Method, device and equipment for implementing block cipher algorithm

Abstract

This application discloses a method, apparatus, and device for implementing a block cipher algorithm. The method comprises: obtaining plaintext data to be encrypted; encrypting the plaintext data using a first block cipher algorithm to obtain ciphertext data; wherein an instruction set is used to calculate a round function in the first block cipher algorithm, the round function including a nonlinear transformation, and the instruction set including instructions for solving the nonlinear transformation; and outputting the ciphertext data. This method can improve the computational efficiency of the block cipher algorithm implementation.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to a method, apparatus and device for implementing a block cipher algorithm. Background Art

[0002] A block cipher algorithm processes data in chunks of a specific length at a time. For example, the SM4 algorithm is a commonly used block cipher primarily used for data encryption. The SM4 algorithm includes encryption and decryption algorithms and key expansion algorithms, both of which use a 32-round nonlinear iterative structure.

[0003] In traditional technology, block cipher algorithms (for example, the SM4 algorithm) can be implemented based on software. However, this implementation requires performing a large number of operations and executing a large number of corresponding instructions, resulting in more system overhead and lower computational efficiency when implementing block cipher algorithms based on this method. Summary of the Invention

[0004] The present application provides a method, apparatus and device for implementing a block cipher algorithm, which can improve the computational efficiency of the block cipher algorithm.

[0005] An embodiment of the present application provides a method for implementing a block cipher algorithm, comprising: obtaining plaintext data to be encrypted; encrypting the plaintext data to be encrypted using a first block cipher algorithm to obtain ciphertext data, wherein an instruction set is used to implement calculation of a round function in the first block cipher algorithm, the round function includes a nonlinear transformation, and the instruction set includes instructions for solving the nonlinear transformation; and outputting the ciphertext data.

[0006] Optionally, the plaintext data to be encrypted is encrypted using a first block cipher algorithm to obtain ciphertext data, wherein the calculation of the round function in the first block cipher algorithm is implemented using an instruction set, including: obtaining input data of the nonlinear transformation, wherein the input data of the nonlinear transformation is determined based on a round key and the plaintext data, and the input data of the nonlinear transformation is data in a first finite field, and the first finite field is a finite field of the first cipher block algorithm; in a second finite field, using the instruction set to implement the nonlinear transformation on the input data of the nonlinear transformation to obtain a result of the nonlinear transformation, wherein the result of the nonlinear transformation is data in the second finite field, and the second finite field is a finite field of the second block cipher algorithm, the second finite field is isomorphic to the first finite field, and the first block cipher algorithm is different from the second block cipher algorithm; and obtaining the ciphertext data according to the result of the nonlinear transformation, wherein the ciphertext data is data in the first finite field.

[0007] Optionally, the nonlinear transformation includes a first affine transformation and a first inverse affine transformation, and the nonlinear transformation is implemented in the second finite field using the instruction set to obtain the result of the nonlinear transformation, including: using the first instruction in the instruction set to perform the first affine transformation on the first data, the second data and the input data of the nonlinear transformation to obtain the first affine transformation result, wherein the first data is data mapped from a preset matrix to the second finite field according to the isomorphic matrix, and the second data is data mapped from a preset vector to the second finite field according to the isomorphic matrix, and the isomorphic matrix is used to indicate the isomorphic relationship; using the second instruction in the instruction set to perform the first inverse affine transformation on the preset matrix, the preset vector and the first affine transformation result to obtain the result of the nonlinear transformation.

[0008] Optionally, the nonlinear transformation includes a first affine transformation, a second affine transformation and an inverse transformation, and the nonlinear transformation is implemented in the second finite field using the instruction set to obtain the result of the nonlinear transformation, including: using the first instruction in the instruction set to perform a first affine transformation on the mapping result of the first data, the second data and the input data to obtain the first affine transformation result, wherein the mapping result of the input data is to map the input data to data in the second finite field according to the isomorphic matrix, the first data is to map a preset matrix to data in the second finite field according to the isomorphic matrix, the second data is to map a preset vector to data in the second finite field according to the isomorphic matrix, and the isomorphic matrix is used to indicate the isomorphic relationship; using the second instruction in the instruction set to perform the inverse transformation on the first affine transformation result to obtain the result of the inverse transformation; using the first instruction to perform a second affine transformation on the first data, the second data and the result of the inverse transformation to obtain the result of the nonlinear transformation.

[0009] Optionally, the round function also includes a linear transformation, and obtaining the ciphertext data based on the result of the nonlinear transformation includes: performing the linear transformation on the result of the nonlinear transformation to obtain the result of the linear transformation; performing an XOR operation on the result of the linear transformation and the internal state of the first block cipher algorithm to obtain the output result of the round function, and the internal state of the first block cipher algorithm is associated with the input data of the nonlinear transformation; when the round key is the key used for the last round of iterative calculation in the first block cipher algorithm, the mapping result of the output result of the round function obtained by the last four rounds of iterative calculation in the first block cipher algorithm is reversed, and the result obtained by the reversed arrangement is determined as the ciphertext data, and the mapping result of the output result of the round function obtained by any round of iterative calculation is the result of mapping the output result of the round function obtained by any round of iterative calculation to the first finite field using the isomorphic matrix.

[0010] Optionally, performing the linear transformation on the result of the nonlinear transformation to obtain the result of the linear transformation includes: performing a circular shift operation on the result of the nonlinear transformation to obtain the result of the circular shift operation; using the first instruction to perform the linear transformation on the result of the circular shift operation according to a linear preset matrix set to obtain the result of the linear transformation, and the number of preset matrices included in the preset matrix set is associated with the result of the circular shift operation.

[0011] Optionally, the nonlinear transformation includes a first affine transformation and a first inverse affine transformation, and performing the nonlinear transformation on input data of the nonlinear transformation using the instruction set in the second finite field to obtain a result of the nonlinear transformation includes:

[0012] The first affine transformation is performed on the mapping result of the first data, the second data and the input data using the first instruction in the instruction set to obtain the first affine transformation result, wherein the mapping result of the input data is data obtained by mapping the input data to the second finite field according to the isomorphic matrix, the first data is data obtained by mapping the preset matrix to the second finite field according to the isomorphic matrix, and the second data is data obtained by mapping the preset vector to the second finite field according to the isomorphic matrix, and the isomorphic matrix is used to indicate the isomorphic relationship; a circular shift operation is performed on the first affine transformation result to obtain the circular shift operation result; the first inverse affine transformation is performed on the circular shift operation result, the third data and the fourth data using the second instruction in the instruction set to obtain the result of the nonlinear transformation, wherein the third data is data obtained by mapping the dot product result of the preset matrix set and the preset matrix to the second finite field, and the fourth data is data obtained by mapping the preset matrix set and the preset vector to the second finite field.

[0013] Optionally, obtaining the ciphertext data according to the result of the nonlinear transformation includes: performing an XOR operation on the result of the nonlinear transformation and the internal state of the first block cipher algorithm to obtain the output result of the round function, the internal state of the first block cipher algorithm being associated with the input data of the nonlinear transformation; when the round key is the key used for the last round of iterative calculation in the first block cipher algorithm, arranging the mapping results of the output results of the round function obtained by the last four rounds of iterative calculation in the first block cipher algorithm in reverse order, and determining the results obtained by the reverse arrangement as the ciphertext data, the mapping result of the output result of the round function obtained by any round of iterative calculation is the result of mapping the output result of the round function obtained by any round of iterative calculation to the first finite field using the isomorphic matrix.

[0014] Optionally, the method further includes: mapping the input data of the nonlinear transformation into the second finite field using the first instruction in the instruction set and the isomorphic matrix to obtain a mapping result of the input data.

[0015] Optionally, the first block cipher algorithm is the national secret SM4 algorithm, and the second block cipher algorithm is the Advanced Encryption Standard AES.

[0016] Optionally, the instruction set is a GFNI instruction set, the first instruction is a VGF2P8AFFINEQB instruction, and the second instruction is a VGF2P8AFFINEINVQB instruction.

[0017] Optionally, any one of the instructions included in the instruction set is implemented using an application programming interface API in any one of the following languages: assembly language, C language, or C++ language.

[0018] Optionally, the width of an operand corresponding to any instruction included in the instruction set is the same as the number of bits of a register associated with the operand corresponding to the any instruction.

[0019] An embodiment of the present application provides a method for implementing a block cipher algorithm, including: obtaining ciphertext data to be decrypted; decrypting the decrypted data to be decrypted using a first block cipher algorithm to obtain plaintext data, wherein an instruction set is used to implement calculation of a round function in the first block cipher algorithm, the round function includes a nonlinear transformation, and the instruction set includes instructions for solving the nonlinear transformation; and outputting the plaintext data.

[0020] It is understandable that the implementation principle of the decryption algorithm provided in the embodiment of the present application is the same as the implementation principle of the encryption algorithm. Therefore, for the contents not described in detail in this part, please refer to the implementation process of the encryption algorithm above. For example, when the first block cipher algorithm is the SM4 algorithm, the working principle of the encryption algorithm included in the SM4 algorithm is the same as the working principle of the decryption algorithm. The difference is that the order of the round keys used in the decryption algorithm is in reverse order to the order of the round keys used in the encryption algorithm. For example, when implementing the SM4 encryption algorithm, the round keys used in the 32-round iterative calculation of the round function are: (rk0,rk1,......,rk 31 ). Therefore, the round keys (rk0, rk1, ..., rk 31 ) is replaced by (rk 31 ,rk 30 ,……,rk0), the SM4 decryption algorithm can be implemented.

[0021] An embodiment of the present application provides a device for implementing a block cipher algorithm, comprising: an acquisition unit for acquiring plaintext data to be encrypted; a processing unit for encrypting the plaintext data to be encrypted using a first block cipher algorithm to obtain ciphertext data, wherein an instruction set is used to implement the calculation of a round function in the first block cipher algorithm, the round function includes a nonlinear transformation, and the instruction set includes instructions for solving the nonlinear transformation; and an output unit for outputting the ciphertext data.

[0022] Optionally, the processing unit is further used to: obtain input data of the nonlinear transformation, wherein the input data of the nonlinear transformation is determined based on the round key and the plaintext data, and the input data of the nonlinear transformation is data in a first finite field, and the first finite field is the finite field of the first cryptographic block algorithm; in a second finite field, use the instruction set to implement the nonlinear transformation on the input data of the nonlinear transformation to obtain a result of the nonlinear transformation, wherein the result of the nonlinear transformation is data in the second finite field, the second finite field is the finite field of the second block cipher algorithm, the second finite field is isomorphic to the first finite field, and the first block cipher algorithm is different from the second block cipher algorithm; obtain the ciphertext data according to the result of the nonlinear transformation, and the ciphertext data is the data in the first finite field.

[0023] Optionally, the nonlinear transformation includes a first affine transformation and a first inverse affine transformation, and the processing unit is further used to: use the first instruction in the instruction set to perform the first affine transformation on the first data, the second data and the input data of the nonlinear transformation to obtain the first affine transformation result, wherein the first data is data obtained by mapping a preset matrix to the second finite field according to the isomorphic matrix, and the second data is data obtained by mapping a preset vector to the second finite field according to the isomorphic matrix, and the isomorphic matrix is used to indicate the isomorphic relationship; use the second instruction in the instruction set to perform the first inverse affine transformation on the preset matrix, the preset vector and the first affine transformation result to obtain the result of the nonlinear transformation.

[0024] Optionally, the nonlinear transformation includes a first affine transformation, a second affine transformation and an inverse transformation, and the processing unit is further used to: use the first instruction in the instruction set to perform the first affine transformation on the mapping result of the first data, the second data and the input data to obtain the first affine transformation result, wherein the mapping result of the input data is the data of mapping the input data to the second finite field according to the isomorphic matrix, the first data is the data of mapping a preset matrix to the second finite field according to the isomorphic matrix, the second data is the data of mapping a preset vector to the second finite field according to the isomorphic matrix, and the isomorphic matrix is used to indicate the isomorphic relationship; use the second instruction in the instruction set to perform the inverse transformation on the first affine transformation result to obtain the result of the inverse transformation; use the first instruction to perform the second affine transformation on the first data, the second data and the result of the inverse transformation to obtain the result of the nonlinear transformation.

[0025] Optionally, the round function also includes a linear transformation, and the processing unit is further used to: perform the linear transformation on the result of the nonlinear transformation to obtain the result of the linear transformation; perform an XOR operation on the result of the linear transformation and the internal state of the first block cipher algorithm to obtain the output result of the round function, and the internal state of the first block cipher algorithm is associated with the input data of the nonlinear transformation; when the round key is the key used for the last round of iterative calculation in the first block cipher algorithm, the mapping result of the output result of the round function obtained by the last four rounds of iterative calculation in the first block cipher algorithm is reversed, and the result obtained by the reversed arrangement is determined as the ciphertext data, and the mapping result of the output result of the round function obtained by any round of iterative calculation is the result of mapping the output result of the round function obtained by any round of iterative calculation to the first finite field using the isomorphic matrix.

[0026] Optionally, the processing unit is further used to: perform a circular shift operation on the result of the nonlinear transformation to obtain the circular shift operation result; use the first instruction to perform the linear transformation on the circular shift operation result according to a linear preset matrix set to obtain the result of the linear transformation, and the number of preset matrices included in the preset matrix set is associated with the result of the circular shift operation.

[0027] Optionally, the nonlinear transformation includes a first affine transformation and a first inverse affine transformation, and the processing unit is further used to: use the first instruction in the instruction set to perform the first affine transformation on the mapping result of the first data, the second data and the input data to obtain the first affine transformation result, wherein the mapping result of the input data is data obtained by mapping the input data to the second finite field according to the isomorphic matrix, the first data is data obtained by mapping the preset matrix to the second finite field according to the isomorphic matrix, and the second data is data obtained by mapping the preset vector to the second finite field according to the isomorphic matrix, and the isomorphic matrix is used to indicate the isomorphic relationship; perform a circular shift operation on the first affine transformation result to obtain the circular shift operation result; use the second instruction in the instruction set to perform the first inverse affine transformation on the circular shift operation result, third data and fourth data to obtain the result of the nonlinear transformation, wherein the third data is data obtained by mapping the dot product result of the preset matrix set and the preset matrix to the second finite field, and the fourth data is data obtained by mapping the preset matrix set and the preset vector to the second finite field.

