SM4 S box hardware implementation method based on redundant tower domain and application

Abstract

The invention discloses an SM4 S box hardware implementation method and application based on a redundant tower domain, and belongs to the technical field of information security, and the method comprises the steps: employing the redundant tower domain to represent an AES S box, and employing a small end sequence to represent affine transformation; giving a transformation relation between the S boxes of the AES and the SM4, and representing affine transformation and constant offset by adopting a small end sequence; based on the step 1 and the step 2, SM4 S box representation based on the redundant tower domain is given; and in combination with mask implementation of three stages of redundancy tower domain inversion, complete SM4 hardware design is completed. According to the method, the SM4 S box is mapped into the redundant tower domain implementation framework of the AES S box for the first time, and the high-compactness RTF-SM4 is realized by optimizing and combining a plurality of affine transformation layers and constant offsets. The S box is very easily combined with gate-level side channel attack protection schemes such as a mask type and a double-track type, so that compact SM4 hardware capable of resisting side channel attack is realized, and the side channel security of encryption hardware is ensured.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and specifically relates to an SM4 S-box hardware implementation method and application based on redundant tower domains, which is mainly used to ensure the side channel security of encryption hardware. Background Art

[0002] SM4, a commercial block cipher standard independently designed by my country (GB / T 32907), plays a core role in the power grid information security system. Given the limited resources of power grid terminals, high real-time requirements, and large-scale deployment, designing a low-footprint, high-efficiency SM4 implementation is a pressing challenge.

[0003] To ensure efficient SM4 implementation, an efficient nonlinear component S-box implementation is required to reduce hardware overhead. Existing S-box implementations fall into two categories: table lookup and computational. The table lookup method stores the S-box in a LUT (LUT) lookup table and implements the S-box functionality by querying the LUT. This method has the advantage of high speed but the disadvantage of large footprint. The computational implementation first represents the S-box operation as a polynomial over a finite field, then constructs the S-box operation using basic operations such as modular multiplication and modular addition over the finite field. While this implementation is not as computationally fast as the LUT, it saves more area than the LUT method.

[0004] Computational implementation methods can be divided into polynomial basis calculations, normal basis calculations, tower field (composite field) calculations, and redundant tower field calculations. Based on the original polynomial basis and normal basis calculations, in the prior art, a 2005 publication [Canright D. A very compact S-box for AES [C] / / Cryptographic Hardware and Embedded Systems- CHES 2005. Springer, 2005: 441-455.] proposed an efficient tower field approach, which uses The domain is converted to the tower domain, such as or Based on the tower domain calculation, the 2015 published literature [Ueno R, Homma N, Sugawara Y, et al. Highly efficient Inversion circuit based on redundant GFarithmetic and its application to AES design [C] / / Cryptographic Hardware and Embedded Systems-CHES 2015. Springer, 2015:63-80.], a redundant tower domain implementation method was proposed. In 2018, a redundant tower domain-based ISW masked AES hardware design method was proposed. Combining redundant tower domain technology with ISW masking, on a Kintex7 device, reduced area by 63.11% and area multiplication time by 48.35% compared to low-entropy masking schemes. This demonstrates that applying redundant tower domain technology to AES S-boxes significantly improves masking implementation in terms of both area and area multiplication time.

[0005] If the redundant tower field technology can be applied to the SM4 S-box, not only can the existing AES S-box masking technology be directly used, but the area of ​​the SM4 S-box can also be reduced. However, applying RTF technology to the side channel protection of SM4 still faces severe challenges. The fundamental reason is that although the SM4 and AES S-boxes are both The above operations are performed, but their algebraic structures are different, resulting in irreducible polynomials, different affine transformation matrices before and after inversion, and different constant offsets. This makes it impossible to unify the two S-boxes through a simple mapping, and the RTF architecture needs to be specifically adapted.

[0006] SM4 in finite fields The irreducible polynomial defined above is , and the irreducible polynomial used by AES is .

[0007] To address the conversion issue between the two S-boxes, OSR proposed an affine transformation-based equivalence model in its implementation of the composite domain of AES and SM4 S-boxes. This model implements the mathematical mapping from AES S-boxes to SM4 S-boxes by introducing a pre-affine transformation D1, a post-affine transformation D2, and constant offsets c1 and c2. However, the affine transformation is represented in big-endian notation and cannot be uniformly expressed with affine transformations in the redundant tower domain.

