended instruction set according to claim 1, characterized in that: The step S5 comprises: Step S5.1: The obtained four 512-bit register data t0, t1, t2, t3 are divided into blocks according to 32-bit data as a group, and re-constructed into F[0...63] in a specific order, where F[i] (0≤i≤63) is 32-bit length data, as shown below: t0=(F[0],F[4],F[8],F[12],F[16],F[20],F[24],F[28], F[32],F[36],F[40],F[44],F[48],F[52],F[56],F[60]) t1=(F[1],F[5],F[9],F[13],F[17],F[21],F[25],F[29], F[33],F[37],F[41],F[45],F[49],F[53],F[57],F[61]) t2=(F[2],F[6],F[10],F[14],F[18],F[22],F[26],F[30], F[34],F[38],F[42],F[46],F[50],F[54],F[58],F[62]) t3=(F[3],F[7],F[11],F[15],F[19],F[23],F[27],F[31], F[35],F[39],F[43],F[47],F[51],F[55],F[59],F[63]) Step S5.2: The divided data t0, t1, t2, and t3 are all grouped as 32-bit data, and the vpshufb instruction is used to rearrange the byte order to achieve the big-endian and small-endian conversion effect. The result is as follows: t0=(F′[0],F′[4],F′[8],F′[12],F′[16],F′[20],F′[24],F′[28], F′[32],F′[36],F′[40],F′[44],F′[48],F′[52],F′[56],F′[60]) t1=(F′[1],F′[5],F′[9],F′[13],F′[17],F′[21],F′[25],F′[29], F′[33],F′[37],F′[41],F′[45],F′[49],F′[53],F′[57],F′[61]) t2=(F′[2],F′[6],F′[10],F′[14],F′[18],F′[22],F′[26],F′[30], F′[34],F′[38],F′[42],F′[46],F′[50],F′[54],F′[58],F′[62]) t3=(F′[3],F′[7],F′[11],F′[15],F′[19],F′[23],F′[27],F′[31], F′[35],F′[39],F′[43],F′[47],F′[51],F′[55],F′[59],F′[63]) Among them, F ′ [i] is the result of converting the 32-bit data of F[i] to big-endian and small-endian. Step S5.3: Data F ′ [0…63] is divided and arranged again according to the 128-bit data to obtain 16 ciphertext output blocks OUT[0…15] corresponding to the 16 input data blocks, where OUT[i]=(F ′ [4i],F ′ [4i+1],F ′ [4i+2,F′4i+3,0≤i≤15.

7. A fast implementation system of SM4 algorithm based on hardware extended instruction set, characterized in that: include: Module M1: takes the 128-bit input key and expands it into the round key RK; Module M2: performs data conversion on the round key RK to obtain a converted round key, and represents the converted data with 32 512-bit ZMM registers; Module M3: Cuts and converts the input 16 SM4 data blocks to obtain converted plaintext data, and uses four 512-bit ZMM registers to store the data; Module M4: Perform 32 rounds of iterations on the converted round key and plaintext data, use AVX512 instruction set instructions to implement affine transformation to convert data from the finite field where SM4 is located to the finite field where AES is located, then use VAES instruction set instructions to perform S-box operations in AES, and then use AVX512 instruction set instructions to implement inverse affine transformation to convert data from the finite field where AES is located back to the finite field where SM4 is located; Module M5: re-convert the data after 32 rounds of iteration of the SM4 algorithm into big-endian and small-endian data and take them out from the 512-bit register in blocks, and arrange them into 16 blocks of ciphertext corresponding to 16 blocks of plaintext data in a specific order for output.

8. The SM4 algorithm fast implementation system based on hardware extended instruction set according to claim 7, characterized in that: The module M1 comprises: Module M1.1: Get 128-bit SM4 key; Module M1.2: Use the key expansion algorithm of the SM4 algorithm to expand the obtained 128-bit SM4 key into a round key RK = (rk0, rk1, ..., rk 31 ), where rk i The data size is 128 bits; The module M2 comprises: The round key RK is converted into data and represented by 32 512-bit ZMM registers, where the round key stored in the i-th register is RK′ i =(rk i ,rk i ,rk i ,rk i ); The RK′ i =(rk i ,rk i ,rk i ,rk i ) Use the vpbroadcastd command to broadcast the 128-bit round key rk of round i i Pad 4 times to expand the data size to 512 bits.