[0028] Optionally, the processing unit is also used to: perform an XOR operation on the result of the nonlinear transformation and the internal state of the first block cipher algorithm to obtain the output result of the round function, and the internal state of the first block cipher algorithm is associated with the input data of the nonlinear transformation; when the round key is the key used for the last round of iterative calculation in the first block cipher algorithm, the mapping results of the output results of the round function obtained by the last four rounds of iterative calculation in the first block cipher algorithm are arranged in reverse order, and the results obtained by the reverse arrangement are determined as the ciphertext data, and the mapping result of the output result of the round function obtained by any round of iterative calculation is the result of mapping the output result of the round function obtained by any round of iterative calculation to the first finite field using the isomorphic matrix.

[0029] Optionally, the processing unit is further configured to: map the input data of the nonlinear transformation to the second finite field using the first instruction in the instruction set and the isomorphism matrix to obtain a mapping result of the input data.

[0030] Optionally, the first block cipher algorithm is the national secret SM4 algorithm, and the second block cipher algorithm is the Advanced Encryption Standard AES.

[0031] Optionally, the instruction set is a GFNI instruction set, the first instruction is a VGF2P8AFFINEQB instruction, and the second instruction is a VGF2P8AFFINEINVQB instruction.

[0032] Optionally, any one of the instructions included in the instruction set is implemented using an application programming interface API in any one of the following languages: assembly language, C language, or C++ language.

[0033] Optionally, the width of an operand corresponding to any instruction included in the instruction set is the same as the number of bits of a register associated with the operand corresponding to the any instruction.

[0034] An embodiment of the present application provides a device for implementing a block cipher algorithm, comprising: an acquisition unit for acquiring ciphertext data to be decrypted; a processing unit for decrypting the decrypted data to be decrypted using a first block cipher algorithm to obtain plaintext data, wherein an instruction set is used to implement the calculation of a round function in the first block cipher algorithm, the round function includes a nonlinear transformation, and the instruction set includes instructions for solving the nonlinear transformation; and an output unit for outputting the plaintext data.

[0035] An embodiment of the present application further provides a storage device, which stores program instructions executable by a processor to perform the method described above.

[0036] An embodiment of the present application further provides an electronic device, comprising: a processor; and a memory for storing a data processing program. After the server is powered on and the program is run by the processor, the method described above is executed.

[0037] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments disclosed in this application, nor is it intended to limit the scope of disclosure of this application. Other features disclosed in this application will become easily understood through the following description.

[0038] Compared with the prior art, this application has the following advantages:

[0039] The present application provides a method for implementing a block cipher algorithm, comprising: obtaining plaintext data to be encrypted; encrypting the plaintext data to be encrypted using a first block cipher algorithm to obtain ciphertext data, wherein an instruction set is used to implement calculations of a round function in the first block cipher algorithm, the round function including a nonlinear transformation, and the instruction set including instructions for solving the nonlinear transformation; and outputting the ciphertext data. In this method, the first block cipher algorithm includes a nonlinear transformation in the round function implemented using an instruction set, and the instruction set includes instructions for solving the nonlinear transformation. Thus, by directly solving the nonlinear transformation using instructions in the instruction set, computational efficiency can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1A This is an application scenario suitable for the method of implementing the block cipher algorithm provided in the embodiment of this application.

[0041] Figure 1 This is a schematic diagram of a method for implementing a block cipher algorithm provided in an embodiment of the present application.

[0042] Figure 2 is the above Figure 1 A schematic diagram of S120 in the method is shown.

[0043] Figure 3 is the above Figure 2 FIG. 1 is a schematic diagram of an implementation of S220 in the method shown.

[0044] Figure 4 is the above Figure 2 A schematic diagram of another implementation of S220 in the method is shown.

[0045] Figure 5 is the above Figure 2 FIG. 4 is a schematic diagram of yet another implementation of S220 in the method shown.

[0046] Figure 6 This is a schematic diagram of a method for implementing a round function in a block cipher algorithm provided in an embodiment of the present application.

[0047] Figure 7 This is a schematic diagram of a method for implementing a round function in a block cipher algorithm provided in an embodiment of the present application.

[0048] Figure 8 This is a schematic diagram of a method for implementing a round function in a block cipher algorithm provided in an embodiment of the present application.

[0049] Figure 9 This is a schematic diagram of a method for implementing a round function in a block cipher algorithm provided in an embodiment of the present application.

[0050] Figure 10A This is a schematic diagram of a method for implementing the SM4 encryption algorithm provided in an embodiment of the present application.

[0051] Figure 10 This is a structural diagram of a device for implementing a block cipher algorithm provided in an embodiment of the present application.

[0052] Figure 11 This is a structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] The following description sets forth many specific details to facilitate a thorough understanding of the present application. However, the present application can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the scope of the present application. Therefore, the present application is not limited to the specific implementations disclosed below.

[0054] With the rapid development of Internet technology, more and more devices (such as user terminals or servers) are communicating over networks to achieve data transmission. To improve data security and protect privacy, when devices transmit data over the network, the sending device typically encrypts the data to be transmitted according to a pre-agreed algorithm to obtain ciphertext data, and then transmits the ciphertext data over the network to the destination device. After receiving the ciphertext data, the destination device decrypts it according to the corresponding decryption algorithm to obtain the plaintext data.

[0055] Block ciphers are a commonly used data encryption and decryption algorithm. They are a type of cryptographic algorithm that can only process a block of data of a specific length at a time. Examples of block ciphers include the SM4 algorithm, the Data Encryption Algorithm (DEA), and the Advanced Encryption Standard (AES).

[0056] Traditionally, block cipher algorithms can be implemented in software. However, this approach requires executing numerous operations and corresponding instructions, resulting in increased system overhead and lower computational efficiency. Some software implementations, such as those based on Bitslice technology, require assembling 128 or 256 plaintext data blocks before the algorithm can process them, resulting in poor versatility and practicality. Furthermore, block cipher algorithms can be implemented in hardware, but this approach requires installing dedicated hardware in the device to implement the block cipher algorithm, resulting in poor versatility when implemented in hardware.

[0057] Based on this, the present application provides a method, apparatus and device for implementing a block cipher algorithm to solve the above-mentioned problems existing in traditional technologies.

[0058] First, a brief introduction to the professional and technical terms involved in the embodiments of this application is given:

[0059] 1. SM4 algorithm

[0060] The SM4 algorithm is a block cipher standard currently in use in China. It was issued by the China National Cryptography Administration on March 21, 2012. The relevant standard is GM / T0002-2012, "SM4 Block Cipher Algorithm." The algorithm has a block length of 128 bits and a key length of 128 bits. Both the encryption algorithm and the key expansion algorithm use a 32-round nonlinear iterative structure.

[0061] The SM4 algorithm consists of an encryption and decryption algorithm and a key expansion algorithm. The block length and key length of the SM4 algorithm are both 128 bits. Both the encryption and key expansion algorithms use 32 rounds. The encryption and decryption algorithms are identical, but the order of round keys is reversed. Key Expansion Algorithm: The SM4 algorithm uses a 128-bit encryption key and a 32-round iterative encryption structure. Each encryption round uses a 32-bit round key, for a total of 32 round keys. Therefore, a key expansion algorithm is required to generate 32 round keys from the encryption key.

[0062] In order to better understand the implementation of the block cipher algorithm provided by this application, the following briefly describes the encryption and decryption algorithm and key expansion algorithm of the SM4 algorithm. The SM4 algorithm is a 32-round nonlinear iterative structure that performs encryption operations in units of words (32 bits). Each iterative operation is a calculation of the round function F. For example, when the plaintext data input to the SM4 algorithm is (X i ,X i+1 ,X i+2 ,X i+3 ), X i ,X i+1 ,Xi+2 and X i+3 When both are 4 words, the encryption algorithm in the SM4 algorithm can be expressed by the following formula:

[0063]

[0064] Among them, the function F() represents the round function; rk i Represents the round key; function R() represents the reverse transformation operation; (X i ,X i+1 ,X i+2 ,X i+3 ) represents the input data of the i-th round iteration function, which is 4 words, a total of 128 bits; (X i+1 ,X i+2 ,X i+3 ,X i+4 ) represents the output data of the round function after the ith round of iteration; (Y0, Y1, Y2, Y3) represents the output data of the round function after the 32nd round of iteration, that is, the ciphertext data, which is 4 words, totaling 128 bits. It can be understood that the function T() in the above formula (1) is a reversible transformation function. The function T() is composed of a nonlinear transformation and a linear transformation, that is, T() = L(r()). The output of the nonlinear transformation is the input of the linear transformation.

[0065] Nonlinear transformation: It is composed of four parallel S-boxes. Let the nonlinear transformation input be A=(a i ,a i+1 ,a i+2 ,a i+3 ), the nonlinear transformation output is B=(b i ,b i+1 ,b i+2 ,b i+3 ), where each of A and B has 8 bits. For example, a i is 8 bits, b i It is 8 bits.

[0066] Linear transformation: The input of linear transformation is the output of nonlinear transformation. Both the input and output of linear transformation are 32 bits. The linear transformation can be expressed by the following formula:

[0067]

[0068] It is understandable that the decryption algorithm principle of the SM4 algorithm is the same as the encryption algorithm principle. The difference is that the order of the round keys used in the decryption algorithm is reversed from the order of the round keys used in the encryption algorithm. For example, when performing 32 rounds of iterative calculations, the order of the round keys used in the encryption algorithm is: (rk0, rk1, ..., rk 31), the order of the round keys used by the decryption algorithm when performing 32 rounds of iterative calculations is: (rk 31 ,rk 30 ,……,rk0).

[0069] Key expansion method: Assume that the encryption key is MK = (MK0, MK1, MK2, MK3), the system parameter FK = (FK0, FK1, FK2, FK3), and the fixed parameter CK = (CK0, CK1, ..., CK 31 ).rk i The round key is generated from the encryption key.

[0070] The initial round key can be expressed by the following formula:

[0071]

[0072] round key rk i It can be expressed by the following formula:

[0073]

[0074] Wherein, the function T'() = L'(r()), and the linear transformation L'() can be expressed by the following formula:

[0075]

[0076] It can be understood that the function T'() shown in formula (5) in the above key expansion method is obtained by replacing the linear transformation L() in the function T() in the above encryption and decryption method with L'().

[0077] 2. SM4 finite field

[0078] The SM4 finite field is used to define the finite field of the round function in the SM4 algorithm. Each element in the finite field is 8 bits long and contains 2 8 = 256 elements. The elements of this finite field can be represented in the form of bytes. The SM4 finite field is also called GF SM4 (2 8 ) finite field, namely SM4 finite field and GF SM4 (2 8 ) finite fields express the same meaning.

[0079] 3. SM4 S-box

[0080] The SM4 S-box is also known as the SM4 S-box transform, S-box, or S-box transformation. The S-box is an operation within the round function of the SM4 algorithm. Both the input and output of the S-box are 8-bit elements. For a specific definition, refer to the "Non-Linear Transformation" section of the GM / T0002-2012 "SM4 Block Cipher Algorithm" standard. The S-box can be viewed as a superposition of a series of operations over the SM4 finite field, specifically including: an affine transformation of the input data; the inversion of the result of the affine transformation; and another affine transformation of the inverse result.

[0081] 4. SM4 L layer

[0082] The SM4 L-layer is also known as the SM4 L-layer transform or L-layer transformation. The L-layer is another operation within the round function of the SM4 algorithm. Its input consists of the output of the SM4 S-box. Both the input and output of the L-layer are 32-bit elements. For a specific definition, refer to the "Linear Transformation" section of the GM / T0002-2012 "SM4 Block Cipher Algorithm" standard. L-layer operations can be viewed as linear transformations applied to 32-bit words, or they can be broken down into a combination of shifts and linear transformations applied to each byte.

[0083] 5. Advanced Encryption Standard (AES) algorithm

[0084] The AES algorithm is the advanced encryption standard released by the U.S. NIST in November 2001 and is the current cryptographic algorithm standard of the U.S. federal government.

[0085] 6. AES finite fields

[0086] The AES finite field is used to define the finite field of the round function in the AES algorithm. Each element in the finite field is 8 bits long and contains 2 8 = 256 elements. The elements on this finite field can be represented in the form of bytes. AES finite field is also called GF AES (2 8 ) finite field, that is, AES finite field and GF AES (2 8 ) finite fields express the same meaning.

[0087] 7. Isomorphism

[0088] Isomorphism means that two finite fields have the same structure, meaning that elements in one field can be converted into elements in the other, and operations on elements in the first field can be converted into operations on the other. For example, the SM4 field and the AES field are isomorphic, meaning that operations on element A in the SM4 field can be converted into operations on element B in the AES field.

[0089] 8. Linear Transformation

[0090] A linear transformation is an operation that treats the elements of a finite field as an 8-bit row vector consisting of 0s and 1s, multiplies this row vector by an 8×8 binary matrix, and obtains another 8-bit row vector.

[0091] It can be understood that the isomorphism relationship between finite fields A and B can be expressed as a linear transformation, where elements on A are converted to elements on B after transformation, and elements on B are converted to elements on A after inverse transformation.

[0092] 9. Affine Transformation

[0093] An affine transformation is an operation that first performs a linear transformation on the elements of a finite field and then adds a constant element. An affine transformation on a finite field can be mapped to an affine transformation on another finite field through an isomorphism (i.e., a linear transformation).

[0094] 10. Inverse affine transformation

[0095] The inverse affine transformation is an operation that first inverts the elements on a finite field and then performs an affine transformation.

[0096] 11. GFNI instruction set

[0097] The GFNI instruction set is a CPU instruction set developed by Intel that can be used to accelerate operations on AES finite fields. The GFNI instruction set includes instructions for performing affine transformations on AES finite fields, namely the VGF2P8AFFINEQB instruction, and for performing inverse affine transformations on AES finite fields, namely the VGF2P8AFFINEINVQB instruction.

[0098] 12. VGF2P8AFFINEQB instruction

[0099] The VGF2P8AFFINEQB instruction has the following functions: given an 8×8 binary matrix A and a binary vector C of length 8, in AES (i.e., GF AES (2 8 ) finite field. Computes x·A+C for a binary vector x of length 8. The VGF2P8AFFINEQB instruction supports 128-bit, 256-bit, or 512-bit register widths. The VGF2P8AFFINEQB instruction can be called from assembly language. Alternatively, the VGF2P8AFFINEQB instruction can be called from C or C++ using the intrinsics interface.

