Data processing method, device, circuit and equipment based on SHA3

Abstract

The invention provides an SHA3-based data processing method, device, circuit and equipment, and the method comprises the steps: obtaining a target message carrying a mask, dividing the target message into a plurality of message blocks, sequentially inputting each message block into a sponge structure, and carrying out the iteration, the method comprises the steps that a message block and current mask information are spliced, then iteration is conducted on the spliced message block and current encrypted information, updated encrypted information and updated mask information are output, finally, an output result of a specified bit segment is intercepted from the encrypted information updated each time, and an encryption result is updated based on the output result. And generating an anti-leakage hash value based on the updated encryption result. According to the method, the input and the intermediate state of the sponge structure each time are randomized through the dynamically updated mask information, so that a real data processing path is effectively masked, a key or original data is prevented from being restored through side channel attack, the risk of information leakage is reduced, and the method has the capability of resisting side channel attack in the whole process.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a data processing method, device, circuit and equipment based on SHA3. Background Art

[0002] Hash algorithms are primarily used in security fields such as data digest calculation, digital signature verification, and message authentication. They are crucial components of cryptographic implementation and key exchange. The SHA3 algorithm, the latest hash algorithm, was introduced in 2015. Its core computational method employs a sponge-like structure, consisting of two phases: water absorption and water expulsion.

[0003] However, during the operation of the SHA3 algorithm, a large amount of side information will be generated in the two stages of water absorption and water squeezing. Through side-channel attacks, the original message and intermediate variable values ​​can be analyzed and deduced, resulting in the risk of information leakage during the operation of the SHA3 algorithm. Summary of the Invention

[0004] The present application provides a data processing method, apparatus, circuit, and device based on SHA3. Through dynamically updated mask information, the input and intermediate state of each sponge structure are randomized, effectively concealing the true data processing path, preventing the restoration of keys or original data through side-channel attacks, and reducing the risk of information leakage.

[0005] In a first aspect, the present application provides a data processing method based on SHA3, the method comprising: Obtaining a target message carrying a mask, and performing padding and block processing on the target message to obtain multiple message blocks; Inputting each of the message blocks into the sponge structure in sequence, so that the message block is spliced ​​with the current mask information and then iterated with the current encryption information, outputting updated encryption information and updated mask information, wherein the current mask information and the current encryption information are generated after the previous iteration of the message block, the mask information corresponding to the first message block is generated based on the set initial mask, and the encryption information corresponding to the first message block is generated based on the all-zero matrix; The output result of the specified bit segment is intercepted in the encrypted information after each update, and the output result is spliced ​​with the encryption result corresponding to the previous message block to update the encryption result. The iteration is stopped until the encryption result is greater than the specified length, and a leakage-resistant hash value is generated based on the encryption result. The encryption result of the first message block is the output result of the first message block.

[0006] The step of performing padding and block processing on the target message to obtain multiple message blocks includes: Filling the bit length of the target message to an integer multiple of a preset bit length, and masking the filled data to obtain a first message; The first message is switched into a plurality of message blocks, and the bit length of each of the message blocks is the preset bit length.

[0007] The step of sequentially inputting each of the message blocks into the sponge structure so as to splice the message block with the current mask information and then iterate with the current encryption information includes: Each of the message blocks is input into the sponge structure in turn, so that after the message block is spliced ​​with the current mask information, an XOR operation is performed with the current mask information and the current encryption information to generate input parameters of the permutation function, and the input parameters are input into the permutation function for iteration.

[0008] The permutation function iterates the input parameters in the following manner: generating target encrypted information of a preset bit length based on the input parameters; Respectively converting the target encrypted information and the current mask information into a plurality of message matrices and a plurality of mask matrices, wherein the message matrices and the mask matrices have the same data structure; Column diffusion, displacement and row permutation, nonlinear transformation, round constant injection and state reorganization are synchronously performed on the plurality of message matrices and the plurality of mask matrices to generate updated encryption information and updated mask information.

[0009] The synchronously performing column diffusion, displacement and row permutation, nonlinear transformation, round constant injection, and state reorganization on the plurality of message matrices and the plurality of mask matrices includes: Synchronously performing an XOR digest on each column of data of each message matrix and each column of data of each mask matrix to perform matrix updating, thereby obtaining a first matrix corresponding to each message matrix and a second matrix corresponding to each mask matrix; Performing cyclic shifts, row rearrangements, and row-by-row logical operations on each of the first matrices and each of the second matrices according to predefined rules to obtain a third matrix corresponding to each of the first matrices and a fourth matrix corresponding to each of the second matrices; A first third matrix among the plurality of the third matrices is XORed with a round constant and then recombined to generate updated encryption information, and a first fourth matrix among the plurality of the fourth matrices is XORed with the round constant and then recombined to generate updated mask information.

[0010] The step of concatenating the output result with the encryption result corresponding to the previous message block to update the encryption result, stopping iteration after the encryption result exceeds a specified length, and generating a leakage-resistant hash value based on the encryption result includes: splicing the output result with the encryption result corresponding to the previous message block to update the encryption result, and determining the bit length of the updated encryption result; If the bit length of the encryption result is greater than a specified length, stop inputting the message block into the sponge structure and generate a leakage-resistant hash value based on the encryption result; In a case where the bit length of the encryption result is less than or equal to the specified length, the current encryption information is demasked for use in the iteration of the next message block, and the next message block is continuously input into the sponge structure.

[0011] The step of generating a leakage-resistant hash value based on the encryption result includes: intercepting the message mask value of the specified length from the updated encryption result, and synchronously intercepting the mask block of the specified length from the current mask information; An XOR operation is performed on the message mask value and the mask block to obtain an anti-leakage hash value.

[0012] In a second aspect, the present application provides a data processing device based on SHA3, the device comprising: a message segmentation module configured to obtain a target message carrying a mask, and perform padding and block processing on the target message to obtain a plurality of message blocks; a message iteration module configured to sequentially input each message block into a sponge structure, so that the message block is concatenated with the current mask information and then iterated with the current encryption information, outputting updated encryption information and updated mask information, wherein the current mask information and the current encryption information are generated after the previous message block iteration, the mask information corresponding to the first message block is generated based on a set initial mask, and the encryption information corresponding to the first message block is generated based on an all-zero matrix; The result output module is configured to intercept the output result of a specified bit segment in the encrypted information after each update, splice the output result with the encryption result corresponding to the previous message block to update the encryption result, stop iteration after the encryption result is greater than the specified length, generate a leakage-resistant hash value based on the encryption result, and the encryption result of the first message block is the output result of the first message block.

