A mask protection method and device for Advanced Encryption Standard AES algorithm

Abstract

The embodiment of the present application provides a mask protection method and device for the Advanced Encryption Standard AES algorithm, including performing XOR processing on the data carrying the i-th round mask and the key data, reusing N multiplication modules to perform inversion operation and affine transformation, performing row transformation, if i=10, performing mask compensation, and then performing demasking processing, outputting the ciphertext processed by the key data, if i<10, after column confusion, performing mask compensation, obtaining the j-th round data carrying the mask, and continuing to perform the step of performing XOR processing on the j-th round data carrying the mask and the key data, j=i+1, 2≤j≤10. That is to say, when performing the inversion operation, the multiplication module is reused to optimize the inversion operation in the AES algorithm. Compared with the resources required by the multiplication module in other protection methods, the resource overhead occupied by the multiplication module in the present application is greatly reduced, meeting the requirements of reducing the use of resources and reducing resource overhead of the protection method.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a mask protection method and device for an Advanced Encryption Standard (AES) algorithm. Background Art

[0002] With the rapid development of computer and other related technologies, we have entered the information society. Data security is extremely important in many fields such as finance or military. A variety of data protection methods can be used to protect data security.

[0003] Currently, data can be encrypted to protect data security. The commonly used traditional encryption algorithm is the Advanced Encryption Standard (AES) algorithm. However, the AES algorithm can also be cracked by a variety of attack methods. Protection can be carried out against the AES algorithm to enhance data security.

[0004] However, current protection methods use more resources and have higher resource overhead, so there is a need to reduce the resource usage of protection methods. Summary of the invention

[0005] In view of this, the purpose of the present application is to provide a mask protection method and device for the Advanced Encryption Standard AES algorithm, which can reduce the resources used by the protection method and reduce resource overhead.

[0006] To achieve the above purpose, this application has the following technical solutions:

[0007] The present application embodiment provides a mask protection method for the Advanced Encryption Standard AES algorithm, the method comprising:

[0008] XOR the i-th round data carrying the mask with the key data to obtain the first result of the i-th round, 1≤i≤10;

[0009] Multiplexing N multiplication modules to perform an inverse operation and an affine transformation on the first result of the i-th round to obtain a second result of the i-th round, where N is an integer;

[0010] Performing row transformation on the second result of the i-th round to obtain a third result of the i-th round;

[0011] If i=10, mask compensation is performed on the third result of the i-th round, and then demasking is performed to output the ciphertext processed by the key data;

[0012] If i is less than 10, the third result of the i-th round is column-confused to obtain the fourth result of the i-th round, and the fourth result of the i-th round is mask-compensated to obtain the j-th round data carrying the mask, and the step of performing XOR processing on the j-th round data carrying the mask and the key data is continued, j=i+1, 2≤j≤10.

[0013] Optionally, the multiplexing of the N multiplication modules performs an inverse operation and an affine transformation on the first result of the i-th round to obtain the second result of the i-th round includes:

[0014] Reuse N multiplication modules in the finite field GF(2 4 ) processing the first result to obtain a first sub-result;

[0015] In the finite field GF(2 2 ) performing an inverse operation on the first sub-result to obtain a second sub-result;

[0016] Continue to reuse N multiplication modules in the finite field GF(2 4 ) processing the second sub-result to obtain a third sub-result;

[0017] Perform an affine transformation on the third sub-result to obtain the second result.

[0018] Optionally, N is 6, and the N multiplication modules include: a first multiplication module, a second multiplication module, a third multiplication module, a fourth multiplication module, a fifth multiplication module and a sixth multiplication module;

[0019] The multiplexing of N multiplication modules in the finite field GF(2 4 ) processing the first result to obtain a first sub-result including:

[0020] Using the third multiplication module, the fifth multiplication module and the sixth multiplication module in the finite field GF(2 4 ) processing the first result to obtain a first sub-result;

[0021] The N multiplication modules are reused in the finite field GF(2 4 ) processing the second sub-result to obtain a third sub-result comprising:

[0022] Using the first multiplication module, the second multiplication module and the third multiplication module or using the first multiplication module, the fourth multiplication module and the fifth multiplication module in a finite field GF(2 4 ) Process the second sub-result to obtain a third sub-result.

[0023] Optionally, performing mask compensation on the third result of the i-th round includes:

[0024] The third result of the tenth round and the first compensation mask are XORed.