[0008] Therefore, applying the redundant tower domain technology of the AES S-box to the SM4 S-box faces technical challenges such as irreducible polynomials, different affine transformation matrices before and after inversion, and different constant offsets. Summary of the Invention

[0009] The technical problem solved by the present invention is as follows: The present invention provides an SM4 S-box hardware implementation method based on redundant tower domains, which can apply the redundant tower domain design of the AES S-box to the SM4 S-box. This SM4 S-box design based on redundant tower domains is directly implemented using basic NAND gates, and can provide a basic implementation framework for protection against mask-type side-channel attacks.

[0010] Technical solution: In order to solve the above technical problems, the technical solution adopted by the present invention is as follows:

[0011] A hardware implementation method for SM4 S-boxes based on redundant tower domains is proposed. Through the algebraic mapping relationship between SM4 S-boxes and AES S-boxes, an implementation framework for embedding SM4 S-boxes into AES redundant tower domains is derived. The affine transformation matrix and constant offset are further optimized to achieve a compact RTF-SM4 round function, thereby realizing SM4 hardware design. The method includes the following steps:

[0012] Step 1: Give an AES S-box represented in redundant tower field, and the affine transformation is represented in little endian order;

[0013] Step 2: Give the transformation relationship between the S-box of AES and SM4. The affine transformation and constant offset are both expressed in little-endian order.

[0014] Step 3: Based on steps 1 and 2, give the SM4 S-box representation based on the redundant tower domain;

[0015] Step 4: Combined with the implementation of the three-stage inverse calculation in the redundant tower domain, the complete SM4 S-box hardware design is completed. The specific implementation process is as follows:

[0016] 1) Input data;

[0017] 2) Perform a pre-affine transformation and a pre-constant shift on the input data;

[0018] 3) Redundant tower domain inversion, or masked redundant tower domain inversion in three stages;

[0019] 4) Perform post-affine transformation and post-constant shift to obtain the SM4 S-box hardware. Furthermore, in step 1, the inversion based on the redundant tower domain representation is:

[0020] ;

[0021] Where Inv(x) represents the inverse operation on the AES S-box, x represents an 8×1 column vector, which is GF(2 8 ) field; M1 represents an 8×8 affine transformation matrix that maps the input x to GF(2 4 ) 2Two 4-bit elements (8 bits in total) on the tower domain normal basis (NB); M2 represents the 8×10 affine transformation matrix that can transform the input into GF(2 5 ) 2 Two 5-bit elements (10 bits in total) on the field redundancy representation basis (RRB) are mapped to GF(2 8 ) field polynomial basis.

[0022] The AES S-box based on the redundant tower domain representation is:

[0023]

[0024] Among them, S AES represents the S-box of the AES block cipher algorithm, x represents the 8-bit input of the S-box, represented by an 8×1 column vector; y represents the 8-bit output of the S-box, represented by an 8×1 column vector; c represents the 8-bit constant offset, represented by an 8×1 column vector; A represents the 8×8 affine transformation matrix.

[0025] Affine transformations are all represented in little-endian order:

[0026] ;

[0027] Where B represents an 8×10 affine transformation matrix, which is obtained by multiplying the affine transformation matrix A by the affine transformation matrix M2. The 8-bit output y of the S-box consists of {y7, y6, y5, y4, y3, y2, y1, y0} from high to low, where y0 to y7 represent eight 1-bit elements. The 8-bit input x of the S-box consists of {x7, x6, x5, x4, x3, x2, x1, x0} from high to low, where x0 to x7 represent eight 1-bit elements.

[0028] Furthermore, in step 2, the conversion relationship between the AES and SM4 S-boxes is:

[0029] ;

[0030] Among them, S SM4 (x) represents the S-box of SM4 algorithm, S AES represents the S-box of the AES block cipher algorithm, D1 represents an 8×8 affine transformation matrix, c1 represents an 8×1 column vector, and c2 represents an 8×1 column vector.