[0100] In some implementations, when the VGF2P8AFFINEQB instruction is called using assembly language, the assembly language API may be expressed as:

[0101] VGF2P8AFFINEINVQB(parameter 1, parameter 2, parameter 3, parameter 4)

[0102] Parameter 1 represents the register storing x (8 bits), which can be any of the following registers: a 128-bit register (i.e., xmm), a 256-bit register (i.e., ymm), or a 512-bit register (i.e., zmm). Specifically, when the register represented by parameter 1 is a 128-bit register, executing the VGF2P8AFFINEINVQB instruction once can simultaneously operate on 16 x's; when the register represented by parameter 1 is a 256-bit register, executing the VGF2P8AFFINEINVQB instruction once can simultaneously operate on 32 x's; when the register represented by parameter 1 is a 512-bit register, executing the VGF2P8AFFINEINVQB instruction once can simultaneously operate on 64 x's. Parameter 2 represents the register storing matrix A (64 bits). Specifically, when the register represented by parameter 2 is a 128-bit register, executing the VGF2P8AFFINEINVQB instruction once can operate on two A's simultaneously; when the register represented by parameter 2 is a 256-bit register, executing the VGF2P8AFFINEINVQB instruction once can operate on four A's simultaneously; when the register represented by parameter 2 is a 512-bit register, executing the VGF2P8AFFINEINVQB instruction once can operate on eight A's simultaneously. Parameter 3 represents the register that stores the result of x·A+C. The positional order of the result corresponds to the positional order of x in the first parameter. Parameter 4 is an 8-bit immediate value that represents the binary vector C involved in the calculation.

[0103] In some other implementations, when the VGF2P8AFFINEQB instruction is called using the C language or the C++ language, the C or C++ API can be expressed as:

[0104] __m128i_mm_gf2p8affine_epi64_epi8(param #1, parameter #2, parameter #3)

[0105] Parameter #1 indicates the register storing x, parameter #2 indicates the register storing A, and parameter #3 indicates the register storing C. __m128i_mm_gf2p8affine_epi64_epi8 returns x·A+C. Parameter #1 and parameter #2 can be any of the following registers: 128-bit registers, 256-bit registers, or 512-bit registers.

[0106] 13. VGF2P8AFFINEINVQB instruction

[0107] The VGF2P8AFFINEINVQB instruction has the following functions: given an 8×8 binary matrix A and a binary vector C of length 8, in AES (i.e., GF AES (2 8 ) Calculate x for a binary vector x of length 8 over a finite field -1 A+C. The VGF2P8AFFINEQB instruction supports registers with widths of 128, 256, or 512 bits. The VGF2P8AFFINEINVQB instruction can be called from assembly language. Alternatively, the VGF2P8AFFINEINVQB instruction can be called from C or C++ using the intrinsics interface.

[0108] It can be understood that the difference between the effect of the VGF2P8AFFINEINVQB instruction and the effect of the VGF2P8AFFINEQB instruction is that the VGF2P8AFFINEINVQB instruction is used to calculate x -1 ·A+C, the VGF2P8AFFINEQB instruction is used to calculate x·A+C. For a detailed introduction to the VGF2P8AFFINEINVQB instruction, please refer to the above introduction to the VGF2P8AFFINEQB instruction. In this case, you need to replace x in the VGF2P8AFFINEQB instruction with x -1 That's it.

[0109] 14. Single instruction multiple data (SIMD)

[0110] SIMD is a technology that uses a single controller to control multiple processors, simultaneously performing the same operation on each of a set of data (also known as a "data vector"), thereby achieving spatial parallelism. For example, SIMD can be used to accelerate the AES algorithm. By simultaneously storing multiple plaintext data packets in long registers (for example, 128-bit, 256-bit, or 512-bit registers), a single operation on the register accelerates the parallel processing of multiple plaintext packets, significantly improving AES algorithm performance.

[0111] Below, with reference to the accompanying drawings, we will describe in detail the applicable application scenarios of the method for implementing the block cipher algorithm provided by this application, as well as the method, apparatus, and device for implementing the block cipher algorithm provided by this application. It is understood that, to the extent that there is no conflict between the various embodiments provided by this application, the following embodiments and features within these embodiments may be combined with one another. Furthermore, the sequence of steps in the following method embodiments is provided for illustrative purposes only and is not intended to be a strict limitation.

[0112] First, the application scenarios of the method for implementing the block cipher algorithm provided in the embodiment of the present application are introduced with reference to the accompanying drawings.

[0113] Figure 1A This is an application scenario of the method for implementing the block cipher algorithm provided in the embodiment of this application. Specifically, Figure 1A The illustrated application scenario includes at least one server 10 and at least one terminal 20 .

[0114] The server 10 may be a server with storage and computing capabilities, and the server 10 may have a memory and a processor. The processor of the server 10 may be a central processing unit (CPU). Optionally, the server 10 may also have one or more of a graphics processing unit (GPU), a neural network processing unit (NPU), or a field programmable gate array (FPGA). The memory of the server 10 may be a random access memory (RAM) or a solid-state drive (SSD), or other device or memory instance with storage capabilities. The solid-state drive may also be referred to as a solid-state drive (SSD).

[0115] Terminal 20 may be a terminal with storage and computing capabilities. One or more applications may be installed on terminal 20. When an application is run on terminal 20, application data associated with the application is generated. Applications may include chat applications, financial service applications, gaming applications, and video applications (e.g., live video streaming applications or video conferencing applications). For example, terminal 20 may be a personal computer, a smartphone, or a tablet computer.

[0116] In one example, the server 10 can be a physical device deployed in a network. The server 10 and the terminal 20 are connected in communication via a network to achieve data transmission. In some implementations, after the server 10 obtains the plaintext data to be transmitted from the local storage device, it first encrypts the plaintext data using an encryption algorithm to obtain ciphertext data, and then transmits the ciphertext data to the terminal 20 via the network. After receiving the ciphertext data, the terminal 20 decrypts the ciphertext data using a decryption algorithm corresponding to the encryption algorithm to obtain the plaintext data. In other implementations, after the terminal 20 obtains the plaintext data to be transmitted from the local storage device, it first encrypts the plaintext data using an encryption algorithm to obtain ciphertext data, and then transmits the ciphertext data to the server 10 via the network. After receiving the ciphertext data, the server 10 decrypts the ciphertext data using a decryption algorithm corresponding to the encryption algorithm to obtain the plaintext data.

[0117] It should be understood that the above Figure 1A The application scenarios shown are for illustrative purposes only and do not constitute any limitation on the application scenarios to which the methods for implementing the block cipher algorithm provided in the embodiments of the present application are applicable. Optionally, the above application scenarios may also include a larger number of servers 10 and a larger number of terminals 20. Optionally, the above terminals 20 may also be replaced by the above servers 10.

[0118] Below, a method for implementing a block cipher algorithm provided in an embodiment of the present application is described with reference to the accompanying drawings.

[0119] Figure 1 Schematic diagram of a method for implementing a block cipher algorithm provided in an embodiment of the present application. The method for implementing a block cipher algorithm provided in an embodiment of the present application can be executed by a device for implementing a block cipher algorithm. It is understood that the device can be implemented as software, or a combination of software and hardware. For example, the device in the embodiment of the present application can be, but is not limited to, a server or a terminal device used by a user. Figure 1 The implementation method of the block cipher algorithm provided in the embodiment of the present application includes S110 to S130. S110 to S130 are described in detail below.

[0120] S110, obtaining plaintext data to be encrypted.

[0121] The length and data type of the plaintext data to be encrypted are not specifically limited. For example, the plaintext data to be encrypted can be, but is not limited to, 128-bit plaintext data. In this case, the 128-bit plaintext data can be divided into 4 groups, denoted as (X0, X1, X2, X3), where X k (k=0,1,2,3) is 32-bit data. Optionally, the 128-bit plaintext data can be divided into 8 groups, namely (X0,X1,X2,X3,X4,X5,X6,X7), Xk (k=0, 1, 2, 3, 4, 5, 6, 7) is 16-bit data. For another example, the plaintext data to be encrypted may be, but is not limited to, data stored in a cloud server or a user terminal device (eg, a mobile phone or tablet computer).

[0122] The method for obtaining the plaintext data to be encrypted is not specifically limited. For example, when the server executes S110 above, the server may send a request to the device storing the plaintext data to obtain the plaintext data. In another example, the device storing the plaintext data may proactively send the plaintext data to the server.

[0123] S120, encrypting the plaintext data to be encrypted using the first block cipher algorithm to obtain ciphertext data, wherein the round function in the first block cipher algorithm is calculated using an instruction set, the round function includes a nonlinear transformation, and the instruction set includes instructions for solving the nonlinear transformation.

[0124] In an embodiment of the present application, a first block cipher algorithm is used to encrypt plaintext data to obtain ciphertext data, wherein an instruction set is used to implement the calculation of the round function in the first block cipher algorithm, including the following steps: obtaining input data for a nonlinear transformation, wherein the input data for the nonlinear transformation is determined based on a round key and plaintext data, and the input data for the nonlinear transformation is data in a first finite field, which is a finite field of the first cipher block algorithm; in a second finite field, using an instruction set to implement a nonlinear transformation on the input data for the nonlinear transformation, and obtaining a result of the nonlinear transformation, wherein the result of the nonlinear transformation is data in a second finite field, which is a finite field of the second block cipher algorithm, the second finite field is isomorphic to the first finite field, and the first block cipher algorithm is different from the second block cipher algorithm; and obtaining ciphertext data based on the result of the nonlinear transformation, wherein the ciphertext data is data in the first finite field. Figure 2 The flowchart of the above-mentioned "using the first block cipher algorithm to encrypt the plaintext data to obtain the ciphertext data" is shown. Figure 2As shown, the process includes S210 to S230. In one example, when the first block cipher algorithm is the SM4 algorithm, 32 rounds of iterative calculations are required when executing the SM4 algorithm. In this implementation, the input data of the nonlinear transformation is determined based on the round key and the plaintext data, including: when executing the first round of iterative calculations, the input data of the nonlinear transformation is determined based on the round key and plaintext data corresponding to the first round of iteration; or, when executing any round of iterative calculations after the first round of iterations, the input data of the nonlinear transformation is determined based on the round key corresponding to the arbitrary round of iterative calculations and the internal state of the SM4 algorithm during the arbitrary round of iterative calculations. The internal state of the SM4 algorithm during the arbitrary round of iterative calculations is the internal state of the SM4 algorithm corresponding to the previous round of iterative calculations before the arbitrary round of iterative calculations. When the current round of iterations is the first round of iterative calculations, the internal state of the SM4 algorithm is the plaintext data input to the SM4 algorithm. Exemplarily, the following is an example of obtaining the input data of the nonlinear transformation of the first round of iterative calculations. Specifically, the plaintext data input to the SM4 algorithm during the first round of iterative calculation is (X0, X1, X2, X3), X k When (k=0,1,2,3) is 32-bit data, the round key rk0 corresponding to the first round of iterative calculation is used to XOR X1, X2 and X3 to obtain a 32-bit data. The 32-bit data is split into four 8-bit data to obtain the input data of the nonlinear transformation corresponding to the first round of iterative calculation. Among them, the round key rk0 is used to XOR X1, X2 and X3 to obtain the following: In this implementation, (X0, X1, X2, X3) can also be called the internal state of the SM4 algorithm during the first round of iterative calculation. Exemplarily, the following is an introduction to the input data of the nonlinear transformation of the second round of iterative calculation. Specifically, the internal state of the SM4 algorithm during the second round of iterative calculation is (X1, X2, X3, X4), X4 is the output result of the first round of iterative calculation, and the round key rk1 corresponding to the second round of iterative calculation is used to XOR X2, X3 and X4 to obtain a 32-bit data. The 32-bit data is split into 4 8-bit data to obtain the input data of the nonlinear transformation corresponding to the second round of iterative calculation. Among them, the XOR of X2, X3 and X4 using the round key rk1 can be expressed as Similarly, the input data for the nonlinear transformation of the third round of iterative calculation can be obtained, ..., and the input data for the nonlinear transformation of the 32nd round of iterative calculation can be obtained.

[0125] The round keys are determined based on the encryption key, and there is no specific limitation on the method for obtaining the round keys. For example, the round keys can be obtained based on the encryption key in the manner specified in the SM4 algorithm standard. It is understandable that the decryption algorithm principle of the SM4 algorithm is consistent with the encryption algorithm principle. The difference is that the order of the round keys used in the decryption algorithm is reversed from the order of the round keys used in the encryption algorithm. For example, when performing 32 rounds of iterative calculations, the order of the round keys used in the encryption algorithm is: (rk0, rk1, ..., rk 31 ), the order of the round keys used by the decryption algorithm when performing 32 rounds of iterative calculations is: (rk 31 ,rk 30 ,……,rk0).

[0126] The second finite field is isomorphic to the first finite field, that is, operations on data in the second finite field can be converted into operations on data in the first finite field, or operations on data in the first finite field can be converted into operations on data in the second finite field. For ease of description, in the embodiment of the present application, the data in the first finite field can be converted into data in the second finite field using the matrix M (also called the isomorphic matrix). Using the matrix M -1 (also known as the inverse matrix of the isomorphic matrix) can convert data on the second finite field to data on the first finite field. For example, when the first block encryption algorithm is the SM4 algorithm and the second block encryption algorithm is the AES algorithm, the matrix M and the matrix M -1 The definition of can be as follows:

[0127]

[0128] The present embodiment provides three methods for implementing "in a second finite field, using an instruction set to perform a nonlinear transformation on input data of the nonlinear transformation to obtain a nonlinear transformation result." These three implementation methods are described in detail below with reference to the accompanying drawings.

[0129] Implementation method 1:

[0130] In implementation method one, the nonlinear transformation includes a first affine transformation and a first inverse affine transformation. In the second finite field, the nonlinear transformation is implemented using an instruction set to obtain a result of the nonlinear transformation, including: using the first instruction in the instruction set to perform the first affine transformation on the first data, the second data and the input data of the nonlinear transformation to obtain a first affine transformation result, wherein the first data is the data in the second finite field mapped by the preset matrix according to the isomorphic matrix, and the second data is the data in the second finite field mapped by the preset vector according to the isomorphic matrix, and the isomorphic matrix is used to indicate the isomorphic relationship; using the second instruction in the instruction set to perform the first inverse affine transformation on the preset matrix, the preset vector and the first affine transformation result to obtain the result of the nonlinear transformation. Figure 3 FIG. 1 shows a flow chart of obtaining the result of nonlinear transformation by using the above-mentioned implementation method 1. Figure 3 As shown, the process includes S310 and S320.