[0025] The performing mask compensation on the fourth result of the i-th round includes:

[0026] The fourth result of the i-th round and the second compensation mask are XOR-ed.

[0027] Optionally, performing XOR processing on the third result of the tenth round and the first compensation mask to obtain a fifth result;

[0028] The demasking process comprises:

[0029] The fifth result is XORed with the target mask.

[0030] The embodiment of the present application provides a mask protection device for an Advanced Encryption Standard (AES) algorithm, the device comprising:

[0031] The first processing unit is used to perform XOR processing on the i-th round data carrying the mask and the key data to obtain the first result of the i-th round, 1≤i≤10;

[0032] A second processing unit is used to multiplex N multiplication modules to perform an inverse operation and an affine transformation on the first result of the i-th round to obtain a second result of the i-th round, where N is an integer;

[0033] A third processing unit, configured to perform row transformation on the second result of the i-th round to obtain a third result of the i-th round;

[0034] a fourth processing unit, configured to, if i=10, perform mask compensation on the third result of the i-th round, then perform demasking processing, and output a ciphertext processed with the key data;

[0035] The fifth processing unit is used to, if i is less than 10, perform column obfuscation on the third result of the i-th round to obtain the fourth result of the i-th round, perform mask compensation on the fourth result of the i-th round to obtain the j-th round data carrying the mask, and continue to execute the step of performing XOR processing on the j-th round data carrying the mask and the key data, j=i+1, 2≤j≤10.

[0036] Optionally, the second processing unit is specifically configured to:

[0037] Reuse N multiplication modules in the finite field GF(2 4 ) processing the first result to obtain a first sub-result;

[0038] In the finite field GF(2 2 ) performing an inverse operation on the first sub-result to obtain a second sub-result;

[0039] Continue to reuse N multiplication modules in the finite field GF(2 4 ) processing the second sub-result to obtain a third sub-result;

[0040] Perform an affine transformation on the third sub-result to obtain the second result.

[0041] Optionally, N is 6, and the N multiplication modules include: a first multiplication module, a second multiplication module, a third multiplication module, a fourth multiplication module, a fifth multiplication module and a sixth multiplication module;

[0042] The second processing unit is specifically configured to:

[0043] Using the third multiplication module, the fifth multiplication module and the sixth multiplication module in the finite field GF(2 4 ) processing the first result to obtain a first sub-result;

[0044] The N multiplication modules are reused in the finite field GF(2 4 ) processing the second sub-result to obtain a third sub-result comprising:

[0045] Using the first multiplication module, the second multiplication module and the third multiplication module or using the first multiplication module, the fourth multiplication module and the fifth multiplication module in a finite field GF(2 4 ) Process the second sub-result to obtain a third sub-result.

[0046] Optionally, the fourth processing unit is specifically configured to:

[0047] The third result of the tenth round and the first compensation mask are XORed.

[0048] The performing mask compensation on the fourth result of the i-th round includes:

[0049] The fourth result of the i-th round and the second compensation mask are XOR-ed.

[0050] Optionally, performing XOR processing on the third result of the tenth round and the first compensation mask to obtain a fifth result;

[0051] The fourth processing unit is specifically configured to:

[0052] The fifth result is XORed with the target mask.

[0053] The embodiment of the present application provides a mask protection method for the Advanced Encryption Standard AES algorithm, including performing XOR processing on the i-th round data carrying the mask and the key data to obtain the first result of the i-th round, 1≤i≤10, multiplexing N multiplication modules to perform inverse operation and affine transformation on the first result to obtain the second result of the i-th round, N is an integer, performing row transformation on the second result of the i-th round to obtain the third result of the i-th round, if i=10, mask compensation is performed on the third result of the i-th round, and then demasking is performed to output the ciphertext processed by the key data; if i<10, column obfuscation is performed on the third result of the i-th round to obtain the fourth result of the i-th round, mask compensation is performed on the fourth result of the i-th round to obtain the j-th round data carrying the mask, and the step of performing XOR processing on the j-th round data carrying the mask and the key data is continued, j=i+1, 2≤j≤10. That is to say, the multiplication module is reused when performing the inversion operation to optimize the inversion operation in the AES algorithm. Compared with the resources required by the multiplication module in other protection methods, the resource overhead occupied by the multiplication module in this application is greatly reduced, meeting the needs of reducing the use of resources and reducing resource overhead of the protection method. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0055] Figure 1 A schematic diagram of a process flow of a mask protection method for an Advanced Encryption Standard AES algorithm provided in an embodiment of the present application is shown;

[0056] Figure 2 A schematic diagram of a mask protection structure of an advanced encryption standard AES algorithm encryption process provided by an embodiment of the present application is shown;

[0057] Figure 3 A finite field GF(2 4 ) on the inverse operation structure diagram;

[0058] Figure 4 A schematic structural diagram of a mask protection device for the Advanced Encryption Standard AES algorithm provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0060] With the rapid development of computer and other related technologies, we have entered the information society. Data security is extremely important in many fields such as finance or military. A variety of data protection methods can be used to protect data security.