[0031] Affine transformations and constant offsets are represented in little-endian order:

[0032] ;

[0033] y0 through y7 are single-bit inputs that together form the 8-bit output of the SM4 S-box. In little-endian order, the 8-bit output consists of {y7, y6, y5, y4, y3, y2, y1, y0} from high to low. x0 through x7 are single-bit elements that together form the 8-bit input of the SM4 S-box. In little-endian order, the 8-bit output consists of {x7, x6, x5, x4, x3, x2, x1, x0} from high to low. D2 and D1 are two 8×8 affine transformations.

[0034] Furthermore, in step 3, the SM4 S-box based on the redundant tower domain is expressed as:

[0035] The following formula converts the AES S-box formula S AES After substituting the formula for the redundant tower domain inverse Inv(x) into the relationship between the SM4 S-box and the AES S-box, multiple affine matrices are merged. The process is as follows:

[0036]

[0037] make

[0038] The SM4 S-box formula based on the redundant tower domain can be obtained as follows:

[0039] ;

[0040] Among them, S SM4 represents the S-box of the SM4 algorithm, F1 represents the front affine transformation, F2 represents the back affine transformation, E1 represents the front constant offset, and E2 represents the back constant offset.

[0041] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0042] (1) This paper maps the SM4 S-box into the redundant tower domain implementation framework of the AES S-box for the first time. By optimizing and merging multiple affine transformation layers and constant offsets, a highly compact RTF-SM4 is finally achieved.

[0043] (2) This redundant tower-based SM4 S-box design is directly implemented using basic NAND gates, providing a basic implementation framework for gate-level side-channel attack protection schemes such as mask-based and dual-rail-based. Furthermore, the redundant tower-based SM4 S-box hardware design has advantages in terms of area and throughput per unit area.

[0044] (3) Hardware designers can use this method to implement a low-area SM4 S-box, which can be easily combined with gate-level side-channel attack protection schemes such as mask-type and dual-rail-type to achieve a compact and side-channel attack-resistant SM4 hardware implementation, ensuring the side-channel security of cryptographic hardware and the security of sensitive data. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 The redundant tower domain SM4 S-box hardware design of the present invention is based on;

[0046] Figure 2 The present invention is further based on the masked redundant tower domain SM4 S box hardware design;

[0047] Figure 3 The following table shows the TVLA maximum values ​​for different intermediate sensitivity values. Specifically, the TVLA maximum values ​​for different intermediate bits of SM4 at 100,000 and 1,000,000 energy traces are shown. The horizontal axis represents the 32 intermediate bits of SM4 (0, ..., 31), and the vertical axis represents the leakage detection value. A value < 4.5 indicates that no information leakage was detected. DETAILED DESCRIPTION

[0048] The present invention will be further illustrated below with reference to specific examples. The examples are implemented based on the technical solutions of the present invention. It should be understood that these examples are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0049] Example 1

[0050] This embodiment's redundant tower field-based SM4 S-box hardware implementation method derives an implementation framework for embedding the SM4 S-box into the AES redundant tower field through the algebraic mapping relationship between the SM4 S-box and the AES S-box. It further optimizes the affine transformation matrix and constant offset to achieve a compact RTF (Redundant Tower Field)-SM4 round function. It primarily includes four steps: Steps 1 to 4.

[0051] Step 1: Give an AES S-box represented in redundant tower field and represent the affine transformation in little-endian order;

[0052] Step 2: Give the conversion relationship between AES and SM4 S-boxes, and express the affine transformation and constant offset in little-endian format.

[0053] Step 3: Based on steps 1 and 2, a redundant tower domain-based SM4 S-box representation is given.

[0054] Step 4: Combine the redundant tower domain inversion three-stage implementation to achieve the complete SM4 hardware design.

[0055] The above steps are described below in conjunction with specific implementation methods.

[0056] Step 1: Give an AES S-box represented in redundant tower field and represent the affine transformation in little-endian order;

[0057] The inversion based on the redundant tower domain representation is:

[0058] ;

[0059] Where Inv(x) represents the inverse operation on the AES S-box, x represents an 8×1 column vector, which is GF(2 8 ) field; M1 represents an 8×8 affine transformation matrix that maps the input x to GF(2 4 ) 2 Two 4-bit elements (8 bits in total) on the tower domain normal basis (NB); M2 represents the 8×10 affine transformation matrix that can transform the input into GF(2 5 ) 2 Two 5-bit elements (10 bits in total) on the Redundantly Represented Basis (RRB) are mapped to GF (2 8 ) field polynomial basis.