[0131] In this implementation, the first data is the data in the second finite field mapped by the preset matrix according to the isomorphic matrix, that is, the first data is specifically the result of the dot product of the inverse matrix of the isomorphic matrix, the isomorphic matrix and the preset matrix. The preset matrix is a preset 8×8 binary matrix. The second data is the data in the second finite field mapped by the preset vector according to the isomorphic matrix, that is, the second data is specifically the result of the dot product of the preset vector and the isomorphic matrix. The preset vector can be a preset 1×8 binary row vector. The isomorphic matrix is used to indicate the isomorphic relationship. Specifically, the isomorphic matrix is a mapping matrix used to convert the data in the first finite field to the data in the second finite field while maintaining the isomorphic property, for example, the matrix M shown in the above formula (6).

[0132] In some possible implementations, when the first block cipher algorithm is the SM4 algorithm and the second block cipher algorithm is the AES algorithm, the nonlinear transformation in the round function can be understood as an S-box specified in the SM4 algorithm standard, which can be expressed by the following formula:

[0133] SBox(x)=A SM4 (x·A SM4 +C SM4 ) -1 +C SM4 (7)

[0134] Among them, A SM4 is the preset matrix, C SM4 Is the preset vector, x is the input data of the S box, and x is an 8-bit binary data. Preset matrix A SM4 and the preset vector C SM4 The definitions are as follows:

[0135]

[0136] Taking the nonlinear transformation as the S-box in the SM4 algorithm (i.e., the content shown in the above formula (7)) as an example, the first data A in the implementation method 1 is SM4 ' and the second data C SM4 ' can be expressed by the following formulas:

[0137] A SM4 '=M·A SM4 ·M -1 (9)

[0138] Among them, A SM4' represents the matrix obtained by converting the matrix in the SM4 finite field to the AES finite field.

[0139] C SM4 '=M·C SM4 (10)

[0140] Among them, C SM4 'Indicates that the preset vector C in the SM4 finite field SM4 The matrix obtained by converting to the AES finite field.

[0141] For example, Figure 6 The embodiment of the second implementation method using the instruction set to implement the round function including nonlinear transformation is shown. Specifically, Figure 6 In the example, the input data of the nonlinear transformation is x, the first block cipher algorithm is the SM4 algorithm, and the second block cipher algorithm is the AES algorithm. x is an 8-bit binary data. Optionally, when the input data of the nonlinear transformation includes multiple x, the same operation can be performed on each x. For details, see the following description of Figure 6 The description is not repeated in detail here.

[0142] Optionally, in the first implementation, the round function further includes a linear transformation. That is, after executing the first implementation, ciphertext data is obtained based on the result of the nonlinear transformation, including: performing a linear transformation on the result of the nonlinear transformation to obtain a result of the linear transformation; performing an exclusive-OR operation on the result of the linear transformation and the internal state of the first block cipher algorithm to obtain an output result of the round function, wherein the internal state of the first block cipher algorithm is associated with the input data of the nonlinear transformation; when the round key is the key used in the last round of iterative calculations in the first block cipher algorithm, the mapping results of the output results of the round function obtained by the last four rounds of iterative calculations in the first block cipher algorithm are reversed, and the results obtained by the reversed arrangement are determined as the ciphertext data, wherein the mapping result of the output result of the round function obtained by any round of iterative calculations is the result of mapping the output result of the round function obtained by any round of iterative calculations to the first finite field using an isomorphic matrix. In this embodiment, performing a linear transformation on the result of the nonlinear transformation to obtain the result of the linear transformation includes: performing a cyclic shift operation on the result of the nonlinear transformation to obtain the result of the cyclic shift operation; and performing a linear transformation on the result of the cyclic shift operation using a first instruction according to a preset matrix set to obtain the result of the linear transformation, wherein the number of preset matrices included in the preset matrix set is associated with the result of the cyclic shift operation. In other words, in this implementation, the linear transformation operation is performed using the first instruction in the instruction set. For example, when the first block cipher algorithm is the SM4 algorithm, the SM4 algorithm includes 32 rounds of iterative calculations. The internal state of the SM4 algorithm during the first round of iterative calculations is recorded as (X0, X1, X2, X3). At this time, when performing the first round of iterative calculations, performing an exclusive OR operation on the result of the nonlinear transformation and the internal state of the first block cipher algorithm to obtain the output result of the round function corresponding to the first round of iterative calculations includes: performing an exclusive OR operation on X0 and the result of the nonlinear transformation obtained by the first round of iterative calculations. During the second round of iterative calculations, the internal state of the SM4 algorithm changes from (X0, X1, X2, X3) to (X1, X2, X3, X4), where X4 is the output of the first round of iterative calculations. During the second round of iterative calculations, an XOR operation is performed on the result of the nonlinear transformation and the internal state of the first block cipher algorithm to obtain the output of the round function corresponding to the second round of iterative calculations. This operation includes performing an XOR operation on X1 and the result of the nonlinear transformation obtained in the second round of iterative calculations. This process continues in this way, obtaining the output of the round function corresponding to the third round of iterative calculations, and so on, until the output of the round function corresponding to the 32nd round of iterative calculations is obtained.

[0143] Alternatively, in other implementations, the linear transformation operation may not be performed using the first instruction in the instruction set. For example, a point multiplication operation may be performed on the linear preset matrix set and the result of the circular shift operation using mathematical calculations to obtain the linear transformation result.

[0144] In some possible implementations, when the first block cipher algorithm is the SM4 algorithm and the second block cipher algorithm is the AES algorithm, the linear transformation in the above round function can be understood as the L layer specified in the SM4 algorithm standard. Based on this, a cyclic shift operation is performed on the result of the nonlinear transformation to obtain a cyclic shift operation result, including: performing a cyclic right shift of 8 bits, 16 bits and 24 bits on the result of the nonlinear transformation, respectively, to obtain corresponding cyclic shift operation results, and at this time, 3 cyclic shift operation results can be obtained. Based on this, the number of preset matrices included in the preset matrix set is associated with the result of the cyclic shift operation. It can be understood that the number of preset matrices included in the preset matrix set is equal to 1 plus 3, and "3" represents the 3 results obtained by performing the cyclic shift operation, that is, the preset matrix set in this implementation includes 4 preset matrices. The 4 preset matrices included in the preset matrix set are all 8×8 binary matrices. Exemplarily, the L-layer transformation in the SM4 algorithm can be expressed by the following formula:

[0145]

[0146] Optionally, the above formula (11) can also be expressed by the following formula:

[0147]

[0148] In the above formulas (11) and (12), (x0, x1, x2, x3) represents the input data of the L-level transformation; L0, L1, L2 and L3 are matrices included in the preset matrix set. In some possible implementations, the definitions of these four preset matrices are as follows:

[0149]

[0150] For example, Figure 7 An embodiment of the above-mentioned implementation method 1 using an instruction set to implement the above-mentioned round function (including nonlinear transformation and linear transformation) is shown. Specifically, Figure 7 The input data of nonlinear transformation is (x i ,x i+1 ,x i+2 ,x i+3 ), i=0,1,......,31, the current iteration is the i-th iteration, the first block cipher algorithm is the SM4 algorithm, and the second block cipher algorithm is the AES algorithm. Figure 7 The description is not repeated in detail here.

[0151] Implementation method 2:

[0152] In the second implementation method, the nonlinear transformation includes a first affine transformation, a second affine transformation and an inverse transformation. In the second finite field, the nonlinear transformation is implemented using an instruction set to obtain the result of the nonlinear transformation, including: using the first instruction in the instruction set to perform a first affine transformation on the mapping result of the first data, the second data and the input data to obtain the first affine transformation result, wherein the mapping result of the input data is to map the input data to the data in the second finite field according to the isomorphic matrix, the first data is to map the preset matrix to the data in the second finite field according to the isomorphic matrix, the second data is to map the preset vector to the data in the second finite field according to the isomorphic matrix, and the isomorphic matrix is used to indicate the isomorphic relationship; using the second instruction in the instruction set to perform an inverse transformation on the result of the first affine transformation to obtain the result of the inverse transformation; using the first instruction to perform a second affine transformation on the first data, the second data and the result of the inverse transformation to obtain the result of the nonlinear transformation. Figure 4 FIG. 4 shows a flow chart of obtaining the result of nonlinear transformation by using the above-mentioned second implementation method. Figure 4 As shown, the process includes S410 to S430.

[0153] Optionally, the first instruction in the instruction set and the isomorphic matrix may be used to map the nonlinearly transformed input data into the second finite field to obtain a mapping result of the input data.

[0154] It can be understood that the definitions of the isomorphic vector, preset vector, preset matrix, first data and second data in the above-mentioned implementation method 2 are respectively the same as those in the above-mentioned implementation method 1. For the contents not described in detail here, please refer to the relevant description in the above-mentioned implementation method 1.

[0155] Optionally, in the second implementation, the round function also includes a linear transformation. That is, after executing the second implementation, the method described in the first implementation for "obtaining ciphertext data based on the result of the nonlinear transformation" may also be executed. For details not detailed here, please refer to the relevant content in the first implementation.

[0156] It can be understood that in the above-mentioned implementation method 2, when the first block cipher algorithm is the SM4 algorithm, in the above-mentioned implementation method 2, the nonlinear transformation in the above-mentioned round function can be understood as the S box specified in the SM4 algorithm standard, and the linear transformation in the above-mentioned round function can be understood as the L layer specified in the SM4 algorithm standard.

[0157] For example, the following Figure 8 An embodiment of the above-mentioned implementation method 1 using an instruction set to implement the above-mentioned nonlinear transformation (including the nonlinear transformation including the first affine transformation and the first inverse affine transformation) is shown. Specifically, in Figure 8In the example, the input data of the nonlinear transformation is x, the first block cipher algorithm is the SM4 algorithm, and the second block cipher algorithm is the AES algorithm. x is an 8-bit binary data. Optionally, when the input data of the nonlinear transformation includes multiple x, the same operation can be performed on each x. For details, see the following description of Figure 8 The description is not repeated in detail here.

[0158] Implementation method three:

[0159] In implementation method three, the nonlinear transformation includes a first affine transformation and a first inverse affine transformation. In the second finite field, the nonlinear transformation is implemented on the input data of the nonlinear transformation using an instruction set to obtain a result of the nonlinear transformation, including: using the first instruction in the instruction set to perform the first affine transformation on the mapping result of the first data, the second data and the input data to obtain a first affine transformation result, wherein the mapping result of the input data is the data obtained by mapping the input data to the second finite field according to the isomorphic matrix, the first data is the data obtained by mapping the preset matrix to the second finite field according to the isomorphic matrix, the second data is the data obtained by mapping the preset vector to the second finite field according to the isomorphic matrix, and the isomorphic matrix is used to indicate the isomorphic relationship; performing a circular shift operation on the first affine transformation result to obtain a circular shift operation result; using the second instruction in the instruction set to perform the first inverse affine transformation on the circular shift operation result, the third data and the fourth data to obtain a result of the nonlinear transformation, wherein the third data is the data obtained by mapping the dot product of the preset matrix set and the preset matrix to the second finite field, and the fourth data is the data obtained by mapping the preset matrix set and the preset vector to the second finite field. Figure 5 FIG. 4 shows a flow chart of obtaining the result of nonlinear transformation by using the third implementation method. Figure 5 As shown, the process includes S510 to S540.

[0160] It can be understood that the definitions of the preset matrix set, isomorphic vectors, preset vectors, preset matrices, first data and second data in the above-mentioned implementation method 2 are respectively the same as those in the above-mentioned implementation method 1. For the contents not described in detail here, please refer to the relevant description in the above-mentioned implementation method 1.

[0161] Optionally, in other possible implementations, based on the above-mentioned implementation method three, obtaining ciphertext data based on the result of the nonlinear transformation includes: performing an exclusive OR operation on the result of the nonlinear transformation and the internal state of the first block cipher algorithm to obtain the output result of the round function, wherein the internal state of the first block cipher algorithm is associated with the input data of the nonlinear transformation; when the round key is the key used in the last round of iterative calculation in the first block cipher algorithm, performing reverse order mapping of the output results of the round function obtained by the last four rounds of iterative calculation in the first block cipher algorithm, and determining the result obtained by the reverse order mapping as the ciphertext data, wherein the mapping result of the output result of the round function obtained by any round of iterative calculation is the result of mapping the output result of the round function obtained by any round of iterative calculation into the first finite field using an isomorphic matrix. The implementation method of "performing an exclusive OR operation on the result of the nonlinear transformation and the internal state of the first block cipher algorithm to obtain the output result of the round function" is the same as the implementation method described in the above-mentioned implementation method one. For matters not described in detail here, please refer to the relevant description of the above-mentioned implementation method one.

[0162] For example, Figure 9 An embodiment of the above-mentioned implementation method 3 using an instruction set to implement the above-mentioned round function (including nonlinear transformation and linear transformation) is shown. Specifically, Figure 9 The input data of nonlinear transformation is (x i ,x i+1 ,x i+2 ,x i+3 ), i=0,1,......,31, the current iteration is the i-th iteration, the first block cipher algorithm is the SM4 algorithm, and the second block cipher algorithm is the AES algorithm. Figure 9 The description is not repeated in detail here.

[0163] S130, output ciphertext data.

[0164] It should be understood that the above Figure 1 This is only for illustration and does not constitute any limitation on the implementation method of the block cipher algorithm provided in the embodiment of the present application. For example, when the first block cipher algorithm is SM4 algorithm and the second block cipher algorithm is AES algorithm, the above Figure 1 The working principle of the SM4 algorithm is implemented using the first and second instructions in the instruction set, according to the key expansion algorithm defined in the SM4 algorithm standard (for example, the formulas shown in formulas (3) to (5) above), and using the first and second instructions in the instruction set to implement the key expansion algorithm.

[0165] In the embodiment of the present application, the calculation of the round function in the first block cipher algorithm is realized using an instruction set, and the round function includes a nonlinear transformation, and the instruction set includes an instruction for solving a nonlinear transformation, so that the computational efficiency of solving the round function can be improved. The number of instructions required to consume when realizing the calculation of the round function using the first instruction and the second instruction in the instruction set is relatively small, and operational efficiency can be improved, and computational efficiency can be further improved. The first instruction and the second instruction in the instruction set are instructions that a general-purpose processor (for example, a CPU) can support operation, and the first instruction and the second instruction can support processing data of various types of lengths, so that the above method has better versatility and practical value. In addition, data or matrices can also be read in parallel using SIMD technology, so that the above method has higher versatility and practical value.

[0166] Figure 6 Schematic diagram of a method for implementing a round function in a block cipher algorithm provided in an embodiment of the present application. Specifically, the round function includes a nonlinear transformation. Figure 6 In this paper, the first block cipher algorithm is SM4 algorithm and the second block cipher algorithm is AES algorithm. In this implementation, the nonlinear transformation can be understood as the S-box specified in the SM4 algorithm standard. The algebraic expression of the S-box is shown in the above formula (7). Figure 6 As shown, the process includes S610 and S620. S610 and S620 are described in detail below.