[0061] Currently, data can be encrypted to protect data security. The commonly used traditional encryption algorithm is the Advanced Encryption Standard (AES) algorithm, also known as the Rijndael algorithm, which is a block cipher algorithm. The plaintext has a total of 128 bits, and the key can be 128 bits, 192 bits, or 256 bits. The AES algorithm mainly includes four operations: round key addition, byte transformation (Sbox), row transformation, and column confusion.

[0062] The AES algorithm can be cracked by a variety of attack methods, such as side-channel attacks. As a non-invasive passive attack, side-channel attacks do not require entering the chip to directly access internal components, nor do they interfere with the normal operation of the device. Instead, they attack by obtaining external information such as power consumption, running time, and electromagnetic radiation obtained by the device during operation. This external information is called a side channel. Side-channel attacks have the characteristics of low cost, multiple attack methods, and high resource consumption of defense methods. Especially for IC cards and IoT devices, attackers can easily obtain physical parameters generated during operation, so side-channel attacks have become a huge threat to the security of encryption devices. Power consumption analysis attacks, as an important attack method of side-channel attacks, collect power consumption curves during encryption and decryption operations, analyze the relationship between power consumption and data, and obtain encrypted data information.

[0063] Side channel attacks include power analysis attacks, which include the following:

[0064] Simple power analysis (SPA) attacks are used to observe the power consumption of a device during operation to derive the relationship between specific operation details and power consumption. Usually, only one or several energy traces are analyzed. When the noise influence is large, it is difficult to obtain the key by SPA attack alone, so SPA attack is also used as an auxiliary means of other attacks.

[0065] Differential power analysis (DPA) is the most common side channel attack. This attack does not require understanding of the hardware structure of the victim and can obtain encrypted information even under the influence of large noise. DPA attacks require more power consumption traces and can generally be divided into five steps: 1) Select the intermediate value of the executed algorithm. 2) Collect the actual power consumption curve of the encryption process. 3) Calculate the assumed intermediate value based on the assumed key. 4) Select a suitable power consumption model (Hamming weight model / Hamming distance model). 5) Calculate the differential power consumption through the differentiation function to obtain the relationship between the correct key and power consumption.

[0066] Correlation power analysis (CPA) is similar to DPA attack. It uses statistical methods to calculate the relationship between data and power consumption. The difference is that CPA attack calculates the correlation coefficient between actual power consumption and assumed power consumption. CPA attack can also be divided into 5 steps: 1) Select the middle value of the executed algorithm. 2) Collect the actual power consumption curves of multiple groups of plaintext encryption processes. 3) Calculate the assumed middle value based on the assumed key. 4) Select a suitable power consumption model to calculate the theoretical power consumption. 5) Calculate the correlation coefficient between the assumed power consumption and the actual power consumption. According to the size of the correlation coefficient, it can be determined whether the guessed key is correct.

[0067] It can be seen that the above attack methods are all related to power consumption and belong to the category of power consumption analysis attack. The AES algorithm operates in bytes. Since the principle of power consumption analysis attack is to obtain encrypted information related to the intermediate value based on the power consumption distribution, operations such as row transformation and column confusion confuse the data. The intermediate value will be related to more plaintext and keys. Therefore, the power consumption analysis attack mainly considers the byte transformation output of the first or last round as the attack point.

[0068] Therefore, protection can be provided against byte transformations in the AES algorithm to enhance data security.

[0069] Among the current protection methods, mask protection methods have been widely studied due to their low cost and easy algorithm implementation. The principle of mask protection is to cut off or reduce the connection between intermediate values ​​and power consumption by randomizing the intermediate values ​​of the algorithm. Algorithm-level masking protects the intermediate values ​​by introducing random numbers. According to the different operations, it can be divided into Boolean masking and arithmetic masking. Boolean masking is more suitable for masking linear operations such as bitwise XOR, while arithmetic operations are suitable for masking nonlinear parts. Arithmetic masking mainly uses multiplication masking and addition masking, but using multiplication masking alone is vulnerable to zero-value attacks. Since the algorithm-level masking method introduces random numbers, when protecting against higher-order attacks, the masking scheme will bring significant resource overhead and delay.