[0060] The AES S-box based on the redundant tower domain representation is:

[0061]

[0062] Among them, S AES represents the S-box of the AES block cipher algorithm, x represents the 8-bit input of the S-box, represented by an 8×1 column vector; y represents the 8-bit output of the S-box, represented by an 8×1 column vector; c represents the 8-bit constant offset, represented by an 8×1 column vector; A represents the 8×8 affine transformation matrix.

[0063] Affine transformations are expressed in little-endian order (Least Significant Bit First):

[0064] ;

[0065] Where B represents an 8×10 affine transformation matrix, which is obtained by multiplying the affine transformation matrix A by the affine transformation matrix M2. The 8-bit output y of the S-box consists of {y7, y6, y5, y4, y3, y2, y1, y0} from high to low, where y0 to y7 represent eight 1-bit elements. The 8-bit input x of the S-box consists of {x7, x6, x5, x4, x3, x2, x1, x0} from high to low, where x0 to x7 represent eight 1-bit elements.

[0066] Step 2: Give the transformation relationship between the S-boxes of AES and SM4, and express the affine transformation and constant offset in little-endian format.

[0067] The conversion relationship between AES and SM4 S-box is:

[0068] ;

[0069] The data that has been affine transformed into big-endian representation is represented in this application in order to be able to be represented uniformly with the affine transformation in the redundant tower domain. Compared with big-endian, the little-endian representation requires the columns and rows to be in reverse order. The specific formula is as follows:

[0070] ;

[0071] Among them, S SM4 (x) represents the S-box of SM4 algorithm, S AES represents the S-box of the AES block cipher algorithm, D2 represents an 8×8 affine transformation matrix, D1 represents an 8×8 affine transformation matrix, c1 represents an 8×1 column vector, and c2 represents an 8×1 column vector.

[0072] Step 3: Based on steps 1 and 2, a redundant tower domain-based SM4 S-box representation is given.

[0073] The SM4 S-box based on the redundant tower domain shows the following specific contents:

[0074] The following formula converts the AES S-box formula S AES After substituting the formula for the redundant tower domain inverse Inv(x) into the relationship between the SM4 S-box and the AES S-box, multiple affine matrices are merged. The process is as follows:

[0075]

[0076] make

[0077] The SM4 S-box formula based on the redundant tower domain can be obtained as follows:

[0078] ;

[0079] Among them, S SM4 represents the SM4 S-box, F1 represents the front affine transformation, F2 represents the back affine transformation, E1 represents the front constant offset, and E2 represents the back constant offset.

[0080] In the above formula, the pre-affine transformation F1 is an 8-row, 8-column matrix transformation, and does not contain nonlinear AND, OR, or NOT gates, but only linear XOR operations. The pre-constant offset E1 is an 8-row, 1-column constant offset.

[0081] The post-affine transformation F2 is a matrix transformation with 8 rows and 10 columns. It does not contain nonlinear AND, OR, or NOT gates, but only linear XOR operations. The post-constant offset E2 is a constant offset with 8 rows and 1 column.

[0082] Step 4: Combine the redundant tower domain inverse three-stage implementation to complete the complete SM4 hardware design.

[0083] This embodiment adopts a three-stage redundant tower domain inversion. For specific implementation methods, please refer to Implementation 2 and Example 3.

[0084] Example 2

[0085] This embodiment provides a specific hardware design process based on redundant tower domain SM4 S box, such as Figure 1 As shown, starting from the input, it includes the front affine transformation and front constant offset, redundant tower domain inversion, back affine transformation and back constant offset. The specific implementation content is as follows:

[0086] S1: Forward affine transformation and forward constant shift

[0087] Input x is GF(2 8 ) field polynomial basis (PB) represented by 8-bit input elements.

[0088] The pre-affine transformation F1 is an 8-row, 8-column matrix transformation that does not contain nonlinear AND, OR, or NOT gates, but only linear XOR operations. The pre-constant offset E1 is an 8-row, 1-column constant offset.