[0167] S610 , using the first instruction in the GFNI instruction set, performs affine transformation on the input data x of the S-box, the matrix A1 and the matrix C1 to obtain an affine transformation result.

[0168] Among them, matrix A1 is matrix A SM4 The result of the dot multiplication with the isomorphic matrix, matrix C1 is the preset vector C SM4 The result of dot product with isomorphic matrix.

[0169] In this application, an affine transformation is performed on the input data x of the S-box, the matrix A1 and the matrix C1 to obtain an affine transformation result, which can be expressed by the following formula:

[0170] x'=x·A1+C1 (14)

[0171] The above A1 can be expressed by the following formula:

[0172] A1=A SM4 ·M (15)

[0173] The above C1 can be expressed by the following formula:

[0174] C1=C SM4 ·M (16)

[0175] S620, using the second instruction in the GFNI instruction set to transform the affine transformation result, the matrix A2 and the preset vector C SM4 Perform the inverse affine transformation to obtain the output data of the S-box,

[0176] Among them, matrix A2 is the inverse matrix of the isomorphic matrix and matrix A SM4 The result of the dot product.

[0177] In this application, the affine transformation result, matrix A2 and preset vector C SM4 Perform the inverse affine transformation to obtain the output data of the S-box. The output data y of the S-box can be expressed by the following formula:

[0178] y=(x′) (-1) A2+C SM4 (17)

[0179] The above A2 can be expressed by the following formula:

[0180] A2=M -1 ·A SM4 (18)

[0181] Optionally, before executing S610, the first instruction may be used to map the input data of the S-box in the SM4 finite field to the AES finite field. Specifically, the input data of the S-box in the SM4 finite field is dot-multiplied with the isomorphic matrix M. The result of the dot-multiplication is the result of mapping the input data of the S-box in the SM4 finite field to the AES finite field.

[0182] In the above implementation, when implementing S-box calculations based on the GFNI instruction set, only necessary algebraic operations are performed, avoiding the need to introduce additional operations to offset invalid calculations, thereby reducing system resource consumption. Specifically, the S-box calculation process in the round function included in the SM4 algorithm can be implemented using only three instructions (i.e., two first instructions and one second instruction). This greatly reduces the number of required instructions and improves operational efficiency. The above method can handle common plaintext group sizes (e.g., 8 groups of plaintext data, 16 groups of plaintext data, or 32 groups of plaintext data), meaning there is no need to collect 128 or 256 groups of plaintext data before executing the SM4 algorithm calculation, making the method more versatile and practical. The above method can be executed on a general-purpose processor (which should be capable of running the first and second instructions in the GFNI instruction set) without the need for dedicated hardware, making the method more versatile.

[0183] The calculation process of the SM4 algorithm S-box provided in the embodiment of the present application is described in detail above. Below, based on the calculation process of the above S-box, a method for implementing the calculation process of the above SM4 algorithm S-box using the GFNI instruction set is further introduced.

[0184] It should also be understood that the above S610 and S620 are described by taking the input data of the S-box as x as an example. Optionally, the input data of the S-box may also be a data group including multiple x's, and the multiple x's may be the same or different.

[0185] The calculation process of the SM4 algorithm S-box provided in the embodiment of the present application is described in detail above in combination with S610 and S620. Below, based on the calculation process of the above S-box, a method for implementing the calculation process of the above SM4 algorithm S-box using the GFNI instruction set is further introduced.

[0186] For ease of description, the following takes an assembly API with an operand of 128-bit register width as an example to provide a method for implementing the above S610 using the VGF2P8AFFINEQB instruction in the GFNI instruction set, and a method for implementing the above S620 using VGF2P8AFFINEINVQB.

[0187] The method for implementing S610 using the VGF2P8AFFINEQB instruction includes: grouping the input data of the S-box into groups of 16, storing the groups in any xmm register, and storing the matrix A1 in the lower 64 bits and upper 64 bits of another xmm register as a column vector. For example, when the register storing the input groups of the S-box is xmm0, the register storing the matrix A1 is xmm1, and the register used to store the output data is xmm2, the assembly interface of the VGF2P8AFFINEQB instruction in the GFNI instruction set implements S610 as follows:

[0188] VGF2P8AFFINEQB(xmm0,xmm1,xmm2,0ceh) (19)

[0189] The method for implementing S620 using VGF2P8AFFINEINVQB includes storing the matrix A2 in the upper 64 bits and lower 64 bits of the xmm register as a column vector. For example, the register storing A2 is xmm3, and the register used to store output data is xmm4. The implementation of S620 using the VGF2P8AFFINEINVQB instruction assembly interface in the GFNI instruction set is as follows:

[0190] VGF2P8AFFINEINVQB(xmm2,xmm3,xmm4,0d3h) (20)

[0191] Finally, we present the calculation results of the simplified S610 and 620 for a given input. For example, when the input data for the S-box operation in S610 is: 000102030405060708090A0B0C0D0E0F (16 8-bit inputs are grouped together and expressed in hexadecimal), the output result after executing the instruction operation shown in formula (19) is: CE09B47315D26FA816D16CABCD0AB770, and the output result after executing the instruction operation shown in formula (20) is: D690E9FECCE13DB716B614C228FB2C05. By referring to the SM4 standard, it can be seen that the output result after executing the instruction operation shown in formula (20) is consistent with the output of the SM4 standard S-box implementation. Figure 7 Schematic diagram of a method for implementing a round function in a block cipher algorithm provided in an embodiment of the present application. Specifically, the round function includes a nonlinear transformation and a linear transformation. Figure 7 In this paper, the first block cipher algorithm is SM4 algorithm and the second block cipher algorithm is AES algorithm. In this implementation, Figure 7 The nonlinear transformation shown corresponds to the S-box specified in the SM4 algorithm standard, and the linear transformation corresponds to the L-layer specified in the SM4 algorithm standard. The algebraic expression of the S-box is specifically shown in the above formula (7), and the algebraic expression of the L-layer is specifically shown in the above formula (11) or the above formula (12). For ease of description, in the embodiment of the present application, the input of the round function of the SM4 algorithm includes the round key rk i and the current internal state of the SM4 algorithm (x i ,x i+1 ,x i+2 ,x i+3 ), i = 0, 1, ..., 31, and the current iteration is the i-th round iteration" as an example to introduce the calculation process of the round function in the SM4 encryption algorithm provided by the embodiment of the present application. Figure 7 As shown, the process includes S710 to S750. S710 to S750 are described in detail below.

[0192] S710 , in the i-th iteration, use the first instruction in the GFNI instruction set to map the input data of the S-box to the AES finite field.

[0193] Among them, during any round of iterative calculation, the input data of the S box is determined according to the round key corresponding to the arbitrary round of iterative calculation and the current internal state of the SM4 algorithm during the arbitrary round of iterative calculation. When the arbitrary round of iterative calculation is the first round of iterative calculation, the current internal state of the SM4 algorithm is the plaintext data to be encrypted input to the SM4 algorithm. For example, the input data of the S box included in the round function can be calculated according to the round key of the SM4 algorithm and the current internal state of the SM4 algorithm in accordance with the provisions of the SM4 standard. For details, please refer to the relevant description above and will not be repeated here. For the convenience of description, in the following embodiments of the present application, the input data of the S box in the round function during the i-th round of iterative calculation is recorded as (x i ,x i+1 ,x i+2 ,x i+3 ), i=0,1,......,31. The isomorphic matrix M is used to map the data in the SM4 finite field to the data in the AES finite field. Based on this, the input data (x i ,x i+1 ,x i+2 ,x i+3 ) is mapped to the AES finite field:

[0194]

[0195] in, Indicates the result obtained after the S-box input data is mapped to the AES finite field.

[0196] For ease of description, the following description of the embodiments of this application uses i = 0 as an example. i = 0 can be understood as the initial state of the SM4 algorithm when the round function included in the SM4 algorithm has not yet performed an iteration. Optionally, i = 1, 2, ... 31.

[0197] S720 , in the AES finite field, use the first instruction to perform a first affine transformation on the input data of the S-box, the matrix 1, and the matrix 2 to obtain a first affine transformation result.

[0198] Among them, matrix 1 is M -1 ·A SM4 M, matrix 2 is C SM4 M. Perform the first affine transformation on the S-box input, matrix 1 and matrix 2 to obtain the first affine transformation result. It can be expressed by the following formula:

[0199]

[0200] In the above formula (22), When the matrix ASM4 As defined in the above formula (8), the matrix M -1 When the matrix M is defined as in the above formula (6), the matrix and matrix The definitions are as follows:

[0201]

[0202]

[0203] S730 , in the AES finite field, invert the first affine transformation result using the second instruction to obtain an inverted result.

[0204] Among them, the result after inverting the first affine transformation result is It can be expressed by the following formula:

[0205]

[0206] S740 , in the AES finite field, using the first instruction, perform a second affine transformation on the result after the inversion processing, matrix 1, and matrix 2 to obtain a second affine transformation result.

[0207] Among them, the second affine transformation result It can be expressed by the following formula:

[0208]

[0209] It can be understood that the above S710 to S740 correspond to the calculation process of the S-box in the round function included in the SM4 algorithm.

[0210] S750 , in the AES finite field, perform a circular right shift of 8 bits, 16 bits, and 24 bits on the second affine transformation result, respectively, to obtain a second affine transformation result #2, a second affine transformation result #3, and a second affine transformation result #4, respectively.

[0211] Among them, the result of the second affine transformation is Execute circular right shifts of 8, 16, and 24 bits respectively, and the results after shifting are: and

[0212] For example, the circular right shift vprold instruction can be used to implement the above circular shift operation. At this time, the operation of the above S750 can be represented by the following instruction:

[0213] vprold(xmm5,xmm6,08h) (27)

[0214] vprold(xmm5,xmm7,010h) (28)

[0215] vprold(xmm5,xmm8,018h) (29)

[0216] Among them, in the above formulas (27) to (29), the xmm5 register is used to store xmm6 registers are used to store The xmm7 register is used to store xmm8 registers are used to store

[0217] S760 , in the AES finite field, sum data #1, data #2, data #3, and data #4 to obtain an output result of a linear transformation.

[0218] Among them, data #1 is obtained by performing linear transformation #1 on the second affine transformation result #1 using the first instruction; data #2 is obtained by performing linear transformation #2 on the second affine transformation result #2 using the first instruction; data #3 is obtained by performing linear transformation #3 on the second affine transformation result #3 using the first instruction; data #4 is obtained by performing linear transformation #4 on the second affine transformation result #4 using the first instruction. Linear transformation #1, linear transformation #2, linear transformation #3 and linear transformation #4 correspond to the matrices L0, L1, L2 and L3 included in the preset matrix set respectively. Based on this, the output result of the linear transformation is It can be expressed by the following formula:

[0219]

[0220] in, Represents data #1, Represents data #2, Represents data #3, Indicates data #4.

[0221] The method for obtaining data #1 through data #4 described above corresponds to a linear transformation method, which corresponds to the L layer defined in the SM4 algorithm standard. It is understood that the order of executing S750 and obtaining data #1 through data #4 in S760 can be interchanged. That is, after S730, a circular right shift operation is first performed on the result obtained by executing S730, and then an affine transformation is performed on the result obtained by the circular right shift operation and the result obtained by executing S730.

[0222] It is understood that the current iteration is the i-th iterative calculation of the round function in the SM4 algorithm. In the above implementation, S720 is executed in the i-th iteration. Optionally, in other implementations, S720 may also be executed in the previous iterative calculation before the i-th iteration. For example, S720 may be executed after obtaining the linear transformation result in the previous iterative calculation before the i-th iteration.

[0223] In the above implementation, when implementing the round function (including S-box calculations and L-layer calculations) included in the SM4 algorithm based on the GFNI instruction set, only necessary algebraic operations are performed, avoiding the need to introduce additional operations to offset invalid operations and reducing system resource consumption. Specifically, the calculation process of the round function included in the SM4 algorithm can be implemented using only five instructions (i.e., four first instructions and one second instruction). This greatly reduces the number of required instructions and improves operational efficiency. The above method can handle common plaintext packet sizes (e.g., 8 packets of plaintext data, 16 packets of plaintext data, or 32 packets of plaintext data), meaning there is no need to collect 128 or 256 packets of plaintext data before executing the SM4 algorithm, making the method more versatile and practical. The above method can be executed on a general-purpose processor (which should be capable of running the first and second instructions in the GFNI instruction set) without the need for dedicated hardware, making the method more versatile.

[0224] Figure 8 Schematic diagram of a method for implementing a round function in a block cipher algorithm provided in an embodiment of the present application. Specifically, the round function includes a nonlinear transformation. Figure 8 In this paper, the first block cipher algorithm is SM4 algorithm and the second block cipher algorithm is AES algorithm. In this implementation, the nonlinear transformation corresponds to the S-box in the round function included in the SM4 algorithm. The algebraic expression of the S-box is shown in the above formula (7). Figure 8 As shown, the process includes S810 to S850. S810 to S850 are described in detail below.

[0225] S810 , using the first instruction in the GFNI instruction set, convert the input data of the S-box into data on the AES finite field.

[0226] For ease of description, in this embodiment, the input data of the S-box is denoted as x, where x is an 8-bit binary data; the isomorphic matrix mapping the data in the SM4 finite field to the data in the AES finite field is denoted as M; the isomorphic matrix mapping the data in the AES finite field to the data in the SM4 finite field is denoted as M -1 Based on this, when the input data of the S-box is converted to x, the operation of mapping x to the AES finite field can be expressed by the following formula:

[0227] x1=x·M (31)

[0228] Among them, x1 represents the data mapping x in the SM4 finite field to the AES finite field; the matrix M and the matrix M -1 The definition of can be found in formula (6) above.

[0229] S820, in the AES finite field, using the first instruction to execute the data obtained after the above S810, the matrix A SM4 ' and matrix C SM4 'Perform the first affine transformation and obtain the first affine transformation result.

[0230] Matrix A SM4 ' is based on the isomorphic matrix, the inverse matrix of the isomorphic matrix and the matrix A SM4 Determined. Specifically, the matrix A SM4 ' is the isomorphic matrix, the inverse matrix of the isomorphic matrix and the matrix A SM4 The result of performing the dot product, matrix A SM4 The definition of ' can be found in formula (9) above.

[0231] Among them, M -1 represents the inverse matrix of the isomorphism matrix, and M represents the isomorphism matrix.

