Lightweight Hash function construction method based on parallel circular shift register

Abstract

The present invention discloses a lightweight Hash function construction method based on parallel circular shift register, including: initialization, grouping input messages of any length according to a preset fixed length, and padding the groups that do not meet the length; constructing a compression function based on the block cipher BPRR, and outputting a message digest of a specified length through absorption and extraction. The present invention has the characteristics of high efficiency and low hardware implementation cost, and its efficiency is close to that of a conventional Hash function. It is more suitable for communication between resource-constrained and unconstrained devices than other lightweight Hash functions, and is mainly used for identity authentication, data verification, key exchange and digital signature in resource-constrained environments.

Description

Technical Field

[0001] The present invention relates to the field of secure communication technology, and in particular to a lightweight Hash function construction method based on a parallel circular shift register (HPRR), which is mainly used for identity authentication, data verification, key exchange and digital signature in a resource-constrained environment. Background Art

[0002] The rapid development of the Internet of Things has brought great convenience to people, but it has also brought new challenges to the integrity and non-forgeability of user data. Resource-constrained devices are strictly limited in computing power, memory space and other resources, making it difficult to use traditional hash functions in these devices. Therefore, the research on lightweight hash functions is extremely necessary. In recent years, some new lightweight hash functions have been announced, such as SPONGENT, Quark, GLUON, SQUASH and PHOTON, which provide great support for digital signatures, message integrity detection and security protocol design in resource-constrained devices. Due to the lack of a unified standard, the efficiency of the software and hardware implementation of these passwords is also different. At the same time, some new iterative structures, such as the Sponge structure, also bring new ideas to the design of lightweight hash functions.

[0003] The key to lightweight hash function design lies in compression function and iteration structure. A secure iteration structure is crucial for the design of lightweight hash functions. Some commonly used iteration structures include MD structure, Rabin structure, DM structure, HAIFA structure and Sponge structure. After selecting the iteration structure, the design of lightweight hash functions is divided into permutation function-based and block cipher-based design methods according to the different compression functions. Sponge structure is suitable for the design of lightweight hash functions because of its simple structure, no forward feedback and random oracle properties, such as SPONGENT, PHOTON, etc.

[0004] Most of the current lightweight hash functions have excellent hardware implementation cost, but low software and hardware implementation efficiency. Therefore, the lightweight hash function HPRR of the present invention improves the software and hardware implementation efficiency on the basis of ensuring security and hardware implementation cost.

[0005] The invention with publication number CN107769911A mentions a lightweight hash function construction method based on the Sponge structure. The Sponge structure is an iterative structure, and its internal operation is a compression function. The specific method is: the pre-processed message is subjected to multiple rounds of compression function iterations to complete the absorption operation, that is, the variable-length message is converted into a fixed-length intermediate state; then the intermediate state is subjected to multiple rounds of compression function iterations, and a substring is output in each round, which are spliced ​​into a fixed-length message digest. The hash function constructed by the invention has both security guarantees and meets lightweight requirements. However, the invention does not involve the application of block ciphers based on parallel circular shift registers.

[0006] The invention with publication number CN104954141A mentions a lightweight Hash function HVH encoding technology, HVH supports message digests of three different lengths: 72bit, 88bit, and 128bit. Similarly, the invention does not involve the application of block ciphers based on parallel circular shift registers. Summary of the invention

[0007] In view of the deficiencies in the prior art, the present invention provides a lightweight Hash function construction method based on parallel circular shift register (HPRR), which has the characteristics of low hardware implementation cost and high software and hardware implementation efficiency. It is mainly used for identity authentication, data verification, key exchange and digital signature in resource-constrained environments.

[0008] To achieve the above object, the present invention adopts the following technical solutions:

[0009] The embodiment of the present invention proposes a lightweight Hash function construction method based on a parallel circular shift register, and the construction method comprises the following steps:

[0010] S1, initialization: group the input message M of any length into groups according to the preset fixed length r, and fill in the groups that do not meet the preset fixed length r;

[0011] S2, absorption phase: grouping messages into M i After XOR operation, it is mixed into the internal state B, and a compression function is constructed based on the block cipher BPRR. The compression function BPRR is used to update the internal state B until all message packets are absorbed. i = 1, 2, ..., k, where k is the total number of packets.