[0013] In a third aspect, the present application provides a SHA3-based data processing circuit, comprising a universal interface module, a logic control module, a universal operation module, and a universal data storage module, wherein the universal interface module is connected to the logic control module and the universal data storage module, the logic control module is connected to the universal operation module, and the universal operation module is connected to the universal data storage module; The universal interface module is configured to connect to the processor, receive a target message carrying a mask from the processor, and transmit the target message to the universal data storage module; and receive a control signal sent by the processor, and transmit the control signal to the logic control module; The universal data storage module is configured to store the target message and the set initial mask; The logic control module is configured to receive the control signal, convert the control signal into a control instruction, and send the control instruction to the general operation module; The general operation module is configured to read and write data in the general data storage module, and execute or suspend the SHA3-based data processing method described in the first aspect based on the control instruction sent by the logic control module.

[0014] In a fourth aspect, the present application provides a SHA3-based data processing device, comprising a processor and the SHA3-based data processing circuit described in the third aspect.

[0015] As mentioned above, the present application provides a data processing method, device, circuit and equipment based on SHA3. After obtaining the target message carrying the mask, the present application divides the target message into multiple message blocks, and inputs each message block into the sponge structure in turn for iteration, so that the message block is spliced ​​with the current mask information and then iterated with the current encryption information, outputs the updated encryption information and the updated mask information, and finally intercepts the output result of the specified bit segment in each updated encryption information, and updates the encryption result based on the output result, and generates a leakage-resistant hash value based on the updated encryption result. The present application randomizes the input and intermediate state of the sponge structure each time through dynamically updated mask information, thereby effectively concealing the real data processing path, preventing the key or original data from being restored through side channel attacks, reducing the risk of information leakage, and having the ability to resist side channel attacks throughout the entire process, solving the technical problem that the existing SHA3 algorithm has the risk of information leakage during the operation process. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flowchart of a data processing method based on SHA3 is provided in an embodiment of the present invention.

[0017] Figure 2A schematic diagram of 24 rounds of transformation of a message matrix by a permutation function provided in an embodiment of the present invention.

[0018] Figure 3 A schematic diagram of 24 rounds of transformations of a mask matrix using a permutation function provided in an embodiment of the present invention.

[0019] Figure 4 A schematic structural diagram of a SHA3-based data processing device provided in an embodiment of the present invention.

[0020] Figure 5 A schematic diagram of the structure of a SHA3-based data processing circuit provided in an embodiment of the present invention.

[0021] Figure 6 A schematic diagram of the structure of another SHA3-based data processing circuit provided by an embodiment of the present invention.

[0022] Figure 7 A schematic diagram of the structure of a SHA3-based data processing device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The following description and accompanying drawings sufficiently illustrate specific embodiments of the present application to enable those skilled in the art to practice them. The examples represent only possible variations. Unless expressly required, individual components and functions are optional, and the order of operations may vary. Portions and features of some embodiments may be included in or replace portions and features of other embodiments. The scope of the embodiments of the present application includes the entire scope of the claims, as well as all available equivalents of the claims. Herein, each embodiment may be referred to individually or collectively by the term "invention," which is merely for convenience and is not intended to automatically limit the scope of the application to any single invention or inventive concept if more than one invention is in fact disclosed. Herein, relational terms such as first and second, etc., are used solely to distinguish one entity or operation from another, and do not require or imply any actual relationship or order between these entities or operations. Furthermore, the terms "comprise," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, or apparatus comprising a set of elements includes not only those elements, but also other elements not explicitly listed. The various embodiments herein are described in a progressive manner, with each embodiment focusing on the differences from the other embodiments. Reference can be made to the common and similar parts between the various embodiments. For structures, products, etc. disclosed in the embodiments, the description is relatively simple because they correspond to the parts disclosed in the embodiments. For relevant parts, refer to the method description.

[0024] like Figure 1 As shown,Figure 1 This is a flow chart of a SHA3-based data processing method provided in an embodiment of the present invention. The SHA3-based data processing method provided in an embodiment of the present invention can be executed by a SHA3-based data processing circuit. The SHA3-based data processing circuit can be implemented in software and / or hardware. The SHA3-based data processing circuit can be composed of two or more physical entities or a single physical entity. The SHA3-based data processing method provided in an embodiment of the present invention includes the following steps: Step 101: Obtain a target message carrying a mask, and perform padding and block processing on the target message to obtain multiple message blocks.

[0025] In this embodiment, a masked target message is first obtained. For example, the target message can be a masked bit string N. The target message can be actively input into the SHA3-based data processing circuit by the user, or obtained from a designated address or server. The specific acquisition method can be configured according to actual needs. After obtaining the target message, it is further padded with data and then divided into blocks to obtain multiple message blocks of a preset bit length. It is understandable that because the subsequent sponge structure algorithm uses a fixed bit rate as a processing unit, the target message must be divided into multiple message blocks of a fixed bit length (preset bit length) to meet the computational requirements of the sponge structure.

[0026] Based on the above embodiment, in step 101, the target message is padded and divided into blocks to obtain multiple message blocks, including: Step 1011: Fill the bit length of the target message to an integer multiple of the preset bit length, and mask the filled data to obtain a first message.

[0027] Since the original bit length of the target message is usually not an integer multiple of the preset bit length required by the sponge structure, it is first necessary to fill the bit length of the target message to an integer multiple of the preset bit length to facilitate subsequent segmentation. When filling the target message, a specific bit sequence (such as "1" followed by multiple "0") can be added to align the total length of the target message with a multiple of the preset bit length to ensure that there is no residue in the block processing, or the target message can be filled with a pad function, which is a commonly used padding operation in data processing. It is implemented in different programming frameworks and libraries, and its core function is to expand the boundaries of arrays, tensors, or strings to meet specific needs. After filling the target message, for the newly filled data, a dynamic mask needs to be generated for the newly added data. m new , dynamic mask m newIt can be generated in real time by a linear feedback shift register (LFSR) or a pseudo-random number generator to ensure unpredictability. m new The newly filled data is masked, and the first message can be obtained after the masking is completed.

[0028] Step 1012: Switch the first message into multiple message blocks, where the bit length of each message block is a preset bit length.

[0029] For the first message, it is necessary to divide the first message into multiple message blocks according to the preset bit length, and each message block has a preset bit length. For example, the preset bit length in this embodiment may be 1600 bits.

[0030] Step 102: Input each message block into the sponge structure in turn, so that the message block is spliced ​​with the current mask information and then iterated with the current encryption information, and output the updated encryption information and the updated mask information. The current mask information and the current encryption information are generated after the previous message block iteration. The mask information corresponding to the first message block is generated based on the set initial mask, and the encryption information corresponding to the first message block is generated based on the all-zero matrix.