[0070] That is to say, currently, due to the use of a lookup table to implement the AES algorithm, the resource overhead of the AES algorithm is relatively large, and the mask protection method for the AES algorithm requires the use of more multiplication modules. One multiplication module requires 16 logical AND and 12 XOR operations to implement. More multiplication modules use more resources and have a higher resource overhead. Therefore, there is a need to reduce the resources used by the protection method.

[0071] Based on this, an embodiment of the present application provides a mask protection method for the Advanced Encryption Standard AES algorithm, including performing XOR processing on the i-th round data carrying the mask and the key data to obtain the first result of the i-th round, 1≤i≤10, multiplexing N multiplication modules to perform inverse operation and affine transformation on the first result to obtain the second result of the i-th round, N is an integer, performing row transformation on the second result of the i-th round to obtain the third result of the i-th round, if i=10, mask compensation is performed on the third result of the i-th round, and then demasking is performed to output the ciphertext processed by the key data; if i<10, column confusion is performed on the third result of the i-th round to obtain the fourth result of the i-th round, mask compensation is performed on the fourth result of the i-th round to obtain the j-th round data carrying the mask, and the step of performing XOR processing on the j-th round data carrying the mask and the key data is continued, j=i+1, 2≤j≤10. That is to say, the multiplication module is reused when performing the inversion operation to optimize the inversion operation in the AES algorithm. Compared with the resources required by the multiplication module in other protection methods, the resource overhead occupied by the multiplication module in this application is greatly reduced, meeting the needs of reducing the use of resources and reducing resource overhead of the protection method.

[0072] In order to better understand the technical solution and technical effects of the present application, specific embodiments will be described in detail below with reference to the accompanying drawings.

[0073] refer to Figure 1 As shown, it is a flowchart of a mask protection for the Advanced Encryption Standard AES algorithm provided by an embodiment of the present application, and the method includes the following steps:

[0074] S101, performing XOR processing on the i-th round data carrying the mask and the key data to obtain the first result of the i-th round.

[0075] refer to Figure 2 As shown, it is a schematic diagram of the mask protection structure of the encryption process of the Advanced Encryption Standard AES algorithm provided in an embodiment of the present application.

[0076] In the embodiment of the present application, the AES algorithm can be divided into multiple rounds for encryption, for example, 10 rounds. Before the first round of input data, a mask M is added to the plaintext to obtain the first round of data carrying the mask.

[0077] The masked data of each round can be XORed with the key data, which is the round key addition of the AES algorithm. That is, the masked data of the i-th round is XORed with the key data to obtain the first result of the i-th round, 1≤i≤10. The round key addition is a linear operation, and the result obtained is the result of the operation of the unmasked data plus the result of the mask.

[0078] As an example, the first round data carrying the mask is XORed with the key data to obtain the first result of the first round. Among them, P is plain text, M is mask, and K is key.

[0079] S102, multiplexing N multiplication modules to perform inverse operation and affine transformation on the first result to obtain a second result of the i-th round.

[0080] In an embodiment of the present application, a byte conversion (Sbox) process is performed on the first result of adding a key in each round to obtain a second result in each round.

[0081] As an example, the byte conversion process is in, is a masked Sbox, is the second result, It is the input of the masked byte transformation, i.e. the first result.

[0082] The byte transformation includes an inverse operation and an affine transformation. That is, the first result of the i-th round can be subjected to an inverse operation and an affine transformation to obtain the second result of the i-th round.

[0083] When performing an inverse operation, N multiplication modules can be reused for processing, and the N multiplication modules can be reused, which greatly reduces the resources occupied by the multiplication modules during the inverse operation and reduces resource overhead. Wherein, N is an integer, for example, N can be 6.

[0084] In an embodiment of the present application, the mask protection method is a first-order mask algorithm, which can use 6 multiplication modules, 2 square modules and 2 square post-multiplication constant modules to perform inversion operations.