[0232] Matrix C SM4 ' is based on the isomorphic matrix and matrix A SM4 Determined. Specifically, the matrix C SM4 ' is the isomorphic matrix and matrix C SM4 The result of performing the dot product, matrix C SM4 The definition of ' can be found in formula (10) above.

[0233] In the AES finite field, the data obtained after executing the above S810, the matrix A SM4 ' and matrix C SM4 'Perform the first affine transformation to obtain the first affine transformation result. The first affine transformation result x2 can be expressed by the following formula:

[0234] x2=x1·A SM4 '+C SM4 ' (32)

[0235] S830: In the AES finite field, invert the first affine transformation result using the second instruction to obtain an inverted result.

[0236] The first affine transformation result obtained in step S820 is x2. The inverse of x2 is obtained to obtain the inverse result. Therefore, the inverse result x3 can be expressed by the following formula:

[0237] x3=(x2) -1 (33)

[0238] S840, in the AES finite field, using the first instruction to invert the result, the matrix A SM4 ' and matrix C SM4 'Perform the second affine transformation and obtain the second affine transformation result.

[0239] According to the results obtained from S810 to S830 above, in the AES finite field, the inverse result, the matrix A SM4 ' and matrix C SM4 'Perform the second affine transformation to obtain the second affine transformation result. The second affine transformation result x4 can be expressed by the following formula:

[0240] x4=x3·A SM4 '+C SM4 ' (34)

[0241] S850: Use the first instruction to convert the second affine transformation result into data on the SM4 finite field, and use the data as output data of the S-box.

[0242] According to the result obtained in S840 above, the second affine transformation result is converted into data on the SM4 finite field, and the data is used as the output data of the S-box. The mapped second affine transformation result y can be expressed by the following formula:

[0243] y=(x4) -1 (35)

[0244] In the above implementation, the calculation process of the S-box in the round function included in the SM4 algorithm can be implemented using five instructions (i.e., four first instructions and one second instruction). This method does not consume a large amount of system resources and has high computational efficiency. The above method can be executed on a general-purpose processor without the need for dedicated hardware, making the method highly versatile.

[0245] In the above implementation, when implementing the S-box calculation within the round function of the SM4 algorithm based on the GFNI instruction set, only necessary algebraic operations are performed, avoiding the need to introduce additional operations to offset invalid calculations and reducing system resource consumption. Specifically, the S-box calculation process can be implemented using only five instructions (i.e., four first instructions and one second instruction), significantly reducing the number of required instructions and improving operational efficiency. The above method can handle common plaintext packet sizes (e.g., 8 packets of plaintext data, 16 packets of plaintext data, or 32 packets of plaintext data), eliminating the need to gather 128 or 256 packets of plaintext data before executing the SM4 algorithm. This makes the method more versatile and practical. The above method can be executed on a general-purpose processor (which should be capable of running the first and second instructions in the GFNI instruction set) without the need for dedicated hardware, making the method more versatile.

[0246] Figure 9 Schematic diagram of a method for implementing a round function in a block cipher algorithm provided in an embodiment of the present application. Specifically, the round function includes a nonlinear transformation, and the nonlinear transformation includes an affine transformation and an inverse affine transformation. Figure 9 Take the SM4 algorithm as the first block cipher algorithm and the AES algorithm as the second block cipher algorithm as an example. In this implementation, Figure 9 The nonlinear transformation shown corresponds to the S-box and L-layer specified in the SM4 algorithm standard. The algebraic expression of the S-box is specifically shown in the above formula (7), and the algebraic expression of the L-layer is specifically shown in the above formula (11) or the above formula (12). For the convenience of description, in the embodiment of the present application, the input data of the nonlinear transformation of the SM4 algorithm during the i-th round of iterative calculation is (x i ,x i+1 ,x i+2 ,x i+3 ),i=0,1,......,31” as an example, the calculation process of the round function in the SM4 encryption algorithm provided in the embodiment of the present application is introduced. Figure 9 As shown, the process includes S910 to S940. S910 to S940 are described in detail below.

[0247] S910 , in the i-th iteration, using the first instruction in the GFNI instruction set to map the input data of the nonlinear transformation to the AES finite field respectively.

[0248] For ease of description, in the embodiment of the present application, the input data of the SM4 algorithm including the nonlinear transformation in the round function during the i-th iteration is recorded as (x i ,x i+1 ,x i+2 ,x i+3),i=0,1,......,31。

[0249] It can be understood that the working principle of the above S910 is the same as that of the above S710, except that the input data of the S-box in the above S720 is replaced by the input data of the nonlinear transformation in the embodiment of the present application. For matters not described in detail here, please refer to the description in the above S710.

[0250] S920 , in the AES finite field, using the first instruction, perform affine transformation on the input data of the nonlinear transformation, the matrix 1, and the matrix 2 to obtain an affine transformation result.

[0251] It can be understood that the working principle of the above S920 is the same as that of the above S720, except that the input data of the S box in the above S720 is replaced by the input data of the nonlinear transformation in the embodiment of the present application. For matters not described in detail here, please refer to the description in the above S720.

[0252] S930 , performing a cyclic shift operation on the affine transformation in the AES finite field to obtain a cyclic shift operation result.

[0253] In the AES finite field, performing a circular shift operation on the affine transformation result to obtain a circular shift operation result includes: performing a circular right shift of 0 bits, 8 bits, 16 bits, and 24 bits on the affine transformation result to obtain three corresponding circular shift operation results. For example, when the affine transformation result obtained in the above S930 is When , the corresponding 4 cyclic shift operation results can be recorded as:

[0254]

[0255] S940 , in the AES finite field, using the second instruction to perform an inverse affine transformation on the cyclic shift operation result, data 1 and data 2 to obtain a nonlinear transformation result.

[0256] Wherein, data 1 is data obtained by mapping the dot product of the preset matrix set and the preset matrix into the second finite field. For example, when the preset matrix set includes the four preset matrices (i.e., L0, L1, L2, and L3) shown in the above formula (13), data 1 may include the matrix matrix and matrix matrix matrix and matrix The definitions are as follows:

[0257]

[0258]

[0259]

[0260] Wherein, data 2 is data obtained by mapping the preset matrix set and the preset vector to the second finite field. Optionally, data 2 is data obtained by mapping the preset matrix set and the preset vector to the second finite field, that is, data 2 is data obtained by mapping some preset matrices and preset vectors in the preset matrix set to the second finite field. For example, when the preset matrix set includes the four preset matrices (i.e., L0, L1, L2, and L3) shown in formula (13), data 2 can be expressed by the following formula:

[0261] C SM4 ·(L0+L3)·M (40)

[0262] Based on this, the result of nonlinear transformation It can be expressed by the following formula:

[0263]

[0264] In the above implementation, when calculating the round function included in the SM4 algorithm based on the GFNI instruction set, only necessary algebraic operations are performed, avoiding the need to introduce additional operations to offset invalid calculations, thereby reducing system resource consumption. Specifically, the calculation process of the round function included in the SM4 algorithm can be implemented using only three instructions (i.e., two first instructions and one second instruction). This greatly reduces the number of required instructions and improves operational efficiency. The above method can handle common plaintext packet sizes (e.g., 8 packets of plaintext data, 16 packets of plaintext data, or 32 packets of plaintext data), meaning there is no need to collect 128 or 256 packets of plaintext data before executing the SM4 algorithm, making the method more versatile and practical. The above method can be executed on a general-purpose processor (which should be capable of running the first and second instructions in the GFNI instruction set) without the need for dedicated hardware, making the method more versatile.

[0265] Above, combined Figure 9 The following describes the schematic diagram of the implementation of the round function in the block cipher algorithm provided by the embodiment of the present application in detail. Figure 9 The method described.

[0266] For ease of description, the following uses an assembly API with 128-bit register operands as an example to illustrate how to implement the simplified round function calculation process using the GFNI instruction set. The 128-bit registers can simultaneously process four groups of the SM4 algorithm.

[0267] First, the round key rki and the current internal state of the SM4 algorithm (x i ,x i+1 ,x i+2 ,x i+3 ), i=0,1,......,31 are loaded into a 128-bit register (take register xmm0 as an example), the above matrix M is loaded into the high 64 bits and low 64 bits of another register in the form of a column vector (the loaded register is recorded as xmm1), the corresponding output register is recorded as xmm2, and the following operations are performed:

[0268] VGF2P8AFFINEQB(xmm0,xmm1,xmm2,00h) (42)

[0269] Then, according to the structure of the standard round function of the SM4 algorithm, the inputs of the four groups of S boxes are calculated (the input of each group contains 4×8=32 bits), and the four inputs are placed in a 128-bit register (let this register be xmm3) in sequence.

[0270] Then, the matrix Load another 128-bit register (set to xmm4) in the form of a column vector, set the output register to xmm5, and execute the following instruction operations:

[0271] VGF2P8AFFINEQB(xmm3,xmm4,xmm5,0ceh) (43)

[0272] Then, a circular right shift operation is first performed on the result output by register xmm5. The circular right shift operation on the result output by register xmm5 may include: performing circular right shift operations of 8, 16, and 24 bits on the result output by xmm5, respectively. For example, the circular right shift operation may be implemented using the following instruction:

[0273] vprold(xmm5,xmm6,08h) (44)

[0274] vprold(xmm5,xmm7,010h) (45)

[0275] vprold(xmm5,xmm8,018h) (46)

[0276] The vprold instruction is used to perform a 32-bit word circular right shift. Optionally, the vprold instruction operation may also be implemented using other instructions, which will not be described in detail.

[0277] Then, the above matrix and Put them into the high 64 bits and low 64 bits of the register respectively, set The register to be placed is xmm9, The register to be placed is xmm10, The register to be placed is xmm11, and then the following instruction operations are executed:

[0278] VGF2P8AFFINEINVQB(xmm5,xmm9,xmm5,00h) (47)

[0279] VGF2P8AFFINEINVQB(xmm6,xmm10,xmm6,00h) (48)

[0280] VGF2P8AFFINEINVQB(xmm7,xmm10,xmm7,00h) (49)

[0281] VGF2P8AFFINEINVQB(xmm8,xmm11,xmm8,0e7h) (50)

[0282] Finally, the contents of registers xmm5, xmm6, xmm7, and xmm8 are XORed to obtain the output of this sub-step, that is, the output result of the L-level operation.

[0283] It should be noted that the above steps are described by first performing a circular right shift operation and then executing the VGF2P8AFFINEINVQB instruction on the result of the circular right shift operation. Optionally, the above steps can also be replaced by the following steps: first executing the VGF2P8AFFINEINVQB instruction, and then executing the circular right shift operation on the result of the VGF2P8AFFINEINVQB instruction operation.

[0284] After 32 rounds of iterative calculations are completed, the results of the 32nd round of iterative calculations are loaded into four 128-bit registers, and the above matrix M is -1 Load the high 64 bits and low 64 bits of another 128-bit register (i.e., xmm13 register) in the form of a column vector. When the result of any of the above iterative calculations is loaded into the xmm11 memory and the output ciphertext data is loaded into the xmm12 memory, execute the following instructions to obtain the ciphertext data:

[0285] VGF2P8AFFINEQB(xmm11,xmm12,xmm13,00h) (51)

[0286] After the instruction operation of the above formula (52) is processed, the results obtained after the processing are arranged in reverse order to obtain the ciphertext data, that is, the encryption result output of the SM4 algorithm.

[0287] Figure 10ASchematic diagram of a method for implementing the SM4 encryption algorithm provided in an embodiment of the present application. Specifically, the round function of the SM4 algorithm includes an S-box and an L-layer. The algebraic expression of the S-box is specifically shown in the above formula (7), and the algebraic expression of the L-layer is specifically shown in the above formula (11) or the above formula (12). For ease of description, in the embodiment of the present application, when the i-th round of iterative calculation is performed, the input of the round function included in the SM4 encryption algorithm includes: the round key rk i and the current internal state of the SM4 algorithm (x i ,x i+1 ,x i+2 ,x i+3 ), i = 0, 1, ..., 31 "as an example, the method for implementing the SM4 encryption algorithm provided in the embodiment of the present application is introduced. Figure 10A As shown, the process includes S1001 to S1009. S1001 to S1009 are described in detail below.

[0288] S1001, obtain 128-bit plaintext data to be encrypted, and determine the input data of the S-box when the round function included in the SM4 encryption algorithm performs the i-th round of iterative calculation based on the 128-bit plaintext data to be encrypted and the round key, where i = 0, 1, 2, ..., 31.

[0289] The 128-bit plaintext data to be encrypted can be understood as the internal state of the SM4 algorithm when performing the first round of iterative calculation. In other words, determining the input data of the S-box when the round function included in the SM4 encryption algorithm performs the i-th round of iterative calculation based on the 128-bit plaintext data to be encrypted and the round key can be understood as obtaining the input data of the S-box during the i-th round of iterative calculation based on the round key corresponding to the i-th round of iterative calculation and the internal state of the SM4 algorithm during the i-th round of iterative calculation. In one example, the input data of the S-box during the i-th round of iterative calculation can be obtained based on the round key corresponding to the i-th round of iterative calculation and the internal state of the SM4 algorithm during the i-th round of iterative calculation in the manner specified in the SM4 algorithm standard. For ease of description, the 128-bit plaintext data input to the SM4 algorithm will be referred to as (X0, X1, X2, X3) below, and (X0, X1, X2, X3) will also be referred to as the internal state of the SM4 algorithm during the first round of iterative calculation. Taking the first round of iterative calculation as an example, the round key rk0 of the first round of iterative calculation is used to XOR X1, X2 and X3 to obtain a 32-bit data, which is then split into four 8-bit data, that is, the input data (x0, x1, x2, x3) of the S box in the i-th round of iterative calculation is obtained. Among them, the round key rk0 is used to XOR X1, X2 and X3, which can be expressed as Taking the second round of iterative calculation as an example, the round key rk1 from the second round of iterative calculation is used to XOR X2, X3, and X4 to obtain a 32-bit data. This 32-bit data is then split into four 8-bit data, which is the input data (x1, x2, x3, x4) for the S-box in the second round of iterative calculation. X4 is the result obtained from the first round of iterative calculation. Similarly, the input data for the S-box in the third, ..., 32nd round of iterative calculation can be obtained. Round key rk i The round key is determined based on the encryption key, and the method for obtaining the round key is not specifically limited. For example, the round key can be obtained based on the encryption key in the manner specified in the SM4 algorithm standard.