[0031] After the target message is padded and split into multiple message blocks, each message block is sequentially input into the sponge structure. The sponge structure is the core design of SHA3. It processes inputs of arbitrary length through two stages: absorption and compression, and outputs a digest of a specified length. The specific structure of the sponge structure can be referenced in the prior art and will not be further described in this embodiment. Specifically, after a message block is input into the sponge structure, it is concatenated with the current mask information, then XORed with the current encryption information. The result of the XOR operation is then fed into a permutation function for iterative calculations, so that the permutation function outputs the updated encryption state as the new encryption information and the updated mask state as the new mask information. The current mask information and the current encryption information are the mask information and encryption information generated by the previous message block after iterative input into the sponge structure. The mask information corresponding to the first message block is generated based on a set initial mask. The initial mask can be generated by a random number generator with multiple sets of random numbers, each consisting of 1600 bits. Furthermore, the encryption information corresponding to the first message block is generated based on an all-zero matrix.

[0032] Based on the above embodiment, in step 102, each message block is sequentially input into the sponge structure so that the message block is concatenated with the current mask information and then iterated with the current encrypted information, including: Each message block is input into the sponge structure in turn, so that after the message block is spliced ​​with the current mask information, an XOR operation is performed with the current mask information and the current encryption information to generate the input parameters of the permutation function, and the input parameters are input into the permutation function for iteration.

[0033] After the message block is input into the sponge structure, the sponge structure performs the water absorption phase, in which the sponge structure will splice the current input message block with the current mask information. For the mask information corresponding to the first message block, the initial mask mask_init and the dynamic mask generated when padding the first message block m new Bitwise XOR, updated to the mask information corresponding to the first message block mask p1 ,Right now:

[0034] The current input message block pi With the current mask information mask pi Splicing to get Pi||mask pi .

[0035] Afterwards, you need to further Pi||mask pi With the current mask information mask pi and the current encryption information S pi Perform XOR operation to generate the input parameters of the permutation function. The encrypted information corresponding to the first message block S p1 , the initial encrypted information is an all-zero matrix (S=0 1600 ), which is the standard initialization method of the sponge structure1, then, for S=0 1600 Perform mask operation to generate the first encrypted information S p1 ,This step ensures the randomness of the initial encrypted information.

[0036] Pi||mask pi With the current mask information mask pi and the current encryption information S pi Perform an XOR operation Then, the operation is used as a permutation function f（） The input parameters of the permutation function f（） In one embodiment, the permutation function is used to generate updated encryption information and mask information.f（） The KECCAK permutation function is used. The KECCAK permutation function is the core nonlinear transformation module of the SHA-3 algorithm. Its function is to obfuscate and diffuse fixed-length internal states through multiple rounds of iteration. It should be noted that the width b, row w, and the corresponding size l in the KECCAK permutation function in this embodiment are applicable not only to b=1600, w=64, and l=6, but also to various other widths, as shown in Table 1: Table 1

[0037] Specifically, the permutation function iterates over the input parameters in the following way: Step 1021: Generate target encrypted information of a preset bit length based on input parameters.

[0038] First, the KECCAK permutation function generates the target encrypted information of the preset bit length according to the input parameters. S new , the specific formula is:

[0039] In this embodiment, the preset bit length is 1600 bits.

[0040] Step 1022: Convert the target encrypted information and the current mask information into a plurality of message matrices and a plurality of mask matrices respectively. The message matrices and the mask matrices have the same data structure.

[0041] For 1600-bit target encryption information S newpi , the target encrypted information S newpi Assign values ​​to multiple message matrices Ab0~Af4, Ab0= S newpi

[1599] ~ S newpi

[1536] ,Ab1= S newpi

[1535] ~ S newpi

[1472] , ..., Af4 = S newpi

[63] ~ S newpi [0].

[0042] For the current 1600-bit mask information mask pi , the mask information mask pi Assign values ​​to multiple mask matrices Ab0_ mask~Af4_ mask , Ab0_ mask = mask pi

[1599] ~ mask pi

[1536] , Ab1_ mask = mask pi

[1535] ~ mask pi

[1472] , ..., Af4_ mask = mask pi

[63] ~ mask pi [0].

[0043] It can be understood that in this embodiment, the data structures of the message matrix and the mask matrix are the same.

[0044] Step 1023: synchronously perform column diffusion, displacement and row permutation, nonlinear transformation, round constant injection, and state reorganization on the multiple message matrices and the multiple mask matrices to generate updated encrypted information and updated mask information.

[0045] For multiple message matrices Ab0~Af4 and multiple mask matrices Ab0_ mask ~Af4_ mask, The permutation function will perform the message matrix Ab0~Af4 and the mask matrix Ab0_ mask ~Af4_ mask 24 rounds of transformations are performed simultaneously, including column diffusion, displacement and row permutation, nonlinear transformation, round constant injection, and state reorganization, completely disrupting the state. Specifically, column diffusion introduces diffusivity through neighborhood XOR operations, displacement and row permutation increase disorder by performing cyclic shifts and rearrangements, nonlinear transformation replacement enhances resistance to linear analysis, and round constant injection breaks symmetry by XORing with the round constant.

[0046] Based on the above embodiment, in step 1023, column diffusion, displacement and row permutation, nonlinear transformation, round constant injection, and state reorganization are synchronously performed on multiple message matrices and multiple mask matrices, including: Step 10231: Synchronously perform an XOR digest on each column of data in each message matrix and each column of data in each mask matrix to perform matrix update, thereby obtaining a first matrix corresponding to each message matrix and a second matrix corresponding to each mask matrix.