[0085] As an example, the inverse operation includes the following 6 formulas:

[0086]

[0087] a′ l +m l =(a l +m l )(d′+m l )+(a h +m l )(d′+m l)+(a l +m l )m l +(a h +m l )m l +m l (2)

[0088]

[0089]

[0090] d′ l +m ll =(d l +m ll )(v′+m ll )+(d h +m ll )(v′+m ll )+(d l +m ll )m ll +(d h +m ll )m ll +m ll (5)

[0091]

[0092] Among them, formulas (1)-(3) include 6 multiplication modules: the first multiplication module (a h +m l )(d′+m l ), the second multiplication module (d′+m l )m l , the third multiplication module (a h +m l )m l , the fourth multiplication module (a l +m l )(d′+m l ), the fifth multiplication module (a l +m l )m l and the sixth multiplication module (a h +m l )(a l +m l ).

[0093] In the embodiment of the present application, when performing an inverse operation on the first result of the i-th round, that is, the result after adding the key, the formula (3) can be first used in the finite field GF(2 4 ) Process the first result to obtain the first sub-result d+m 1, and then reduce the domain to the finite field GF(2 4 ) is reduced to the finite field GF(2 2 ), in the finite field GF(2 2 ) on the first subresult d+m 1 Perform the inverse operation, that is, use formulas (3)-(6) to obtain the second sub-result d'+m l , and then continue to reuse the multiplication module to convert the second sub-result d'+m l Back to the finite field GF(2 4 ) is processed, that is, the third sub-result a is obtained by using formulas (1) and (2) h '+m h , a l '+m l .

[0094] refer to Figure 3 As shown, a finite field GF(2 4 ) on the inverse operation structure diagram. As can be seen from the figure, firstly, the third multiplication module (a h +m l )m l , the fifth multiplication module (a l +m l )m l and the sixth multiplication module (a h +m l )(a l +m l ) in the finite field GF(2 4 ) for the first result a h +m h , a l +m l Process and get the first sub-result d+m 1 , and then in the finite field GF(2 2 ) on the first subresult d+m 1 Perform the inverse operation to obtain the second sub-result d'+m l , and then the second sub-result d'+m l Bringing back to formula (1), using the first multiplication module (a) in formula (1) h +m l )(d′+m l ), the second multiplication module (d′+m l )m l and the third multiplication module (a h +m l )m l In the finite field GF(2 4 ) to obtain the third sub-result a h'+m h , the second result d'+m l Bringing back to formula (2), using the first multiplication module (a h +m l )(d′+m l ), the fourth multiplication module (a l +m l )(d′+m l ) and the fifth multiplication module (a l +m l )m l In the finite field GF(2 4 ) to obtain the third sub-result a l '+m l .

[0095] In the embodiment of the present application, for the first sub-result d+m 1 Inverse to get the second sub-result d'+m l In the finite field GF(2 2 ) can reduce the computational complexity, further reduce the resources occupied by the mask protection method, and reduce resource overhead. GF(2 2 ) domain is

[0096] c(x)=(d(x)+h(x)) -1 =d 2 (x)+h 2 (x) = d -1 (x)+h -1 (x)

[0097] It can be seen that when performing byte conversion, data a h , a l , d' mainly uses m l Mask and refer to Figure 3 As shown, from the second sub-result d'+m l Calculate the third sub-result a l '+m l 、a h '+m h The calculation process only needs 3 steps, which greatly speeds up the calculation speed of the mask protection method of the AES algorithm and shortens the calculation time of the mask protection method of the AES algorithm.

[0098] S103, performing row transformation on the second result of the i-th round to obtain a third result of the i-th round.

[0099] In an embodiment of the present application, after performing byte transformation (Sbox) processing on the first result of each round to obtain the second result of each round, the second result of each round is further subjected to row transformation to obtain the third result of each round.

[0100] As an example, the row transformation process is in, is the third result, Sbox(in) is the output of the unmasked byte transformation, For the second result.

[0101] S104, determine whether i is equal to 10.

[0102] In an embodiment of the present application, after the row transformation, it can be determined whether the round is the last round of the AES algorithm, that is, it can be determined whether i is equal to 10, so as to perform different processing on the third result obtained by the row transformation of this round.

[0103] S1041, if i<10, then after performing column obfuscation on the third result of the i-th round, the fourth result of the i-th round is obtained, mask compensation is performed on the fourth result of the i-th round to obtain the j-th round data carrying the mask, and the step of performing XOR processing on the j-th round data carrying the mask and the key data is continued, j=i+1, 2≤j≤10.

[0104] In an embodiment of the present application, if it is not the last round of the AES algorithm, that is, i<10, the third result of the i-th round is column-obfuscated to obtain the fourth result of the i-th round.