[0012] S3, extraction phase: output some bits of the internal state B as a partial message digest, and then use the compression function BPRR to update the internal state B until the total length of the output reaches the length requirement of the message digest.

[0013] Furthermore, in step S1, the size r of each packet is 8 bits, the message summary length N is 128 bits, and the capacity c is 120 bits; when the input message length is exactly a multiple of r, it directly enters the absorption stage, otherwise a character string including a "1" and several "0"s is added after the input message so that the length of the padded input message is exactly a multiple of r.

[0014] In step S2, the absorption stage includes the following steps:

[0015] S21, the internal state B is represented as 4 32-bit words cascaded, B = (B 0 ||B 1 ||B 2 ||B 3 );

[0016] S22, let i=1;

[0017] S23, group the first r bits of the internal state B with the r-bit message M i XOR, use the XOR result to update the first r bits of the internal state B;

[0018] S24, iterate in accordance with the following formula, each round of iteration uses the parallel circular shift register PRR to update the internal state B, and the internal state B is updated once after 20 rounds of iteration:

[0019] B 0 =B 0 +B 1 +B 2 +B 3 ; B 1 =(B 0 <<<(m&31))+B 1 +1;

[0020] B 2 =(B 0 <<<[(m+1)&31])+B 2 +3; B 3 =(B 0 <<<[(m+2)&31])+B 3 +5;

[0021] The initial value of m is 1, and it is updated to m=m+3 after each iteration.

[0022] S25, let i=i+1, repeat steps S23 to S24 until i=k+1, all message groups are absorbed, and k is the number of groups of message M.

[0023] Further, in step S3, the extraction stage includes the following steps:

[0024] S31, let i=1;

[0025] S32, taking the first r bits of the internal state B as output, iterates in combination with the following formula, and uses the parallel circular shift register PRR to update B in each iteration. After 20 iterations, the internal state B is updated once:

[0026] B 0 =B 0 +B 1 +B 2 +B 3 ; B 1 =(B 0 <<<(m&31))+B 1 +1;

[0027] B 2 =(B 0 <<<[(m+1)&31])+B 2 +3; B 3 =(B 0 <<<[(m+2)&31])+B 3 +5

[0028] The initial value of m is 1, and it is updated to m=m+3 after each iteration.

[0029] S33, let i=i+1, repeat steps S32 to S33 until the output length reaches the message digest length N, and obtain an N-bit message digest H, H=(H 1 ||H 2 ||……||H t ).

[0030] The beneficial effects of the present invention are:

[0031] The hardware implementation of the lightweight Hash function construction method (HPRR) based on parallel circular shift register provided by the present invention requires 1128GE, which meets the hardware cost requirements of lightweight passwords. Tests and analysis show that HPRR meets the security requirements of lightweight Hash functions, and its efficiency is better than that of most lightweight Hash functions, including DM-PRESENT-80, and its hardware cost is also less than that of the password. The present invention has the characteristics of high efficiency and low hardware implementation cost. Its efficiency is close to that of conventional Hash functions. It is more suitable for communication between resource-constrained and unconstrained devices than other lightweight Hash functions. It is mainly used for identity authentication, data verification, key exchange and digital signature in resource-constrained environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1The diagram is a structural diagram of a lightweight hash function HPRR based on a parallel circular shift register according to an embodiment of the present invention.

[0033] In the figure: ⊕ represents XOR; M represents input message; H represents message digest; PRR represents parallel circular shift register; BPRR represents lightweight block cipher based on parallel circular shift register. DETAILED DESCRIPTION

[0034] The present invention will now be described in further detail with reference to the accompanying drawings.

[0035] It should be noted that the terms such as "upper", "lower", "left", "right", "front", "back", etc. cited in the invention are only for the convenience of description and are not used to limit the scope of implementation of the present invention. Changes or adjustments in their relative relationships should be regarded as the scope of implementation of the present invention without substantially changing the technical content.

[0036] The embodiment of the present invention proposes a lightweight Hash function construction method based on a parallel circular shift register (HPRR), and the construction method comprises the following steps:

[0037] S1, initialization: group the input message M of any length into groups according to a preset fixed length r, and fill in the groups that do not meet the preset fixed length r.