[0047] When performing 24 rounds of transformation, the KECCAK permutation function first performs column diffusion θ (Theta) on each column of each message matrix and each column of each mask matrix. During column diffusion, the XOR digest of each column of each message matrix and each column of each mask matrix is ​​calculated, the diffusion value is generated, and the matrix is ​​updated to achieve inter-column bit mixing. The specific steps include: Ca0 = Ab0 ^ Ac0 ^ Ad0 ^ Ae0 ^ Af0 Ca1 = Ab1 ^ Ac1 ^ Ad1 ^ Ae1 ^ Af1 Ca2 = Ab2 ^ Ac2 ^ Ad2 ^ Ae2 ^ Af2 Ca3 = Ab3 ^ Ac3 ^ Ad3 ^ Ae3 ^ Af3 Ca4 = Ab4 ^ Ac4 ^ Ad4 ^ Ae4 ^ Af4 Ca0_ mask = Ab0_ mask ^Ac0_ mask ^ Ad0_ mask ^Ae0_ mask ^Af0_ mask Ca1_ mask = Ab1_ mask ^Ac1_ mask ^ Ad1_ mask ^Ae1_ mask ^Af1_ mask Ca2_ mask = Ab2_ mask ^Ac2_ mask ^ Ad2_ mask ^Ae2_ mask ^Af2_ mask Ca3_ mask = Ab3_ mask ^Ac3_ mask ^ Ad3_ mask ^Ae3_ mask ^Af3_ mask Ca4_ mask = Ab4_ mask ^ Ac4_ mask ^ Ad4_ mask ^Ae4_ mask ^Af4_ mask D0 = Ca4 ^ Ca1<<<1 D1 = Ca0 ^ Ca2<<<1 D2 = Ca1 ^ Ca3<<<1 D3 = Ca2 ^ Ca4<<<1 D4 = Ca3 ^ Ca0<<<1 D0_ mask = Ca4_ mask ^Ca1_ mask <<<1 D1_ mask = Ca0_ mask ^Ca2_ mask <<<1 D2_ mask = Ca1_ mask ^Ca3_ mask <<<1 D3_ mask = Ca2_ mask ^Ca4_ mask <<<1 D4_ mask = Ca3_ mask ^Ca0_ mask <<<1 Reconstruct the new Ab0~Af4 (i.e. the first matrix), where the new Ab0 = Ab0 ^ D0,…, the new Af4 =Af4 ^ D4.

[0048] Reconstructing the new Ab0_ mask ~Af4_ mask (ie the second matrix), where the new Ab0_ mask = Ab0_ mask ^D0_ mask ,…, New Af4_ mask =Af4_ mask ^ D4_ mask The symbol “^” above represents an exclusive OR operation, and the symbol “<<<” represents a circular left shift.

[0049] Step 10232: Perform cyclic shift, row rearrangement, and row-by-row logical operations on each first matrix and each second matrix according to predefined rules to obtain a third matrix corresponding to each first matrix and a fourth matrix corresponding to each second matrix.

[0050] After performing column diffusion to obtain multiple first matrices and multiple second matrices, it is necessary to further synchronously perform cyclic shift (ρ) and row rearrangement (π) on the multiple first matrices and multiple second matrices according to a predetermined rule to change the bit space distribution. The specific steps are as follows: Ea0 = Ab0 Ea1 = Ac1<<<44 Ea2 = Ad2<<<43 Ea3 = Ae3<<<21 Ea4 = Af4<<<14 Eb0 = Ab3<<<28 Eb1 = Ac4<<<20 Eb2 = Ad0<<<3 Eb3 = Ae1<<<45 Eb4 = Af2<<<61 Ec0 = Ab1<<<1 Ec1 = Ac2<<<6 Ec2 = Ad3<<<25 Ec3 = Ae4<<<8 Ec4 = Af0<<<18 Ed0 = Ab4<<<27 Ed1 = Ac0<<<36 Ed2 = Ad1<<<10 Ed3 = Ae2<<<15 Ed4 = Af3<<<56 Ef0 = Ab2<<<62 Ef1 = Ac3<<<55 Ef2 = Ad4<<<39 Ef3 = Ae0<<<41 Ef4 = Af1<<<2 Ea0_ mask = Ab0_ mask Ea1_ mask = Ac1_ mask <<<44 Ea2_ mask = Ad2_ mask <<<43 Ea3_ mask =Ae3_ mask <<<21 Ea4_ mask =Af4_mask <<<14 Eb0_ mask = Ab3_ mask <<<28 Eb1_ mask = Ac4_ mask <<<20 Eb2_ mask = Ad0_ mask <<<3 Eb3_ mask = Ae1_ mask <<<45 Eb4_ mask = Af2_ mask <<<61 Ec0_ mask = Ab1_ mask <<<1 Ec1_ mask = Ac2_ mask <<<6 Ec2_ mask = Ad3_ mask <<<25 Ec3_ mask = Ae4_ mask <<<8 Ec4_ mask = Af0_ mask <<<18 Ed0_ mask = Ab4_ mask <<<27 Ed1_ mask = Ac0_ mask <<<36 Ed2_ mask = Ad1_ mask <<<10 Ed3_ mask = Ae2_ mask <<<15 Ed4_ mask = Af3_ mask <<<56 Ef0_ mask = Ab2_ mask <<<62 Ef1_ mask = Ac3_ mask <<<55 Ef2_ mask = Ad4_ mask <<<39 Ef3_mask =Ae0_ mask <<<41 Ef4_ mask =Af1_ mask <<<2 It can be understood that Ab0~Af4 in this step is the first matrix obtained by column diffusion θ, Ab0_ mask ~Af4_ mask is the second matrix obtained by column diffusion θ.