[0105] As an example, the calculation process of column confusion can be

[0106]

[0107] in, This is the fourth result.

[0108] Subsequently, mask compensation can be performed on the fourth result of each round except the last round to obtain the jth round data carrying the mask. That is, a new mask M' is introduced in the mask compensation stage in each round. Figure 2 As shown, in the next round, the masked data can be XORed with the key data directly, and the AES algorithm can be restarted for a new round of encryption. Specifically, the fourth result of each round can be XORed with the second compensation mask to achieve mask compensation. The second compensation mask is the result obtained by using the mask compensation operation.

[0109] As an example, the process of mask compensation can be

[0110]

[0111] Among them, comin is the fourth result, mask′ is the mask of the j=i+1th round, that is, the next round mask of the i-th round, and the second compensation mask is

[0112] S1042, if i=10, mask compensation is performed on the third result of the i-th round, and then demasking is performed to output the ciphertext processed by the key data.

[0113] In an embodiment of the present application, if it is the last round of the AES algorithm, there is no need to perform column obfuscation, and mask compensation is directly performed on the third result of the 10th round. Specifically, the third result of the 10th round and the first compensation mask are XORed to obtain the fifth result, thereby realizing mask compensation. The first compensation mask is the result obtained by using the mask compensation operation.

[0114] As an example, the process of mask compensation can be

[0115]

[0116] Among them, comin is the third result, mask′ is the mask of the j=i+1th round, that is, the next round mask of the i-th round, and the first compensation mask is The third result The fifth result obtained by XORing the third result and the first compensation mask is

[0117] In the embodiment of the present application, the fifth result is demasked in the 10th round of the AES algorithm. Specifically, the fifth result can be XORed with the target mask so as to finally output the ciphertext processed with the key data, wherein the target mask is mask′, which is a mask different from the mask used in the 10th round. That is, the demasking process of the last round of the AES algorithm is XORed with the mask M′ of the last round, i.e., the fifth result By XORing it with the target mask mask′, the ciphertext result can be obtained.

[0118] This is because the mask protection method provided in the embodiment of the present application is aimed at first-order simple power consumption analysis attack, differential power consumption analysis attack and relative power consumption analysis attack. The main attack point considered by these three attacks is the output of the byte transformation Sbox. Therefore, after the AES algorithm is completed, a demasking operation is required to obtain an unmasked output result.

[0119] That is, the embodiment of the present application provides a first-order mask protection method, which uses a mask to protect the plain text input, and multiplexes the multiplication module and inverse operation from GF(28 ) domain is reduced to GF(2 4 ) domain and optimized algorithm structure, the calculation process is optimized to 3 steps, which can implement the protected AES encryption algorithm with smaller resource consumption and faster computing speed, and a mask compensation operation is required after each round is completed. After the overall algorithm is completed, a demasking operation is performed before outputting the ciphertext.

[0120] In addition, the composite domain mask method provided in the embodiment of the present application can be applied to other block cipher algorithms, such as SM4, etc., so as to improve the power consumption resistance of other protected encryption algorithms.

[0121] The embodiment of the present application provides a mask protection method for the Advanced Encryption Standard AES algorithm, including performing XOR processing on the i-th round data carrying the mask and the key data to obtain the first result of the i-th round, 1≤i≤10, multiplexing N multiplication modules to perform inverse operation and affine transformation on the first result to obtain the second result of the i-th round, N is an integer, performing row transformation on the second result of the i-th round to obtain the third result of the i-th round, if i=10, mask compensation is performed on the third result of the i-th round, and then demasking is performed to output the ciphertext processed by the key data; if i<10, column obfuscation is performed on the third result of the i-th round to obtain the fourth result of the i-th round, mask compensation is performed on the fourth result of the i-th round to obtain the j-th round data carrying the mask, and the step of performing XOR processing on the j-th round data carrying the mask and the key data is continued, j=i+1, 2≤j≤10. That is to say, the multiplication module is reused when performing the inversion operation to optimize the inversion operation in the AES algorithm. Compared with the resources required by the multiplication module in other protection methods, the resource overhead occupied by the multiplication module in this application is greatly reduced, meeting the needs of reducing the use of resources and reducing resource overhead of the protection method.