[0038] S2, absorption phase: grouping messages into M i After XOR operation, it is mixed into the internal state B, and a compression function is constructed based on the block cipher BPRR. The compression function BPRR is used to update the internal state B until all message packets are absorbed. i = 1, 2, ..., k, where k is the total number of packets.

[0039] S3, extraction phase: output some bits of the internal state B as a partial message digest, and then use the compression function BPRR to update the internal state B until the total length of the output reaches the length requirement of the message digest.

[0040] Figure 1 Schematic diagram of the structure of the lightweight Hash function HPRR based on parallel circular shift register of the present invention. Figure 1 The construction method of this embodiment is designed based on the Sponge structure and the compression function is constructed based on the block cipher BPRR. The specific implementation of HPRR includes the following steps:

[0041] (1) Initialization. Group the input message M of any length into 8 bits, and perform padding operations on the groups that do not meet the length requirements. The group size r of HPRR is 8 bits, the message digest length N is 128 bits, and the capacity c is 120 bits. When the input message length is exactly a multiple of r, it directly enters the absorption phase. Otherwise, a string of "1" and several "0" is added to the input message so that the length of the padded input message is exactly a multiple of r.

[0042] (2) Absorption stage. The program code of the absorption stage includes:

[0043]

[0044]

[0045] After 20 iterations, the internal state is updated once until all message groups are absorbed.

[0046] (3) Extraction stage. The program code of the extraction stage includes:

[0047]

[0048] After 20 iterations, the internal state is updated once until the output length reaches the message digest length N, and an N-bit message digest H is obtained.

[0049] Compared with existing lightweight hash functions, HPRR has the following advantages:

[0050] (1) Good avalanche (diffusion and confusion) effect. The present invention uses dependency testing to detect the avalanche effect. The test results are shown in Table 1. sa represents the strict avalanche criterion, d a Indicates the avalanche effect degree, d c Indicates completeness.

[0051] Table 1 HPRR dependence test results

[0052]

[0053] The reference value is obtained from the test results of commonly used algorithms. The test results show that all the indicators of HPRR meet the standards of dependency testing, so HPRR has a good avalanche effect.

[0054] (2) The output has good pseudo-randomness. The present invention uses the NIST test suite to evaluate the pseudo-randomness of the output sequence of the HPRR in the OFB working mode. The test results are shown in Table 2.

[0055] Table 2 Pseudo-randomness test results of HPRR-OFB ​​output

[0056]

[0057]

[0058] For NIST testing, if the calculated result is the acceptance level P v <0.01, the output sequence is considered non-random; if P v ≥0.01, the output sequence is considered random. The output sequence of HPRR-OFB ​​passes all 15 tests, so the output sequence of HPRR-OFB ​​has good pseudo-randomness; and the previous test shows that HPRR has a good avalanche effect, so HPRR can better hide the statistical relationship between the output summary and the input message.

[0059] (3) Low hardware implementation cost. The number of GEs required for the hardware implementation of HPRR and other lightweight hash functions is shown in Table 3. The hardware implementation cost of HPRR is low.

[0060] Table 3 Hardware consumption comparison between HPRR and other lightweight hash functions

[0061]

[0062] (4) High efficiency. The speed of generating message digests by HPRR and other lightweight hash functions is shown in Table 4 under the Intel(R) Core(TM) CPU i5-6300HQ, 2.3GHz, 8GB memory, and C++ programming environment. The test results show that HPRR is better than most other lightweight hash functions, including DM-PRESENT-80 using the DM structure. The hardware implementation cost is also less than DM-PRESENT-80, and the efficiency is close to that of conventional hash functions.

[0063] Table 4 Speed ​​comparison of HPRR and other lightweight hash functions

[0064]

[0065] (5) Security. The security of HPRR is verified by differential analysis, linear analysis, impossible differential analysis, preimage attack, second preimage attack, and collision attack. The compression function of HPRR is designed using the block cipher BPRR, so some of the analysis of BPRR is also applicable to HPRR.