[0051] After obtaining Ea0~Ef4 and Ea0_ mask ~Ef4_ mask After that, it is necessary to further perform logical operations row by row, that is, nonlinear transformation (χ), so as to obtain the third matrix corresponding to each first matrix and the fourth matrix corresponding to each second matrix. The specific process is as follows: Ab0 = Ea0 ^ ((~Ea1)&Ea2) Ab1 = Ea1 ^ ((~Ea2)&Ea3) Ab2 = Ea2 ^ ((~Ea3)&Ea4) Ab3 = Ea3 ^ ((~Ea4)&Ea0) Ab4 = Ea4 ^ ((~Ea0)&Ea1) Ac0 = Eb0 ^ ((~Eb1)&Eb2) Ac1 = Eb1 ^ ((~Eb2)&Eb3) Ac2 = Eb2 ^ ((~Eb3)&Eb4) Ac3 = Eb3 ^ ((~Eb4)&Eb0) Ac4 = Eb4 ^ ((~Eb0)&Eb1) Ad0 = Ec0 ^ ((~Ec1)&Ec2) Ad1 = Ec1 ^ ((~Ec2)&Ec3) Ad2 = Ec2 ^ ((~Ec3)&Ec4) Ad3 = Ec3 ^ ((~Ec4)&Ec0) Ad4 = Ec4 ^ ((~Ec0)&Ec1) Ae0 = Ed0 ^ ((~Ed1)&Ed2) Ae1 = Ed1 ^ ((~Ed2)&Ed3) Ae2 = Ed2 ^ ((~Ed3)&Ed4) Ae3 = Ed3 ^ ((~Ed4)&Ed0) Ae4 = Ed4 ^ ((~Ed0)&Ed1) Af0 = Ef0 ^ ((~Ef1)&Ef2) Af1 = Ef1 ^ ((~Ef2)&Ef3) Af2 = Ef2 ^ ((~Ef3)&Ef4) Af3 = Ef3 ^ ((~Ef4)&Ef0) Af4 = Ef4 ^ ((~Ef0)&Ef1) Ab0_ mask = Ea0_ mask ^ ((~Ea1__ mask )&Ea2_ mask ) Ab1 _ mask = Ea1_ mask ^ ((~Ea2__ mask )&Ea3_ mask ) Ab2_ mask = Ea2_ mask ^ ((~Ea3__ mask )&Ea4_ mask ) Ab3_ mask = Ea3_ mask ^ ((~Ea4__ mask )&Ea0_ mask ) Ab4_ mask = Ea4_ mask ^ ((~Ea0__ mask )&Ea1_ mask ) Ac0 _ mask = Eb0_ mask ^ ((~Eb1__ mask )&Eb2_ mask ) Ac1 _ mask = Eb1_ mask ^ ((~Eb2__ mask )&Eb3_ mask ) Ac2 _ mask = Eb2_ mask ^ ((~Eb3__ mask )&Eb4_ mask ) Ac3_ mask = Eb3_ mask ^ ((~Eb4__ mask )&Eb0_ mask ) Ac4 _ mask = Eb4_ mask ^ ((~Eb0__ mask )&Eb1_ mask ) Ad0_ mask = Ec0_ mask ^ ((~Ec1__ mask )&Ec2_ mask ) Ad1_ mask = Ec1_ mask ^ ((~Ec2__ mask )&Ec3_ mask ) Ad2 _ mask = Ec2_ mask ^ ((~Ec3__ mask )&Ec4_ mask ) Ad3_ mask = Ec3_ mask ^ ((~Ec4__ mask )&Ec0_ mask ) Ad4 _ mask = Ec4_ mask ^ ((~Ec0__ mask )&Ec1_ mask ) Ae0_ mask = Ed0_ mask ^ ((~Ed1__ mask )&Ed2_ mask ) Ae1_ mask = Ed1_ mask ^ ((~Ed2__ mask )&Ed3_ mask ) Ae2 _ mask = Ed2_ mask ^ ((~Ed3__ mask )&Ed4_ mask ) Ae3_ mask = Ed3_ mask ^ ((~Ed4__ mask )&Ed0_ mask) Ae4_ mask = Ed4_ mask ^ ((~Ed0__ mask )&Ed1_ mask ) Af0 _ mask = Ef0_ mask ^ ((~Ef1__ mask )&Ef2_ mask ) Af1_ mask = Ef1_ mask ^ ((~Ef2__ mask )&Ef3_ mask ) Af2 _ mask = Ef2_ mask ^ ((~Ef3__ mask )&Ef4_ mask ) Af3_ mask = Ef3_ mask ^ ((~Ef4__ mask )&Ef0_ mask ) Af4_ mask = Ef4_ mask ^ ((~Ef0__ mask )&Ef1_ mask ) It can be understood that in this step, Ab0~Af4 is the third matrix obtained after the update, Ab0_ mask ~Af4_ mask This is the updated fourth matrix. The symbol “~” represents bitwise inversion, and the symbol “&” represents bitwise AND.

[0052] Step 10233: XOR the first third matrix among the plurality of third matrices with the round constant and then reorganize it to generate updated encryption information, and simultaneously XOR the first fourth matrix among the plurality of fourth matrices with the round constant and then reorganize it to generate updated mask information.

[0053] After obtaining the third matrix and the fourth matrix, it is necessary to further XOR the round constant (RC[i]) of the first third matrix among the multiple third matrices, and XOR the corresponding round constant (RC[i]) of the first fourth matrix among the multiple fourth matrices, to destroy the symmetry. The specific formula is as follows: Ab0 = Ab0 (third matrix) ^ RC[i] Ab0_ mask = Ab0_ mask (Fourth matrix)^RC[i] The calculation method of RC[i] may refer to FIPS PUB 202, which will not be described in detail in this embodiment.

[0054] In one embodiment, if Figure 2 and Figure 3 As shown, Figure 2 and Figure 3 Schematic diagram of 24 rounds of transformation of the message matrix by the permutation function provided in the embodiment of the present invention and schematic diagram of 24 rounds of transformation of the mask matrix by the permutation function, respectively. Figure 3 In, Ab0_ mask ~Af4_ mask Abbreviated as m Ab0~ m The specific process of the Af4,24 random transformation can be referred to the description of the above embodiment, which will not be repeated in this embodiment.

[0055] After XORing the first third matrix with the round constant, all third matrices are bitwise combined and the updated encrypted information is output. Similarly, after XORing the first fourth matrix with the round constant, all fourth matrices are bitwise combined and the updated mask information is output.

[0056] Step 103: intercept the output result of the specified bit segment in the encrypted information after each update, and splice the output result with the encryption result corresponding to the previous message block to update the encryption result. Stop the iteration until the encryption result is greater than the specified length, and generate a leakage-resistant hash value based on the encryption result. The encryption result of the first message block is the output result of the first message block.

[0057] After obtaining the updated encrypted information after each iteration, the sponge structure needs to be squeezed. Specifically, it is necessary to intercept the data of the specified bit segment in the encrypted information after each update to obtain the output result. After obtaining the output result, it is necessary to splice the output result with the encryption result after the previous message block iteration to update the encryption result, wherein the output result of the first message block is directly used as the encryption result of the first message block. After updating the encryption result, it is necessary to further determine whether the bit length of the updated encryption result is greater than the specified length. If it is greater than the specified length, the iteration can be stopped and the final anti-leakage hash value can be generated based on the updated encryption result. If it is less than or equal to the specified length, it is necessary to continue to input the next message block into the sponge structure for iteration.

[0058] Based on the above embodiment, in step 103, the output result is concatenated with the encryption result corresponding to the previous message block to update the encryption result, and iteration is stopped until the encryption result is greater than the specified length. The anti-leakage hash value is generated based on the encryption result, including: Step 1031: Concatenate the output result with the encryption result corresponding to the previous message block to update the encryption result, and determine the bit length of the updated encryption result.

[0059] Step 1032: If the bit length of the encryption result is greater than the specified length, stop inputting the message block into the sponge structure and generate a leakage-resistant hash value based on the encryption result.

[0060] Step 1033: When the bit length of the encryption result is less than or equal to the specified length, the current encrypted information is unmasked for iteration of the next message block, and the next message block is continuously input into the sponge structure.