[0290] It will be appreciated that the input data of the S-box in S1001 is data in the SM4 finite field. When calculating the SM4 encryption algorithm, the round function included in the SM4 encryption algorithm must be iterated 32 times. The principles of each of the 32 rounds of iterative calculations are the same; only the input data and output results of the round function differ in each round. The calculation process of the round function during the i-th round will be described in detail below in conjunction with S1002 to S1006.

[0291] S1002, in the AES finite field, use instruction 1 to perform affine transformation on the input data of the S-box, matrix 1 and matrix 2 to obtain an affine transformation result.

[0292] Instruction 1 is the VGF2P8AFFINEQB instruction. Matrix 1 is denoted as A1, and the definition of A1 can be found in the above formula (15). Matrix 2 is denoted as C1, and the definition of C1 can be found in the above formula (16).

[0293] In the embodiment of the present application, the input data of the S-box during the i-th round of iterative calculation is recorded as (x i ,x i+1 ,x i+2 ,x i+3 ), i = 0, 1, ..., 31. Based on this, instruction 1 is used to perform affine transformation on the input data of the S-box, matrix 1 and matrix 2 to obtain the affine transformation result, that is, instruction 1 is used to calculate the following formula:

[0294]

[0295] in, Represents the affine transformation result.

[0296] S1003, in the AES finite field, use instruction 2 to transform the affine transformation result, matrix A2 and preset vector C SM4 Perform the inverse affine transform to obtain the output of the S-box.

[0297] Among them, the preset vector CSM4 The definition of is given in formula (8) above, and the definition of matrix A2 is given in formula (18) above.

[0298]

[0299] Among them, (x i ,x i+1 ,x i+2 ,x i+3 )' represents the output result of the S-box.

[0300] S1004: Perform a cyclic shift operation on the output result of the S-box in the AES finite field to obtain a cyclic shift result.

[0301] In the AES finite field, a cyclic shift operation is performed on the output result of the S-box to obtain a cyclic shift operation result, including: performing a cyclic right shift of 0 bits, 8 bits, 16 bits and 24 bits on the output result of the S-box to obtain the corresponding 4 cyclic shift operation results. When the output result of the S-box is recorded as (x i ,x i+1 ,x i+2 ,x i+3 )', the results of the four cyclic shift operations can be recorded as: (x i ,x i+1 ,x i+2 ,x i+3 )'、(x i+3 ,x i ,x i+1 ,x i+2 )'、(x i+2 ,x i+3 ,x i ,x i+1 )' and (x i+1 ,x i+2 ,x i+3 ,x i )'.

[0302] S1005 , in the AES finite field, use instruction 2 to perform an inverse affine transformation on the cyclic shift operation result, data 1 and data 2 to obtain an output result of the L layer.

[0303] Wherein, data 1 is data obtained by mapping the dot product result of the preset matrix set and the preset matrix to the second finite field. When the preset matrix set includes the four preset matrices (i.e., L0, L1, L2, and L3) shown in the above formula (13), data 1 may include the following matrices: matrix matrix and matrix The definitions of these matrices can be found in Formulas (37) to (39) above. Data 2 is data that maps the preset matrix set and the preset vector to the second finite field. Optionally, Data 2 is data that maps the preset matrix set and the preset vector to the second finite field, that is, Data 2 is data that maps some of the preset matrices and preset vectors in the preset matrix set to the second finite field. The definition of Data 2 can be found in Formula (40) above.

[0304] In the AES finite field, instruction 2 is used to perform an inverse affine transformation on the result of the circular shift operation, data 1, and data 2 to obtain the output result of the L layer. That is, instruction 2 is used to calculate the following formula:

[0305] The result of nonlinear transformation It can be expressed by the following formula:

[0306]

[0307] The above instruction 2 may be the VGF2P8AFFINEINVQB instruction in the GFNI instruction set.

[0308] S1006, performing an XOR operation on the result of the nonlinear transformation and the input data of the S-box to obtain the result of the iterative calculation of the i-th round.

[0309] Perform an XOR operation on the result of the nonlinear transformation and the input data of the S-box to obtain the result of the i-th round of iterative calculation, that is, perform the following operation:

[0310]

[0311] It is understandable that after the execution of the i-th round of iterative calculation, the internal state of the SM4 algorithm changes from (x i ,x i+1 ,x i+2 ,x i+3 ) is changed to (x i+1 ,x i+2 ,x i+3 ,x i+4 ). That is to say, when executing the i+1th round of iterative calculation, the internal state of the SM4 algorithm is (x i+1 ,x i+2 ,x i+3 ,x i+4 ).

[0312] S1007, determine whether i is equal to 31.

[0313] According to the working principle of the SM4 algorithm, when i is equal to 31, it is the last round of iterative calculation performed on the round function included in the SM4 algorithm (i.e., the 32nd round of iterative calculation). That is to say, if the current iterative calculation is the last round of iterative calculation performed on the round function, then the iterative calculation needs to be stopped thereafter, and the ciphertext data is obtained based on the result of the last round of iterative calculation. If the current iterative calculation is not the last round of iterative calculation performed on the round function, then the next round of iterative calculation needs to be continued thereafter. Based on this, determining whether i is equal to 31 includes: if it is determined that i is equal to 31, then executing S1008 after S1007; if it is determined that i is not equal to 31, then executing S1009 after S1007.

[0314] S1008, use instruction 1 to map the results obtained from the iterative calculations of the i-3th round, the i-2th round, the i-1th round and the i-th round respectively into the SM4 finite field, and reverse the mapping results to obtain the ciphertext data.

[0315] Instruction 1 is used to map the results of the iterative calculations of the i-3th round, the i-2th round, the i-1th round, and the i-th round into the SM4 finite field, that is, instruction 1 is used to implement the calculation of the following formulas respectively:

[0316]

[0317] Among them, X 32 ', X 33 ', X 34 ' and X 35 ' are the results obtained by iterative calculation of the i-3th round, i-2th round, i-1th round and i-th round respectively.

[0318] When the results of the iterative calculations in rounds i-3, i-2, i-1 and i are obtained, the mapping results are: X 32 , X 33 , X 34 and X 35 When the order is reversed, the result is X 35 , X 34 , X 33 and X 32 , that is, the ciphertext data is (X 35 ,X 34 ,X 33 ,X 32 ).

[0319] S1009, executing calculation of the (i+1)th iteration round function.

[0320] The calculation principle of the round function for the (i+1)th iteration is the same as that for the (i)th iteration, except that the input data and output result of the round function are different. The input data of the round function for the (i+1)th iteration is the result of the (i)th iteration. The input data of the round function can be understood as the input data of the S-box in the round function. For details not detailed in the method corresponding to S1008, please refer to the calculation process of the round function for the (i)th iteration described in S1002 to S1006 above.

[0321] The device that executes the above methods S1001 to S1009 may be a general-purpose processor that supports the GFNI instruction set, for example, the processor may be a CPU.

[0322] It is understandable that the above implementation method uses the SM4 encryption algorithm as an example. The working principle of the encryption algorithm included in the SM4 algorithm is the same as the working principle of the decryption algorithm. The difference is that the order of the round keys used in the decryption algorithm is reversed from the order of the round keys used in the encryption algorithm. When implementing the SM4 encryption algorithm in the above method, the round keys used in the 32-round iterative calculation of the round function are: (rk0,rk1,......,rk 31 ). Therefore, the round keys (rk0,rk1,......,rk 31 ) is replaced by (rk 31 ,rk 30 ,……,rk0), the SM4 decryption algorithm can be implemented.

[0323] In the above implementation, only three instructions from the GFNI instruction set (i.e., one VGF2P8AFFINEQB instruction and two VGF2P8AFFINEINVQB instructions) are required for each round of iterative calculation of the round function. After obtaining the results of the last four rounds of iterative calculations, another instruction is used to map these results to the SM4 finite field to obtain ciphertext data. The above method only requires a small number of instructions to implement the SM4 encryption algorithm, which can improve the computational efficiency of the SM4 encryption algorithm. The above method can handle common numbers of plaintext groups (e.g., 8 groups of plaintext data, 16 groups of plaintext data, or 32 groups of plaintext data), that is, there is no need to collect 128 or 256 groups of plaintext data before executing the SM4 algorithm, making the method more versatile and practical. When the above method is executed by a general-purpose processor, the processor does not need to be equipped with dedicated hardware to solve the SM4 algorithm, making the method more versatile.

[0324] It should be understood that the above Figures 6 to 10 The specific embodiment shown in A is for illustration only and does not constitute any limitation on the method for implementing the block cipher algorithm provided in this application.

[0325] Above, combined Figures 1 to 10 A introduces in detail the method for implementing the block cipher algorithm provided by this application. Figure 10 and Figure 11 This application introduces the apparatus and electronic device for implementing a block cipher algorithm. It should be understood that the method for implementing a block cipher algorithm described above corresponds to the apparatus and electronic device for implementing a block cipher algorithm described below. Therefore, for any details not described below, reference can be made to the relevant descriptions in the aforementioned method embodiments.

[0326] Corresponding to the method for implementing a block cipher algorithm provided in an embodiment of the present application, an embodiment of the present application provides a device for implementing a block cipher algorithm.

[0327] Figure 10 This is a structural diagram of a device for implementing a block cipher algorithm provided in an embodiment of the present application. Figure 10 As shown, the device includes an acquisition unit 1001, a processing unit 1002 and an output unit 1003.

[0328] In some implementations, the device is used to implement the encryption algorithm process corresponding to the block cipher algorithm in the above method embodiment. Below, the steps in the encryption algorithm executed by the acquisition unit 1001, the processing unit 1002 and the output unit 1003 when executing the encryption algorithm are described.

[0329] An acquisition unit 1001 is used to acquire plaintext data to be encrypted; a processing unit 1002 is used to encrypt the plaintext data to be encrypted using a first block cipher algorithm to obtain ciphertext data, wherein an instruction set is used to implement the calculation of a round function in the first block cipher algorithm, the round function includes a nonlinear transformation, and the instruction set includes instructions for solving the nonlinear transformation; an output unit 1003 is used to output the ciphertext data.

[0330] Optionally, the processing unit 1002 is further used to: obtain input data of the nonlinear transformation, wherein the input data of the nonlinear transformation is determined based on the round key and the plaintext data, and the input data of the nonlinear transformation is data in a first finite field, and the first finite field is the finite field of the first cryptographic block algorithm; in a second finite field, use the instruction set to implement the nonlinear transformation on the input data of the nonlinear transformation to obtain a result of the nonlinear transformation, wherein the result of the nonlinear transformation is data in the second finite field, the second finite field is the finite field of the second block cryptographic algorithm, the second finite field is isomorphic to the first finite field, and the first block cryptographic algorithm is different from the second block cryptographic algorithm; and obtain the ciphertext data based on the result of the nonlinear transformation, and the ciphertext data is the data in the first finite field.

[0331] Optionally, the nonlinear transformation includes a first affine transformation and a first inverse affine transformation, and the processing unit 1002 is further used to: use the first instruction in the instruction set to perform the first affine transformation on the first data, the second data and the input data of the nonlinear transformation to obtain the first affine transformation result, wherein the first data is data obtained by mapping a preset matrix to the second finite field according to the isomorphic matrix, and the second data is data obtained by mapping a preset vector to the second finite field according to the isomorphic matrix, and the isomorphic matrix is used to indicate the isomorphic relationship; use the second instruction in the instruction set to perform the first inverse affine transformation on the preset matrix, the preset vector and the first affine transformation result to obtain the result of the nonlinear transformation.

[0332] Optionally, the nonlinear transformation includes a first affine transformation, a second affine transformation and an inverse transformation, and the processing unit 1002 is further used to: use the first instruction in the instruction set to perform the first affine transformation on the mapping result of the first data, the second data and the input data to obtain the first affine transformation result, wherein the mapping result of the input data is the data of mapping the input data to the second finite field according to the isomorphic matrix, the first data is the data of mapping a preset matrix to the second finite field according to the isomorphic matrix, the second data is the data of mapping a preset vector to the second finite field according to the isomorphic matrix, and the isomorphic matrix is used to indicate the isomorphic relationship; use the second instruction in the instruction set to perform the inverse transformation on the first affine transformation result to obtain the result of the inverse transformation; use the first instruction to perform the second affine transformation on the first data, the second data and the result of the inverse transformation to obtain the result of the nonlinear transformation.

[0333] Optionally, the round function also includes a linear transformation, and the processing unit 1002 is further used to: perform the linear transformation on the result of the nonlinear transformation to obtain the result of the linear transformation; perform an XOR operation on the result of the linear transformation and the internal state of the first block cipher algorithm to obtain the output result of the round function; when the round key is the key used for the last round of iterative calculation in the first block cipher algorithm, the mapping results of the output results of the round function obtained by the last four rounds of iterative calculation in the first block cipher algorithm are arranged in reverse order, and the results obtained by the reverse arrangement are determined as the ciphertext data, and the mapping result of the output result of the round function obtained by any round of iterative calculation is the result of mapping the output result of the round function obtained by any round of iterative calculation to the first finite field using the isomorphic matrix.

[0334] Optionally, the processing unit 1002 is further used to: perform a circular shift operation on the result of the nonlinear transformation to obtain the circular shift operation result; use the first instruction to perform the linear transformation on the circular shift operation result according to a linear preset matrix set to obtain the result of the linear transformation, and the number of preset matrices included in the preset matrix set is associated with the result of the circular shift operation.

[0335] Optionally, the nonlinear transformation includes a first affine transformation and a first inverse affine transformation, and the processing unit 1002 is further used to: use the first instruction in the instruction set to perform the first affine transformation on the mapping result of the first data, the second data and the input data to obtain the first affine transformation result, wherein the mapping result of the input data is data obtained by mapping the input data to the second finite field according to the isomorphic matrix, the first data is data obtained by mapping a preset matrix to the second finite field according to the isomorphic matrix, and the second data is data obtained by mapping a preset vector to the second finite field according to the isomorphic matrix, and the isomorphic matrix is used to indicate the isomorphic relationship; perform a circular shift operation on the first affine transformation result to obtain the circular shift operation result; use the second instruction in the instruction set to perform the first inverse affine transformation on the circular shift operation result, third data and fourth data to obtain the result of the nonlinear transformation, wherein the third data is data obtained by mapping the dot product result of the preset matrix set and the preset matrix to the second finite field, and the fourth data is data obtained by mapping the preset matrix set and the preset vector to the second finite field.