[0066] (a) Differential analysis: When the differential provided by the constant is not taken into account and the number of cyclic shifts is fixed to 1, a type of differential path with a high probability of propagating from itself to itself after two rounds of iterations is found. The overall probability of this type of differential is 2-5 , so the differential probability of HPRR-64 after 30 rounds of compression function iteration is 2 -75 <2 -64 , so HPRR-64 can resist differential analysis. For HPRR-128, each round of iteration has three different cyclic shift numbers and three constants, and the probability of differential modulus addition of four words is smaller, so 20 rounds of HPRR-128 can provide at least 2 120 Therefore, HPRR has a good ability to resist differential analysis and meets the security requirements of lightweight hash functions.

[0067] (b) Impossible differential analysis: Through analysis, it can be seen that the impossible differential feature of BPRR-64 is at most 13 rounds, including 7 rounds of encryption and 6 rounds of decryption. The reason why the BPRR-64 algorithm can be attacked to 13 rounds is mainly because the number of cyclic shifts is gradually increasing, and the update of the first word differential does not involve cyclic shifts, so the speed at which the uncertain bit propagates to the last bit is slow. In BPRR-128, there are three different cyclic shift numbers in each round and they increase faster, so the speed at which the uncertain bit propagates to the last bit is also faster, so the number of impossible differential attack rounds is less than 13 rounds. Therefore, the hash function HPRR based on the block cipher BPRR can fully resist impossible differential analysis and meet the security requirements of lightweight hash functions.

[0068] The above are only preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should be regarded as the protection scope of the present invention.

Claims

1. A lightweight Hash function construction method based on parallel circular shift register, characterized in that: The construction method The following steps are involved: S1, initialization: group the input message M of any length into groups according to the preset fixed length r, and fill in the groups that do not meet the preset fixed length r; S2, absorption phase: grouping messages into M i After XOR operation, it is mixed into the internal state B, and a compression function is constructed based on the block cipher BPRR. The compression function BPRR is used to update the internal state B until all message packets are absorbed. i = 1, 2, ..., k, where k is the total number of packets. S3, extraction phase: output some bits of the internal state B as a partial message digest, and then use the compression function BPRR to update the internal state B until the total length of the output reaches the length requirement of the message digest; In step S2, the absorption stage includes the following steps: S21, represent the internal state B as 4 32-bit words concatenated, B = (B0||B1||B2||B3); S22, let i=1; S23, group the first r bits of the internal state B with the r-bit message M i XOR, use the XOR result to update the first r bits of the internal state B; S24, iterate in accordance with the following formula, each round of iteration uses the parallel circular shift register PRR to update the internal state B, and the internal state B is updated once after 20 rounds of iteration: B0=B0+B1+B2+B3; B1=(B0<<<(m&31))+B1+1; B2=(B0<<<[(m+1)&31])+B2+3; B3=(B0<<<[(m+2)&31])+B3+5; The initial value of m is 1, and it is updated to m=m+3 after each iteration. S25, let i=i+1, repeat steps S23 to S24 until i=k+1, all message groups are absorbed, k is the number of groups of message M; In step S3, the extraction stage includes the following steps: S31, let i=1; S32, taking the first r bits of the internal state B as output, iterates in combination with the following formula, and uses the parallel circular shift register PRR to update B in each iteration. After 20 iterations, the internal state B is updated once: B0=B0+B1+B2+B3; B1=(B0<<<(m&31))+B1+1; B2=(B0<<<[(m+1)&31])+B2+3; B3=(B0<<<[(m+2)&31])+B3+5 The initial value of m is 1, and it is updated to m=m+3 after each iteration. S33, let i=i+1, repeat steps S32 to S33 until the output length reaches the message digest length N, and obtain an N-bit message digest H, H=(H1||H2||...||H N ).

2. The method for constructing a lightweight Hash function based on a parallel circular shift register according to claim 1, characterized in that: In step S1, the size r of each packet is 8 bits, the message digest length N is 128 bits, and the capacity c is 120 bits; when the length of the input message is exactly a multiple of r, it directly enters the absorption stage, otherwise a character string including a "1" and several "0"s is added after the input message so that the length of the padded input message is exactly a multiple of r.

Images