[0061] Specifically, after extracting the output result d of a specified bit segment (e.g., the first r1 bits) from each updated encrypted message, the output result is concatenated with the encryption result Q obtained after the previous message block iteration to update the encryption result Q, i.e., Q = Q + d. After the encryption result Q is updated, if the bit length of the updated encryption result Q is greater than the specified length Z, iteration can be stopped and a leakage-resistant hash value can be generated based on the updated encryption result Q. In one embodiment, the process for generating the leakage-resistant hash value based on the output result is as follows: extracting a message mask value of a specified length (e.g., the first r2 bits, where r2>r1) from the updated encryption result, and simultaneously extracting a mask block of a specified length from the current mask information; performing an exclusive-or operation on the message mask value and the mask block to obtain the leakage-resistant hash value. It will be understood that, since the updated encryption result Q still contains a mask, it must be exclusive-ored with the corresponding portion of the updated mask information (i.e., the first r2 bits of the updated mask information) to obtain an unmasked output block, which serves as the final leakage-resistant hash value Sr. If the bit length of the intercepted output result is less than or equal to the specified length, it is necessary to further demask the encrypted information updated by this 24-round transformation to obtain the encrypted information for the next message block iteration. S pi+1 Specifically, the encrypted information updated by the 24 rounds of transformation can be demasked by applying a permutation function to the mask information updated by the 24 rounds of transformation, and the real encrypted information without mask can be output. S pi+1 For the next message block iteration, the mask information updated by the 24 rounds of transformation is independently applied with the permutation function to perform the same transformation as the encrypted information to obtain the mask information for the next message block iteration. mask pi+1 .

[0062] It can be understood that the SHA3 algorithm provided in the embodiment of the present invention includes all modes of the SHA3 series specified by the US NIST, including SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHAKE128 and SHAKE256 algorithms.

[0063] As described above, an embodiment of the present invention provides a data processing method based on SHA3. After obtaining a target message carrying a mask, the embodiment of the present invention divides the target message into multiple message blocks, and sequentially inputs each message block into the sponge structure for iteration, so that the message block is spliced ​​with the current mask information and then iterated with the current encryption information, outputting updated encryption information and updated mask information. Finally, the output result of a specified bit segment is intercepted in each updated encryption information, and the encryption result is updated based on the output result, and a leakage-resistant hash value is generated based on the updated encryption result. The embodiment of the present invention randomizes the input and intermediate state of the sponge structure each time through dynamically updated mask information, thereby effectively concealing the real data processing path, preventing the key or original data from being restored through side channel attacks, reducing the risk of information leakage, and having the ability to resist side channel attacks throughout the entire process, thereby solving the technical problem that the existing SHA3 algorithm has the risk of information leakage during the operation process.

[0064] The embodiment of the present invention also provides a data processing device based on SHA3, such as Figure 4 As shown, Figure 4 This is a schematic diagram of the structure of a SHA3-based data processing device provided in an embodiment of the present invention. The SHA3-based data processing device provided in an embodiment of the present invention includes: The message segmentation module 201 is configured to obtain a target message carrying a mask and perform padding and block processing on the target message to obtain multiple message blocks; The message iteration module 202 is configured to sequentially input each message block into the sponge structure so that the message block is concatenated with the current mask information and then iterated with the current encryption information, outputting updated encryption information and updated mask information, where the current mask information and the current encryption information are generated after the previous message block iteration, the mask information corresponding to the first message block is generated based on the set initial mask, and the encryption information corresponding to the first message block is generated based on the all-zero matrix; The result output module 203 is configured to intercept the output result of a specified bit segment in the encrypted information after each update, and splice the output result with the encryption result corresponding to the previous message block to update the encryption result. The iteration is stopped until the encryption result is greater than the specified length, and a leakage-resistant hash value is generated based on the encryption result. The encryption result of the first message block is the output result of the first message block.

[0065] Based on the above embodiment, the message segmentation module 201 includes: a data filling unit configured to fill the bit length of the target message to an integer multiple of a preset bit length, and mask the filled data to obtain a first message; The data segmentation unit is configured to switch the first message into multiple message blocks, and the bit length of each message block is a preset bit length.

[0066] Based on the above embodiment, the message iteration module 202 is specifically configured to input each message block into the sponge structure in turn, so that after the message block is spliced ​​with the current mask information, an XOR operation is performed with the current mask information and the current encryption information to generate the input parameters of the permutation function, and the input parameters are input into the permutation function for iteration.

[0067] Based on the above embodiment, the permutation function iterates the input parameters in the following manner: Generate target encrypted information of a preset bit length based on input parameters; Converting target encrypted information and current mask information into a plurality of message matrices and a plurality of mask matrices respectively, wherein the message matrices and the mask matrices have the same data structure; Column diffusion, displacement and row permutation, nonlinear transformation, round constant injection and state reorganization are synchronously performed on multiple message matrices and multiple mask matrices to generate updated encrypted information and updated mask information.

[0068] Based on the above embodiment, multiple message matrices and multiple mask matrices are synchronously subjected to column diffusion, displacement and row permutation, nonlinear transformation, round constant injection, and state reorganization, including: Synchronously performing an XOR digest on each column of data in each message matrix and each column of data in each mask matrix to perform matrix updating, thereby obtaining a first matrix corresponding to each message matrix and a second matrix corresponding to each mask matrix; Performing cyclic shifts, row rearrangements, and row-by-row logical operations on each first matrix and each second matrix according to predefined rules to obtain a third matrix corresponding to each first matrix and a fourth matrix corresponding to each second matrix; A first third matrix among the plurality of third matrices is XORed with a round constant and then recombined to generate updated encryption information, and a first fourth matrix among the plurality of fourth matrices is XORed with a round constant and then recombined to generate updated mask information.

[0069] Based on the above embodiment, the result output module 203 includes: a data splicing unit configured to splice the output result with the encryption result corresponding to the previous message block to update the encryption result, and determine the bit length of the updated encryption result; A result output unit is configured to stop inputting the message block into the sponge structure when the bit length of the encryption result is greater than a specified length, and generate a leakage-resistant hash value based on the encryption result; The re-iteration unit is configured to, when the bit length of the encryption result is less than or equal to the specified length, de-mask the current encrypted information for iteration of the next message block and continue to input the next message block into the sponge structure.

[0070] Based on the above embodiment, the result output unit is specifically configured to intercept a message mask value of a specified length from the updated encryption result, and simultaneously intercept a mask block of a specified length from the current mask information; perform an XOR operation on the message mask value and the mask block to obtain a leakage-resistant hash value.

[0071] The SHA3-based data processing device provided in the embodiment of the present invention can be used to execute the SHA3-based data processing method provided in the above embodiment, and has corresponding functions and beneficial effects.

[0072] It is worth noting that in the above-mentioned embodiment of the SHA3-based data processing device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other and are not used to limit the scope of protection of the present invention.