[0089] The front affine transformation and the front constant offset can be calculated together. When x[7:0] is input and y1[7:0] is output, the hardware implementation is as follows.

[0090]

[0091] Among them, 1'b1 represents 1 bit 1, and ^ represents exclusive OR.

[0092] The output of S1 is in the tower domain Using a normal basis, x can be represented by the upper 4 bits {h4, h3, h2, h1} and the lower 4 bits {l4, l3, l2, l1}.

[0093] S2: Redundant tower domain inversion

[0094] like Figure 1 As shown, in this embodiment, the redundant tower domain inversion is implemented in three stages.

[0095] Phase 1: The output of S1 is in the tower domain In the normal basis representation of x, x can be represented by the upper 4 bits {h4, h3, h2, h1} and the lower 4 bits {l4, l3, l2, l1}. Phase 1 calculation and .

[0096] Represents the 16th power of input x, and the output is redundant The above RRB (Redundantly Represented Basis) representation. The high 5 bits of the output are {l4, l3, l2, l1, 1}, and the low 5 bits are {h4, h3, h2, h1, 1}.

[0097] Represents the 17th power of input x, and the output is redundant tower domain The above PRR (Polynomial Ring Representation) representation. The specific calculation method is as follows:

[0098] .

[0099] Among them, + represents exclusive OR, Indicates or, the symbol omitted between two variables is and. 0~ d4 is a single-bit element, indicating Output the corresponding 5 bits; H i,j =h i +h j , L i,j =l i +l j (1≤i<j≤4).

[0100] Phase 2: In the redundant tower area We use PRR (Polynomial Ring Representation) to invert and calculate .

[0101] .

[0102] Among them, e 0~ e4 is a single-bit element, indicating Output the corresponding 5 bits.

[0103] Phase 3: Use RRB multiplication on the redundant tower domain to calculate , find .

[0104]

[0105] Among them, h' 0~ h'4 is a single-bit element, indicating The corresponding high 5 bits are output, F i,j =e i +e j， (1≤i<j≤4). Substitute the above formula h' 0~ h'4 replaced by l' 0~ l'4,L i,j Replace with H i,j , l is replaced by h, and we get The corresponding lower 5 bits are output as l' 0~ l'4.

[0106] S3: Post-affine transformation and post-constant shift

[0107] The post-affine transformation F2 is a matrix transformation with 8 rows and 10 columns. It does not contain nonlinear AND, OR, or NOT gates, but only linear XOR operations. The post-constant offset E2 is a constant offset with 8 rows and 1 column.

[0108] The post-affine transformation and post-constant offset can be combined for calculation. When e[9:0] is input and y[7:0] is output, the hardware implementation is as follows.

[0109]

[0110] The three-stage method for inverting S2 in the redundant tower domain can be found in the reference “[Highly Efficient GF(2 8 )Inversion Circuit based on Redundant GF Arithmetic and its Application to AESDesign,” in CHES 2015, ser. LNCS, T. G¨ uneysu and H. Handschuh, Eds., vol.9293. Springer, 2015, pp. 63–80.].

[0111] Example 3

[0112] The SM4 S-box hardware based on redundant tower domains is combined with side-channel attack protection to ensure the side-channel security of cryptographic hardware. This S-box can be easily combined with gate-level side-channel attack protection solutions such as mask-based ones to achieve a compact and side-channel-resistant SM4 hardware implementation, ensuring the side-channel security of cryptographic hardware and the security of sensitive data.

[0113] Specifically, this embodiment provides a mask protection type redundant tower domain SM4 S box hardware design process (abbreviated as ISW-RTF SM4), such as Figure 2 As shown, starting from the input, it includes three stages: pre-affine transformation and pre-constant shift, masked redundant tower domain inversion, post-affine transformation and post-constant shift. The specific implementation is as follows:

[0114] S1: Pre-affine transformation and pre-constant shift

[0115] There are two variables in the input, input x1 and input x2. Its meaning is to split the input x into two shared factors x1 and x2, satisfying the following conditions: x1 is a random number, and x2 = x^x1. x is the actual input of the SM4 S-box, that is, GF(2 8 ) field polynomial basis (PB). This way, information leakage of any shared factors will not leak the true sensitive intermediate values, making the circuit resistant to first-order side-channel attacks.