9. The SM4 algorithm fast implementation system based on hardware extended instruction set according to claim 7, characterized in that: The module M3 comprises: Module M3.1: For the 16 SM4 data blocks D[0…15] input, where D[i] represents the i-th 128-bit data block, split them into units of 32 bits to obtain P[0…63], where D[i] = (P[4i], P[4i+1, P4i+2, P4i+3), 0≤i≤15; Module M3.2: Store the split data P[0…63] into four 512-bit ZMM registers t0, t1, t2, t3, where: t0=(P[0],P[4],P[8],P[12],P[16],P[20],P[24],P[28], P[32],P[36],P[40],P[44],P[48],P[52],P[56],P[60]) t1=(P[1],P[5],P[9],P[13],P[17],P[21],P[25],P[29], P[33],P[37],P[41],P[45],P[49],P[53],P[57],P[61]) t2=(P[2],P[6],P[10],P[14],P[18],P[22],P[26],P[30], P[34],P[38],P[42],P[46],P[50],P[54],P[58],P[62]) t3=(P[3],P[7],P[11],P[15],P[19],P[23],P[27],P[31], P[35],P[39],P[43],P[47],P[51],P[55],P[59],P[63]) Module M3.3: The data in the four registers t0, t1, t2, and t3 are grouped into 32 bits. The vpshufb instruction is used to rearrange the byte order of each group of 32 bits of data. The results are as follows: t0=(P′[0],P′[4],P′[8],P′[12],P′[16],P′[20],P′[24],P′[28], P′[32],P′[36],P′[40],P′[44],P′[48],P′[52],P′[56],P′[60]) t1=(P′[1],P′[5],P′[9],P′[13],P′[17],P′[21],P′[25],P′[29], P′[33],P′[37],P′[41],P′[45],P′[49],P′[53],P′[57],P′[61]) t2=(P′[2],P′[6],P′[10],P′[14],P′[18],P′[22],P′[26],P′[30], P′[34],P′[38],P′[42],P′[46],P′[50],P′[54],P′[58],P′[62]) t3=(P′[3],P′[7],P′[11],P′[15],P′[19],P′[23],P′[27],P′[31], P′[35],P′[39],P′[43],P′[47],P′[51],P′[55],P′[59],P′[63]) Among them, P ′ [i] is the result of converting the 32-bit data of P[i] to big-endian and small-endian.

10. The SM4 algorithm fast implementation system based on hardware extended instruction set according to claim 7, characterized in that: The module M4 comprises: Module M4.1: According to the SM4 algorithm theory, it is necessary to perform 32 rounds of iterations on the converted round key and plaintext data. In the i-th round of iteration, the round key RK′ obtained by the conversion of the round key data is converted using the vpxord instruction. i Perform an XOR operation with the data t1, t2, t3 obtained in the plaintext data conversion to obtain a 512-bit result x; Module M4.2: Use the vpshufb instruction to perform an affine transformation on the result x, converting the data from the finite field where SM4 is located to the finite field where AES is located; Module M4.3: Use vpshufb to perform a reverse shift operation on the result converted to the finite field where AES is located, and then use the vaesenclast instruction to perform an S-box lookup table replacement operation of the AES algorithm on the result; Module M4.4: Use the vpshufb instruction to perform an inverse affine transformation to convert data from the finite field where AES is located back to the finite field where SM4 is located; Module M4.5: Use vpxord, vpshufb, vpslld, and vpsrld instructions to perform the L linear transformation of the SM4 algorithm on the result converted to the finite field where SM4 is located, where Module M4.6: Use the vpxord instruction to perform an XOR operation on the result obtained after the linear transformation of L and the data t0 obtained in the plaintext data conversion to obtain the 512-bit final result x ′ ; Module M4.7: Replace the data with the following values: t0=t1 t1=t2 t2=t3 t3=x ′ Repeat triggering modules M4.1 to M4.7 until 32 rounds of iterations are completed; The module M5 comprises: Module M5.1: The obtained four 512-bit register data t0, t1, t2, t3 are divided into blocks according to 32-bit data as a group, and re-constructed into F[0...63] in a specific order, where F[i] (0≤i≤63) is 32-bit length data, as shown below: t0=(F[0],F[4],F[8],F[12],F[16],F[20],F[24],F[28], F[32],F[36],F[40],F[44],F[48],F[52],F[56],F[60]) t1=(F[1],F[5],F[9],F[13],F[17],F[21],F[25],F[29], F[33],F[37],F[41],F[45],F[49],F[53],F[57],F[61]) t2=(F[2],F[6],F[10],F[14],F[18],F[22],F[26],F[30], F[34],F[38],F[42],F[46],F[50],F[54],F[58],F[62]) t3=(F[3],F[7],F[11],F[15],F[19],F[23],F[27],F[31], F[35],F[39],F[43],F[47],F[51],F[55],F[59],F[63]) Module M5.2: The divided data t0, t1, t2, and t3 are all grouped as 32-bit data. The vpshufb instruction is used to rearrange the byte order to achieve the big-endian and small-endian conversion effect. The results are as follows: t0=(F′[0],F′[4],F′[8],F′[12],F′[16],F′[20],F′[24],F′[28], F′[32],F′[36],F′[40],F′[44],F′[48],F′[52],F′[56],F′[60]) t1=(F′[1],F′[5],F′[9],F′[13],F′[17],F′[21],F′[25],F′[29], F′[33],F′[37],F′[41],F′[45],F′[49],F′[53],F′[57],F′[61]) t2=(F′[2],F′[6],F′[10],F′[14],F′[18],F′[22],F′[26],F′[30], F′[34],F′[38],F′[42],F′[46],F′[50],F′[54],F′[58],F′[62]) t3=(F′[3],F′[7],F′[11],F′[15],F′[19],F′[23],F′[27],F′[31], F′[35],F′[39],F′[43],F′[47],F′[51],F′[55],F′[59],F′[63]) Among them, F ′ [i] is the result of converting the 32-bit data of F[i] to big-endian and small-endian. Module M5.3: Data F ′ [0…63] is divided and arranged again according to the 128-bit data to obtain 16 ciphertext output blocks OUT[0…15] corresponding to the 16 input data blocks, where OUT[i]=(F ′ [4i],F ′ [4i+1],F ′ [4i+2,F′4i+3,0≤i≤15.

Images