[0073] The embodiment of the present invention also provides a data processing circuit based on SHA3, such as Figure 5 As shown, Figure 5 This is a schematic diagram of the structure of a SHA3-based data processing circuit provided in an embodiment of the present invention. The SHA3-based data processing circuit 30 provided in an embodiment of the present invention includes a universal interface module 301, a logic control module 302, a universal operation module 303, and a universal data storage module 304. The universal interface module 301 is connected to the logic control module 302 and the universal data storage module 304. The logic control module 302 is connected to the universal operation module 303, and the universal operation module 303 is connected to the universal data storage module 304.

[0074] The universal interface module 301 is configured to connect to the processor, receive a target message carrying a mask from the processor, and transmit the target message to the universal data storage module 304 ; and receive a control signal sent by the processor, and transmit the control signal to the logic control module 302 .

[0075] Specifically, in this embodiment, the universal interface module 301 is the module that communicates with the processor via the SHA3-based data processing circuit 30, including various bus interfaces such as AXI, AHB, and APB. It is primarily used to receive masked target messages from the processor and transmit them to the universal data storage module 304. It is understood that the universal interface module 301 can also read data from the universal data storage module 304. Furthermore, the universal interface module 301 is used to receive control signals from the processor. In this embodiment, the processor can use these control signals to initiate, pause, poll the end status of operations, or select an algorithm type. Upon receiving the control signals, the universal interface module 301 further transmits the control signals to the logic control module 302.

[0076] The general data storage module 304 is configured to store the target message and the set initial mask.

[0077] The general data storage module 304 is used to store the target message and the set initial mask. In addition, for the target message N and the mask value mN of the target message, the general data storage module 304 can store the target message N and the mask value mN in different storage areas respectively. Even if an attacker breaks through one storage area, he can only obtain the masked target message N or the isolated mask value mN, and cannot directly restore the original message, thereby enhancing data confidentiality. In one embodiment, in order to speed up the reading, writing and access speed of data, the general data storage module 304 can be implemented using registers, but the general data storage module 304 is not limited to registers, and can also be NVM-type non-volatile memory such as FLASH, SRAM, ROM, etc., which is not specifically limited in this embodiment. In addition, the general data storage module 304 can also be configured to store intermediate values ​​generated during the SHA3 operation.

[0078] The logic control module 302 is configured to receive a control signal, convert the control signal into a control instruction, and send the control instruction to the general operation module 303 .

[0079] The logic control module 302 is used to receive control signals and convert the control signals into control instructions to control the general operation module 303. The logic control module 302 can be implemented through a hardware circuit state machine or a general microcode instruction set, which is not specifically limited in this embodiment.

[0080] The general operation module 303 is configured to read and write data in the general data storage module 304 , and execute or suspend the above-mentioned SHA3-based data processing method based on the control instruction sent by the logic control module 302 .

[0081] The general operation module 303 is used to read and write data from the general data storage module 304, for example, reading the target message and initial mask, and writing intermediate values ​​generated during the operation (such as encryption information and mask information) into the general data storage module 304 for storage. The general operation module 303 is also used to execute or pause the above-mentioned SHA3-based data processing method according to control instructions sent by the logic control module 302.

[0082] In one embodiment, if Figure 6 As shown, Figure 6 A schematic diagram of another SHA3-based data processing circuit provided in an embodiment of the present invention. Figure 6 In the example, the general data storage module 304 includes a message storage area and a mask storage area. The message storage area is used to store the target message, and the mask storage area is used to store the mask value corresponding to the target message. Figure 6 The logic control module 302 is also connected to the general data storage module 304 and is used to drive the general data storage module 304 to read and write data according to the control signal of the processor. The general operation module 303 includes a bit flipping unit, a KECCAK permutation unit, and an RC unit. The bit flipping unit is used to read the current encryption information and the current mask information from the general data storage module 304 in each iteration, and then perform bit flipping on the current encryption information and the current mask information to generate multiple message matrices and multiple mask matrices. The specific process can be referred to the process of generating multiple message matrices and multiple mask matrices in the SHA3-based data processing method provided in the above embodiment, and will not be repeated in this embodiment. The KECCAK permutation unit is used to simultaneously perform column diffusion, displacement and row permutation, nonlinear transformation, round constant injection, and state reorganization on the multiple message matrices and multiple mask matrices. The RC unit is used to provide round constants for the KECCAK permutation unit.

[0083] The embodiment of the present invention uses dynamically updated mask information to randomize the input and intermediate states of the sponge structure each time, thereby effectively concealing the real data processing path, preventing the restoration of keys or original data through side-channel attacks, reducing the risk of information leakage, and having the ability to resist side-channel attacks throughout the entire process, thereby solving the technical problem of the risk of information leakage in the existing SHA3 algorithm during the calculation process.

[0084] This embodiment also provides a data processing device based on SHA3, such as Figure 7 As shown, Figure 7A structural schematic diagram of a SHA3-based data processing device provided in an embodiment of the present invention is provided. The SHA3-based data processing device includes a processor 40 and the above-mentioned SHA3-based data processing circuit 30, wherein the processor 40 is specifically configured to be connected to the universal interface module of the SHA3-based data processing circuit 30, and to send target messages and control instructions to the SHA3-based data processing circuit 30.

[0085] The data processing device 30 based on SHA3 can be a computing device such as a desktop computer, a notebook, a palmtop computer, a cloud server, etc. It can be understood by those skilled in the art that Figure 7 This is only an example of a data processing device 30 based on SHA3 and does not constitute a limitation of the data processing device 30 based on SHA3. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the data processing device 30 based on SHA3 may also include input and output devices, network access devices, buses, etc.

[0086] The processor 40300 may be a central processing unit (CPU), other general-purpose processors 40, digital signal processors 40 (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor 40 may be a microprocessor 40 or any conventional processor 40.

[0087] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0088] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0089] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0090] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0091] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the method of the present invention. The aforementioned storage medium includes various media that can store computer programs, such as USB flash drives, mobile hard drives, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0092] An embodiment of the present invention further provides a storage medium containing computer-executable instructions. When executed by a computer processor, the computer-executable instructions are used to perform a SHA3-based data processing method, the method comprising the following steps: A target message carrying a mask is obtained, and the target message is padded and divided into blocks to obtain multiple message blocks.

[0093] Each message block is input into the sponge structure in turn, so that the message block is spliced ​​with the current mask information and then iterated with the current encryption information, and the updated encryption information and the updated mask information are output. The current mask information and the current encryption information are generated after the previous message block iteration. The mask information corresponding to the first message block is generated based on the set initial mask, and the encryption information corresponding to the first message block is generated based on the all-zero matrix.