[0116] 8-bit input x1, after the pre-affine transformation F1 and pre-constant shift E1, the output is α1, α1 is an 8-bit variable, the upper and lower four bits of which are in the tower domain It is expressed using a normal basis.

[0117] 8-bit input x2, the front affine transformation F1, the output α2, α2 is an 8-bit variable, the upper four bits and the fourth bit are in the tower domain It is expressed using a normal basis.

[0118] S2: Masked redundant tower domain inversion three-stage

[0119] The two 8-bit variables α1 and α2 outputted from the S1 stage, which are represented by a normal basis, are used as the input of the masked redundant tower domain inversion stage 3, and the output is α1 represented by the redundant representation basis RRB. -1 and α2 -1 .

[0120] The three-stage inversion of the masked redundant tower domain can be directly adopted from the reference: [A Compact AESHardware Implementation Secure Against 1st-Order Side-Channel Attacks. ICCD2018:545-552] in III Proposed Implementation B. Masked AES S-box, which describes Stage 1, Stage 2, and Stage 3.

[0121] S3: Post-affine transformation and post-constant shift

[0122] The redundant representation basis RRB output of stage S2 represents α1 -1 and α2 -1 As the input of S3, α1 -1 After the post-affine transformation F2 and the post-constant offset E2, we get y1; α2 -1 After the post-affine transformation F2, y2 is obtained.

[0123] The three-stage method for inverting the masked redundant tower domain can be found in the reference: [A Compact AES Hardware Implementation Secure Against 1st-Order Side-Channel Attacks. ICCD 2018:545-552], which gives a design of the three-stage masked redundant tower domain inversion.

[0124] Evaluation results of the SM4 S-box implemented using the method of the present invention:

[0125] The advantage of the present invention is that it uses efficient redundant tower domains in an SM4 S-box, resulting in an S-box that implements SM4 using basic AND / NOR gates. This SM4 S-box can be easily combined with solutions such as ISW masks, achieving technical advantages in terms of area and throughput per unit area.

[0126] The following is a performance comparison and security evaluation of the SM4 S-box mask implementation based on redundant tower field (RTF) (abbreviated as ISW-RTF SM4) and the SM4 S-box mask implementation based on lookup table (LUT) (abbreviated as RSM-LUT SM4) proposed by the present invention.

[0127] Table 1 compares the performance of SM4 using redundant tower-domain mask implementation and lookup-based mask implementation. On Kintex7, Virtex6, and Spartan6 FPGAs, ISW-RTF SM4 reduces LUT usage by 52% compared to RSM-LUT SM4, while increasing throughput per unit area by 22%-34%. On Spartan3 devices, LUT usage is reduced by 81%, while throughput per unit area increases by 1.38 times. This shows that when using a mask-based protection scheme in combination with redundant tower-domain implementation, both area and throughput per unit area are superior to lookup-based implementation.

[0128] Table 1 Performance comparison of redundant tower domain mask implementation and table lookup mask implementation

[0129]

[0130] Using the collected energy traces of the two SM4 implementations, a test vector leakage assessment (TVLA) is performed on the registers storing sensitive intermediate values ​​in rounds 31 and 32 of SM4. Figure 3 The maximum TVLA test results for different intermediate bits of SM4 at 100,000 and 1,000,000 energy traces are presented. It can be seen that at both 100,000 and 1,000,000 energy traces, the masking scheme implemented using the method of the present invention can protect all bits of SM4's 32-bit round key.

[0131] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for hardware implementation of an SM4 S-box based on redundant tower domains, characterized in that: Through the algebraic mapping relationship between SM4 S-box and AES S-box, the implementation framework of SM4 S-box embedded in AES redundant tower domain is derived. The affine transformation matrix and constant offset are further optimized to realize the compact RTF-SM4 round function, thus realizing the SM4 S-box hardware design. The specific implementation process is as follows: 1) Input data; 2) Perform a pre-affine transformation and a pre-constant shift on the input data; 3) Redundant tower domain inversion, or masked redundant tower domain inversion in three stages; 4) Perform post-affine transformation and post-constant shift to obtain the SM4 S-box hardware.