[0336] Optionally, the processing unit 1002 is further used to: perform an XOR operation on the result of the nonlinear transformation and the internal state of the first block cipher algorithm to obtain the output result of the round function, and the internal state of the first block cipher algorithm is associated with the input data of the nonlinear transformation; when the round key is the key used for the last round of iterative calculation in the first block cipher algorithm, the mapping results of the output results of the round function obtained by the last four rounds of iterative calculation in the first block cipher algorithm are arranged in reverse order, and the results obtained by the reverse arrangement are determined as the ciphertext data, and the mapping result of the output result of the round function obtained by any round of iterative calculation is the result of mapping the output result of the round function obtained by any round of iterative calculation to the first finite field using the isomorphic matrix.

[0337] Optionally, the processing unit 1002 is further configured to: map the nonlinearly transformed input data to the second finite field using the first instruction in the instruction set and the isomorphic matrix to obtain a mapping result of the input data.

[0338] Optionally, the first block cipher algorithm is the national secret SM4 algorithm, and the second block cipher algorithm is the Advanced Encryption Standard AES.

[0339] Optionally, the instruction set is a GFNI instruction set, the first instruction is a VGF2P8AFFINEQB instruction, and the second instruction is a VGF2P8AFFINEINVQB instruction.

[0340] Optionally, in other implementations, the device is used to implement the decryption algorithm process corresponding to the block cipher algorithm in the above method embodiment. Below, the steps in the decryption algorithm executed by the acquisition unit 1001, the processing unit 1002 and the output unit 1003 when executing the decryption algorithm are described.

[0341] An acquisition unit 1001 is used to acquire ciphertext data to be decrypted;

[0342] a processing unit 1002 configured to decrypt the decrypted data to be decrypted using a first block cipher algorithm to obtain plaintext data, wherein a round function in the first block cipher algorithm is calculated using an instruction set, the round function includes a nonlinear transformation, and the instruction set includes instructions for solving the nonlinear transformation;

[0343] The output unit 1003 is configured to output the plaintext data.

[0344] It can be understood that the implementation principle of the decryption algorithm provided in the embodiment of the present application is the same as the implementation principle of the encryption algorithm. The difference is that the order of the round keys used in the decryption algorithm and the order of the round keys used in the encryption algorithm are in reverse order. Therefore, for the content not described in detail in this part, please refer to the implementation process of the encryption algorithm above.

[0345] It should be noted that for the detailed description of the device embodiment provided in the embodiment of the present application, reference can be made to the relevant description of the method for implementing the block cipher algorithm provided in the embodiment of the present application, which will not be repeated here.

[0346] Corresponding to a method for implementing a block cipher algorithm provided in an embodiment of the present application, an embodiment of the present application provides an electronic device.

[0347] Figure 11 This is a structural diagram of an electronic device provided in an embodiment of the present application. Figure 11 As shown, the system includes a memory 1101, a processor 1102, a communication interface 1103 and a communication bus 1104. The memory 1101, the processor 1102 and the communication interface 1103 are connected to each other via the communication bus 1104.

[0348] The memory 1101 may be a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1101 may store programs. When the program stored in the memory 1101 is executed by the processor 1102, the processor 1102 and the communication interface 1103 are used to perform the various steps of the method for implementing the block cipher algorithm in the embodiment of the present application.

[0349] The processor 1102 can be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), a graphics processing unit (GPU) or one or more integrated circuits to execute relevant programs to implement the functions required to be performed by the units in the device for implementing the block cipher algorithm of the embodiment of the present application, or to execute the various steps of the method for implementing the block cipher algorithm of the embodiment of the present application.

[0350] Processor 1102 may also be an integrated circuit chip with signal processing capabilities. During implementation, the various steps of the method for implementing the block cipher algorithm provided herein may be performed by hardware integrated logic circuits or software instructions within processor 1102. The aforementioned processor 1102 may also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component. The various methods, steps, and logic block diagrams disclosed in the embodiments of this application may be implemented or executed. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in conjunction with the embodiments of this application may be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules within the decoding processor. The software module may be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. The storage medium is located in the memory 1101, and the processor 1102 reads the information in the memory 1101, and combines its hardware to complete the functions required to be performed by the units included in the device for implementing the block cipher algorithm of the embodiment of the present application, or executes the method for implementing the block cipher algorithm of the method embodiment of the present application.

[0351] The communication interface 1103 uses a transceiver such as, but not limited to, a transceiver to implement Figure 11 The device shown may communicate with other devices or communication networks. For example, encrypted data may be output via the communication interface 1103.

[0352] The communication bus 1104 may include Figure 11 The pathway for transmitting information between the various components of the device (e.g., memory 1101, processor 1102, and communication interface 1103) is shown.

[0353] An embodiment of the present application further provides a storage device, which stores program instructions executable by a processor, and the program instructions are used to implement the various steps of the method for implementing the block cipher algorithm provided in the present application.

[0354] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored on a computer-readable medium and includes several instructions to enable a computing device (which can be a personal computer, server, terminal device, or network device, etc.) to execute the method according to the embodiments of the present disclosure.

[0355] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0356] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0357] 1. Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage media, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include non-transitory media such as modulated data signals and carrier waves.

[0358] 2. Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0359] Although the present application is disclosed as above with the preferred embodiments, it is not intended to limit the present application. Any person skilled in the art may make possible changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be based on the scope defined by the claims of the present application.

Claims

1. A method for implementing a block cipher algorithm, characterized in that: include: Obtain the plaintext data to be encrypted; Encrypting the plaintext data to be encrypted using a first block cipher algorithm to obtain ciphertext data, wherein calculating a round function in the first block cipher algorithm using an instruction set includes: performing a nonlinear transformation on input data of the nonlinear transformation using the instruction set in a second finite field to obtain a result of the nonlinear transformation, wherein the result of the nonlinear transformation is data in the second finite field, the second finite field is a finite field of the second block cipher algorithm, the second finite field is isomorphic to the first finite field, and the first block cipher algorithm is different from the second block cipher algorithm; The round function includes a nonlinear transformation, and the instruction set includes instructions for solving the nonlinear transformation; Output the ciphertext data.

2. The method according to claim 1, characterized in that The method further comprises: encrypting the plaintext data to be encrypted by using a first block cipher algorithm to obtain ciphertext data, wherein the method further comprises: Obtaining input data for the nonlinear transformation, wherein the input data for the nonlinear transformation is determined based on a round key and the plaintext data, and the input data for the nonlinear transformation is data in a first finite field, and the first finite field is a finite field of the first block cipher algorithm; The ciphertext data is obtained according to the result of the nonlinear transformation, where the ciphertext data is data in the first finite field.

3. The method according to claim 2, characterized in that The nonlinear transformation includes a first affine transformation and a first inverse affine transformation, and implementing the nonlinear transformation in the second finite field using the instruction set to obtain a result of the nonlinear transformation includes: Performing the first affine transformation on first data, second data, and input data of the nonlinear transformation using a first instruction in the instruction set to obtain the first affine transformation result, wherein the first data is data obtained by mapping a preset matrix to the second finite field according to an isomorphism matrix, and the second data is data obtained by mapping a preset vector to the second finite field according to the isomorphism matrix, and the isomorphism matrix is used to indicate the isomorphism relationship; The first inverse affine transformation is performed on the preset matrix, the preset vector and the first affine transformation result using a second instruction in the instruction set to obtain the nonlinear transformation result.

4. The method according to claim 2, characterized in that The nonlinear transformation includes a first affine transformation, a second affine transformation, and an inverse transformation. In the second finite field, implementing the nonlinear transformation using the instruction set to obtain a result of the nonlinear transformation includes: performing a first affine transformation on first data, second data, and a mapping result of the input data using a first instruction in the instruction set to obtain the first affine transformation result, wherein the first data is data obtained by mapping a preset matrix to the second finite field according to an isomorphism matrix, the second data is data obtained by mapping a preset vector to the second finite field according to the isomorphism matrix, the isomorphism matrix is used to indicate the isomorphism relationship, and the mapping result of the input data is data obtained by mapping the input data to the second finite field according to the isomorphism matrix; Performing the inverse transformation on the first affine transformation result using a second instruction in the instruction set to obtain the inverse transformation result; The first instruction is used to perform a second affine transformation on the first data, the second data, and the result of the inverse transformation to obtain the result of the nonlinear transformation.

5. The method according to claim 3 or 4, characterized in that The round function further includes a linear transformation, and obtaining the ciphertext data according to the result of the nonlinear transformation includes: Performing the linear transformation on the result of the nonlinear transformation to obtain a result of the linear transformation; performing an exclusive-OR operation on a result of the linear transformation and an internal state of the first block cipher algorithm to obtain an output result of the round function, wherein the internal state of the first block cipher algorithm is associated with input data of the nonlinear transformation; When the round key is the key used in the last round of iterative calculation in the first block cipher algorithm, the mapping results of the output results of the round function obtained by the last four rounds of iterative calculation in the first block cipher algorithm are arranged in reverse order, and the results obtained by the reverse arrangement are determined as the ciphertext data, and the mapping result of the output result of the round function obtained by any round of iterative calculation is the result of mapping the output result of the round function obtained by any round of iterative calculation to the first finite field using the isomorphic matrix.

6. The method according to claim 5, characterized in that The performing the linear transformation on the result of the nonlinear transformation to obtain the result of the linear transformation includes: Performing a cyclic shift operation on the result of the nonlinear transformation to obtain the cyclic shift operation result; The linear transformation is performed on the result of the cyclic shift operation according to a preset matrix set using the first instruction to obtain a result of the linear transformation, wherein the number of preset matrices included in the preset matrix set is associated with the result of the cyclic shift operation.

7. The method according to claim 2, characterized in that The nonlinear transformation includes a first affine transformation and a first inverse affine transformation. In the second finite field, implementing the nonlinear transformation on input data of the nonlinear transformation using the instruction set to obtain a result of the nonlinear transformation includes: performing the first affine transformation on first data, second data, and a mapping result of the input data using the first instruction in the instruction set to obtain the first affine transformation result, wherein the mapping result of the input data is data obtained by mapping the input data to the second finite field according to a homogeneous matrix, the first data is data obtained by mapping a preset matrix to the second finite field according to the homogeneous matrix, the second data is data obtained by mapping a preset vector to the second finite field according to the homogeneous matrix, and the homogeneous matrix is used to indicate the homogeneous relationship; Performing a circular shift operation on the first affine transformation result to obtain the circular shift operation result; The first inverse affine transformation is performed on the circular shift operation result, third data, and fourth data using the second instruction in the instruction set to obtain the result of the nonlinear transformation, wherein the third data is data obtained by mapping the dot product result of the preset matrix set and the preset matrix to the second finite field, and the fourth data is data obtained by mapping the preset matrix set and the preset vector to the second finite field.

8. The method according to claim 7, characterized in that The step of obtaining the ciphertext data according to the result of the nonlinear transformation includes: performing an exclusive OR operation on a result of the nonlinear transformation and an internal state of the first block cipher algorithm to obtain an output result of the round function, wherein the internal state of the first block cipher algorithm is associated with input data of the nonlinear transformation; When the round key is the key used in the last round of iterative calculation in the first block cipher algorithm, the mapping results of the output results of the round function obtained by the last four rounds of iterative calculation in the first block cipher algorithm are arranged in reverse order, and the results obtained by the reverse arrangement are determined as the ciphertext data, and the mapping result of the output result of the round function obtained by any round of iterative calculation is the result of mapping the output result of the round function obtained by any round of iterative calculation to the first finite field using the isomorphic matrix.

9. The method according to claim 4 or 7, characterized in that The method further comprises: The input data of the nonlinear transformation is mapped to the second finite field using the first instruction in the instruction set and the isomorphism matrix to obtain a mapping result of the input data.

10. The method according to any one of claims 2 to 4, characterized in that The first block cipher algorithm is the national secret SM4 algorithm, and the second block cipher algorithm is the Advanced Encryption Standard AES.

11. The method according to claim 3 or 4, characterized in that The instruction set is the GFNI instruction set, the first instruction is the VGF2P8AFFINEQB instruction, and the second instruction is the VGF2P8AFFINEINVQB instruction.

12. A method for implementing a block cipher algorithm, characterized in that: include: Obtain the ciphertext data to be decrypted; Decrypting the decrypted data to be decrypted using a first block cipher algorithm to obtain plaintext data, wherein calculating a round function in the first block cipher algorithm using an instruction set includes: performing a nonlinear transformation on input data of the nonlinear transformation using the instruction set in a second finite field to obtain a result of the nonlinear transformation, wherein the result of the nonlinear transformation is data in the second finite field, the second finite field is a finite field of the second block cipher algorithm, the second finite field is isomorphic to the first finite field, and the first block cipher algorithm is different from the second block cipher algorithm; The round function includes a nonlinear transformation, and the instruction set includes instructions for solving the nonlinear transformation; The plaintext data is output.

13. A device for implementing a block cipher algorithm, characterized in that: include: An acquisition unit, used for acquiring plaintext data to be encrypted; a processing unit, configured to encrypt the plaintext data to be encrypted using a first block cipher algorithm to obtain ciphertext data, wherein the calculation of a round function in the first block cipher algorithm is implemented using an instruction set, comprising: performing a nonlinear transformation on input data of the nonlinear transformation using the instruction set in a second finite field to obtain a result of the nonlinear transformation, wherein the result of the nonlinear transformation is data in the second finite field, the second finite field is a finite field of the second block cipher algorithm, the second finite field is isomorphic to the first finite field, and the first block cipher algorithm is different from the second block cipher algorithm; the round function includes a nonlinear transformation, and the instruction set includes instructions for solving the nonlinear transformation; An output unit, configured to output the ciphertext data.

14. A device for implementing a block cipher algorithm, characterized in that: include: An acquisition unit, used to acquire ciphertext data to be decrypted; a processing unit, configured to decrypt the decrypted data to be decrypted using a first block cipher algorithm to obtain plaintext data, wherein the calculation of a round function in the first block cipher algorithm is implemented using an instruction set, comprising: performing a nonlinear transformation on input data of the nonlinear transformation using the instruction set in a second finite field to obtain a result of the nonlinear transformation, wherein the result of the nonlinear transformation is data in the second finite field, the second finite field is a finite field of the second block cipher algorithm, the second finite field is isomorphic to the first finite field, and the first block cipher algorithm is different from the second block cipher algorithm; the round function includes a nonlinear transformation, and the instruction set includes instructions for solving the nonlinear transformation; An output unit, configured to output the plaintext data.

15. A storage device, characterized in that: The device stores program instructions executable by a processor to implement the method according to any one of claims 1 to 12.

16. An electronic device, characterized in that: The method comprises a processor, a memory and a communication interface, wherein the memory and the processor are coupled to the communication interface, the memory is used to store computer program code, the computer program code includes computer instructions, and the processor is used to call the computer instructions to implement the method according to any one of claims 1 to 12.

Images