[0094] The output result of the specified bit segment is intercepted in the encrypted information after each update, and the output result is spliced ​​with the encryption result corresponding to the previous message block to update the encryption result. The iteration is stopped when the encryption result is greater than the specified length. The anti-leakage hash value is generated based on the encryption result. The encryption result of the first message block is the output result of the first message block.

[0095] Note that the above are only preferred embodiments of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments, and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the embodiments of the present invention have been described in detail through the above embodiments, the present invention is not limited to the above embodiments. Without departing from the concept of the embodiments of the present invention, the embodiments of the present invention may also include more other equivalent embodiments, and the scope of the embodiments of the present invention is determined by the scope of the appended claims.

Claims

1. A data processing method based on SHA3, characterized in that: The method comprises: Obtaining a target message carrying a mask, and performing padding and block processing on the target message to obtain multiple message blocks; Inputting each of the message blocks into the sponge structure in sequence, so that the message block is spliced ​​with the current mask information and then iterated with the current encryption information, outputting updated encryption information and updated mask information, wherein the current mask information and the current encryption information are generated after the previous iteration of the message block, the mask information corresponding to the first message block is generated based on the set initial mask, and the encryption information corresponding to the first message block is generated based on the all-zero matrix; The output result of the specified bit segment is intercepted in the encrypted information after each update, and the output result is spliced ​​with the encryption result corresponding to the previous message block to update the encryption result. The iteration is stopped until the encryption result is greater than the specified length, and a leakage-resistant hash value is generated based on the encryption result. The encryption result of the first message block is the output result of the first message block.

2. The data processing method based on SHA3 according to claim 1, characterized in that: The filling and block processing of the target message to obtain multiple message blocks includes: Filling the bit length of the target message to an integer multiple of a preset bit length, and masking the filled data to obtain a first message; The first message is switched into a plurality of message blocks, and the bit length of each of the message blocks is the preset bit length.

3. The data processing method based on SHA3 according to claim 1, characterized in that: The step of sequentially inputting each of the message blocks into the sponge structure so as to splice the message block with the current mask information and then iterate with the current encryption information comprises: Each of the message blocks is input into the sponge structure in turn, so that after the message block is spliced ​​with the current mask information, an XOR operation is performed with the current mask information and the current encryption information to generate input parameters of the permutation function, and the input parameters are input into the permutation function for iteration.

4. The data processing method based on SHA3 according to claim 3, characterized in that: The permutation function iterates over the input parameters in the following manner: generating target encrypted information of a preset bit length based on the input parameters; Respectively converting the target encrypted information and the current mask information into a plurality of message matrices and a plurality of mask matrices, wherein the message matrices and the mask matrices have the same data structure; Column diffusion, displacement and row permutation, nonlinear transformation, round constant injection and state reorganization are synchronously performed on the plurality of message matrices and the plurality of mask matrices to generate updated encryption information and updated mask information.

5. The data processing method based on SHA3 according to claim 4, characterized in that: The synchronously performing column diffusion, displacement and row permutation, nonlinear transformation, round constant injection, and state reorganization on the plurality of message matrices and the plurality of mask matrices includes: Synchronously performing an XOR digest on each column of data of each message matrix and each column of data of each mask matrix to perform matrix updating, thereby obtaining a first matrix corresponding to each message matrix and a second matrix corresponding to each mask matrix; Performing cyclic shifts, row rearrangements, and row-by-row logical operations on each of the first matrices and each of the second matrices according to predefined rules to obtain a third matrix corresponding to each of the first matrices and a fourth matrix corresponding to each of the second matrices; A first third matrix among the plurality of the third matrices is XORed with a round constant and then recombined to generate updated encryption information, and a first fourth matrix among the plurality of the fourth matrices is XORed with the round constant and then recombined to generate updated mask information.

6. The data processing method based on SHA3 according to claim 1, characterized in that: The step of concatenating the output result with the encryption result corresponding to the previous message block to update the encryption result, stopping iteration after the encryption result is greater than a specified length, and generating a leakage-resistant hash value based on the encryption result includes: splicing the output result with the encryption result corresponding to the previous message block to update the encryption result, and determining the bit length of the updated encryption result; If the bit length of the encryption result is greater than a specified length, stop inputting the message block into the sponge structure and generate a leakage-resistant hash value based on the encryption result; In a case where the bit length of the encryption result is less than or equal to the specified length, the current encryption information is demasked for use in the iteration of the next message block, and the next message block is continuously input into the sponge structure.

7. The data processing method based on SHA3 according to claim 6, characterized in that: Generating a leakage-resistant hash value based on the encryption result includes: intercepting the message mask value of the specified length from the updated encryption result, and synchronously intercepting the mask block of the specified length from the current mask information; An XOR operation is performed on the message mask value and the mask block to obtain an anti-leakage hash value.

8. A data processing device based on SHA3, characterized in that: The device comprises: a message segmentation module configured to obtain a target message carrying a mask, and perform padding and block processing on the target message to obtain a plurality of message blocks; a message iteration module configured to sequentially input each message block into a sponge structure, so that the message block is concatenated with the current mask information and then iterated with the current encryption information, outputting updated encryption information and updated mask information, wherein the current mask information and the current encryption information are generated after the previous message block iteration, the mask information corresponding to the first message block is generated based on a set initial mask, and the encryption information corresponding to the first message block is generated based on an all-zero matrix; The result output module is configured to intercept the output result of a specified bit segment in the encrypted information after each update, splice the output result with the encryption result corresponding to the previous message block to update the encryption result, stop iteration after the encryption result is greater than the specified length, generate a leakage-resistant hash value based on the encryption result, and the encryption result of the first message block is the output result of the first message block.

9. A data processing circuit based on SHA3, characterized in that: It includes a universal interface module, a logic control module, a universal operation module and a universal data storage module, wherein the universal interface module is connected to the logic control module and the universal data storage module, the logic control module is connected to the universal operation module, and the universal operation module is connected to the universal data storage module; The universal interface module is configured to connect to the processor, receive a target message carrying a mask from the processor, and transmit the target message to the universal data storage module; and receive a control signal sent by the processor, and transmit the control signal to the logic control module; The universal data storage module is configured to store the target message and the set initial mask; The logic control module is configured to receive the control signal, convert the control signal into a control instruction, and send the control instruction to the general operation module; The general operation module is configured to read and write data in the general data storage module, and execute or suspend the SHA3-based data processing method according to any one of claims 1 to 7 based on a control instruction sent by the logic control module.

10. A data processing device based on SHA3, characterized in that: The method comprises a processor and the SHA3-based data processing circuit according to claim 9.

Images