[0122] Based on the mask protection method for the Advanced Encryption Standard AES algorithm provided in the above embodiments, the present application embodiment also provides a mask protection device for the Advanced Encryption Standard AES algorithm, see Figure 4 , is a structural diagram of a mask protection device for the Advanced Encryption Standard AES algorithm provided in this embodiment, the device 400 includes:

[0123] The first processing unit 410 is used to perform XOR processing on the i-th round data carrying the mask and the key data to obtain a first result of the i-th round, 1≤i≤10;

[0124] The second processing unit 420 is used to multiplex N multiplication modules to perform an inverse operation and an affine transformation on the first result of the i-th round to obtain a second result of the i-th round, where N is an integer;

[0125] A third processing unit 430 is used to perform row transformation on the second result of the i-th round to obtain a third result of the i-th round;

[0126] The fourth processing unit 440 is configured to, if i=10, perform mask compensation on the third result of the i-th round, and then perform demasking processing to output the ciphertext processed by the key data;

[0127] The fifth processing unit 450 is used to, if i is less than 10, obtain the fourth result of the i-th round after performing column obfuscation on the third result of the i-th round, perform mask compensation on the fourth result of the i-th round to obtain the j-th round data carrying the mask, and continue to execute the step of performing XOR processing on the j-th round data carrying the mask and the key data, j=i+1, 2≤j≤10.

[0128] Optionally, the second processing unit is specifically configured to:

[0129] Reuse N multiplication modules in the finite field GF(2 4 ) processing the first result to obtain a first sub-result;

[0130] In the finite field GF(2 2 ) performing an inverse operation on the first sub-result to obtain a second sub-result;

[0131] Continue to reuse N multiplication modules in the finite field GF(2 4 ) processing the second sub-result to obtain a third sub-result;

[0132] Perform an affine transformation on the third sub-result to obtain the second result.

[0133] Optionally, N is 6, and the N multiplication modules include: a first multiplication module, a second multiplication module, a third multiplication module, a fourth multiplication module, a fifth multiplication module and a sixth multiplication module;

[0134] The second processing unit is specifically configured to:

[0135] Using the third multiplication module, the fifth multiplication module and the sixth multiplication module in the finite field GF(2 4 ) processing the first result to obtain a first sub-result;

[0136] The N multiplication modules are reused in the finite field GF(2 4 ) processing the second sub-result to obtain a third sub-result comprising:

[0137] Using the first multiplication module, the second multiplication module and the third multiplication module or using the first multiplication module, the fourth multiplication module and the fifth multiplication module in a finite field GF(24 ) Process the second sub-result to obtain a third sub-result.

[0138] Optionally, the fourth processing unit is specifically configured to:

[0139] The third result of the tenth round and the first compensation mask are XORed.

[0140] The performing mask compensation on the fourth result of the i-th round includes:

[0141] The fourth result of the i-th round and the second compensation mask are XOR-ed.

[0142] Optionally, performing XOR processing on the third result of the tenth round and the first compensation mask to obtain a fifth result;

[0143] The fourth processing unit is specifically configured to:

[0144] The fifth result is XORed with the target mask.

[0145] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0146] The above is only a preferred implementation of the present application. Although the present application has been disclosed as a preferred embodiment, it is not intended to limit the present application. Any technician familiar with the art can use the above disclosed methods and technical contents to make many possible changes and modifications to the technical solution of the present application without departing from the scope of the technical solution of the present application, or modify it into an equivalent embodiment of equivalent changes. Therefore, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present application without departing from the content of the technical solution of the present application still falls within the scope of protection of the technical solution of the present application.

Claims

1. A mask protection method for the Advanced Encryption Standard AES algorithm, characterized in that: The method comprises: XOR the i-th round data carrying the mask with the key data to obtain the first result of the i-th round, 1≤i≤10; Multiplexing N multiplication modules to perform an inverse operation and an affine transformation on the first result of the i-th round to obtain a second result of the i-th round, where N is an integer; Performing row transformation on the second result of the i-th round to obtain a third result of the i-th round; If i=10, mask compensation is performed on the third result of the i-th round, and then demasking is performed to output the ciphertext processed by the key data; If i is less than 10, the third result of the i-th round is column-confused to obtain the fourth result of the i-th round, and the fourth result of the i-th round is mask-compensated to obtain the j-th round data carrying the mask, and the step of performing XOR processing on the j-th round data carrying the mask and the key data is continued, j=i+1, 2≤j≤10.