2. The method for implementing SM4 S-box hardware based on redundant tower domain according to claim 1, characterized in that: The following steps are involved: Step 1: Give an AES S-box represented in redundant tower field, and the affine transformation is represented in little endian order; Step 2: Give the transformation relationship between the S-box of AES and SM4. The affine transformation and constant offset are both expressed in little-endian order. Step 3: Based on steps 1 and 2, give the SM4 S-box representation based on the redundant tower domain; Step 4: Combine the redundant tower domain inverse three-stage implementation to complete the complete SM4 hardware design.

3. The method for implementing SM4 S-box hardware based on redundant tower domain according to claim 2, characterized in that: In step 1, the inversion based on the redundant tower domain representation is: ； Where Inv(x) represents the inverse operation on the AES S-box, x represents the 8-bit input of the S-box, represented by an 8×1 column vector, which is GF(2 8 ) field represents an 8-bit input element; M1 represents an 8×8 affine transformation matrix that maps the input x to GF(2 4 ) 2 Two 4-bit elements represented on the tower domain normal basis; M2 represents the 8×10 affine transformation matrix, which converts the input into GF(2 5 ) 2 Field redundancy represents two 5-bit elements on the basis, mapped to GF(2 8 ) field.

4. The method for implementing SM4 S-box hardware based on redundant tower domain according to claim 3, characterized in that: The AES S-box based on the redundant tower domain representation is: ； Among them, S AES represents the S-box of the AES block cipher algorithm; y represents the 8-bit output of the S-box, represented by an 8×1 column vector; c represents the 8-bit constant offset, represented by an 8×1 column vector; A represents the 8×8 affine transformation matrix.

5. The method for implementing SM4 S-box hardware based on redundant tower domain according to claim 3, characterized in that: Affine transformations are all represented in little-endian order: ； Where B represents an 8×10 affine transformation matrix, which is obtained by multiplying the affine transformation matrix A by the affine transformation matrix M2. The 8-bit output y of the S-box consists of {y7, y6, y5, y4, y3, y2, y1, y0} from high to low, where y0 to y7 represent eight 1-bit elements. The 8-bit input x of the S-box consists of {x7, x6, x5, x4, x3, x2, x1, x0} from high to low, where x0 to x7 represent eight 1-bit elements.

6. The method for implementing SM4 S-box hardware based on redundant tower domain according to claim 2, characterized in that: In step 2, the conversion relationship between the AES and SM4 S-boxes is: ； Among them, S SM4 (x) represents the S-box of SM4 algorithm, S AES represents the S-box of the AES block cipher algorithm, D2 represents an 8×8 affine transformation matrix, D1 represents an 8×8 affine transformation matrix, c1 represents an 8×1 column vector, and c2 represents an 8×1 column vector.

7. The method for implementing SM4 S-box hardware based on redundant tower domain according to claim 6, characterized in that: The D1 and D2 affine transformation matrices and the c1 and c2 constant offsets are all expressed in little-endian format: ； Among them, y0-y7 are single-bit inputs and together constitute the 8-bit output of the SM4 S-box. In little-endian order, the 8-bit output is composed of {y7, y6, y5, y4, y3, y2, y1, y0} from high to low. x0-x7 are single-bit elements and together constitute the 8-bit input of the SM4 S-box. In little-endian order, the 8-bit output is composed of {x7, x6, x5, x4, x3, x2, x1, x0} from high to low.

8. The method for implementing SM4 S-box hardware based on redundant tower domain according to claim 2, characterized in that: In step 3, the SM4 S-box based on the redundant tower domain is expressed as: The formula of AES S box S AES After substituting the formula for the redundant tower domain inversion Inv(x) into the relationship between the SM4 S-box and the AES S-box, multiple affine matrices are merged. The process is as follows: ； make ; The SM4 S-box formula based on the redundant tower domain is obtained as follows: ； Among them, S SM4 represents the S-box of the SM4 algorithm, F1 represents the front affine transformation, F2 represents the back affine transformation, E1 represents the front constant offset, and E2 represents the back constant offset.

9. Application of SM4 S-box hardware based on redundant tower domains to ensure side-channel security of cryptographic hardware, characterized by: SM4 S-box hardware implemented using the method described in any one of claims 1-8.

Images