2. The method according to claim 1, characterized in that The multiplexing of the N multiplication modules performs an inverse operation and an affine transformation on the first result of the i-th round to obtain the second result of the i-th round includes: Reuse N multiplication modules in the finite field GF(2 4 ) processing the first result to obtain a first sub-result; In the finite field GF(2 2 ) performing an inverse operation on the first sub-result to obtain a second sub-result; Continue to reuse N multiplication modules in the finite field GF(2 4 ) processing the second sub-result to obtain a third sub-result; Perform an affine transformation on the third sub-result to obtain the second result.

3. The method according to claim 2, characterized in that The N is 6, and the N multiplication modules include: a first multiplication module, a second multiplication module, a third multiplication module, a fourth multiplication module, a fifth multiplication module and a sixth multiplication module; The multiplexing of N multiplication modules in the finite field GF(2 4 ) processing the first result to obtain a first sub-result including: Using the third multiplication module, the fifth multiplication module and the sixth multiplication module in the finite field GF(2 4 ) processing the first result to obtain a first sub-result; The N multiplication modules are reused in the finite field GF(2 4 ) processing the second sub-result to obtain a third sub-result comprising: Using the first multiplication module, the second multiplication module and the third multiplication module or using the first multiplication module, the fourth multiplication module and the fifth multiplication module in a finite field GF(2 4 ) Process the second sub-result to obtain a third sub-result.

4. The method according to any one of claims 1 to 3, characterized in that: The performing mask compensation on the third result of the i-th round includes: Performing XOR processing on the third result of the tenth round and the first compensation mask; The performing mask compensation on the fourth result of the i-th round includes: The fourth result of the i-th round and the second compensation mask are XOR-ed.

5. The method according to claim 4, characterized in that XOR processing is performed on the third result of the tenth round and the first compensation mask to obtain a fifth result; The demasking process comprises: The fifth result is XORed with the target mask.

6. A mask protection device for the Advanced Encryption Standard AES algorithm, characterized in that: The device comprises: The first processing unit is used to perform XOR processing on the i-th round data carrying the mask and the key data to obtain the first result of the i-th round, 1≤i≤10; A second processing unit is used to multiplex N multiplication modules to perform an inverse operation and an affine transformation on the first result of the i-th round to obtain a second result of the i-th round, where N is an integer; A third processing unit, configured to perform row transformation on the second result of the i-th round to obtain a third result of the i-th round; a fourth processing unit, configured to, if i=10, perform mask compensation on the third result of the i-th round, then perform demasking processing, and output a ciphertext processed with the key data; The fifth processing unit is used to, if i is less than 10, perform column obfuscation on the third result of the i-th round to obtain the fourth result of the i-th round, perform mask compensation on the fourth result of the i-th round to obtain the j-th round data carrying the mask, and continue to execute the step of performing XOR processing on the j-th round data carrying the mask and the key data, j=i+1, 2≤j≤10.

7. The device according to claim 6, characterized in that The second processing unit is specifically configured to: Reuse N multiplication modules in the finite field GF(2 4 ) processing the first result to obtain a first sub-result; In the finite field GF(2 2 ) performing an inverse operation on the first sub-result to obtain a second sub-result; Continue to reuse N multiplication modules in the finite field GF(2 4 ) processing the second sub-result to obtain a third sub-result; Perform an affine transformation on the third sub-result to obtain the second result.

8. The device according to claim 7, characterized in that The N is 6, and the N multiplication modules include: a first multiplication module, a second multiplication module, a third multiplication module, a fourth multiplication module, a fifth multiplication module and a sixth multiplication module; The second processing unit is specifically configured to: Using the third multiplication module, the fifth multiplication module and the sixth multiplication module in the finite field GF(2 4 ) processing the first result to obtain a first sub-result; The N multiplication modules are reused in the finite field GF(2 4 ) processing the second sub-result to obtain a third sub-result comprising: Using the first multiplication module, the second multiplication module and the third multiplication module or using the first multiplication module, the fourth multiplication module and the fifth multiplication module in a finite field GF(2 4 ) Process the second sub-result to obtain a third sub-result.

9. The device according to any one of claims 6 to 8, characterized in that: The fourth processing unit is specifically configured to: Performing XOR processing on the third result of the tenth round and the first compensation mask; The performing mask compensation on the fourth result of the i-th round includes: The fourth result of the i-th round and the second compensation mask are XOR-ed.

10. The device according to claim 9, characterized in that XOR processing is performed on the third result of the tenth round and the first compensation mask to obtain a fifth result; The fourth processing unit is specifically configured to: The fifth result is XORed with the target mask.

Images