A multi-platform cryptographic algorithm PASSERO implementation method

Abstract

The invention discloses an implementation method of a cryptographic algorithm PASSERO for multiple platforms. PASSERO is an improved algorithm for the ROCCA algorithm structure. When PASSERO is initialized, the lower bound of the number of active S boxes in the first round measured by a MILP solver under a single key setting is 4 more than the lower bound of the number of active S boxes in the fourth round of the ROCCA algorithm, the second round is 35 more than the eighth round of the ROCCA algorithm, and the third round is 53 more than the twelfth round of the ROCCA algorithm. Therefore, even if the PASSERO round function is set to 5 rounds, it can still resist differential attacks well, and the security of resisting differential attacks is higher than that of the ROCCA algorithm; similar to the security analysis of ROCCA, PASSERO can also effectively resist forgery attacks, integral attacks and state recovery attacks. In a resource-constrained environment, the PASSERO algorithm of the present invention uses a fixed-slice AES technology to greatly improve the implementation speed of data encryption and decryption. In a resource-sufficient environment, the PASSERO algorithm of the present invention uses a SIMD instruction part to improve the implementation speed of data encryption and decryption.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method for realizing a cryptographic algorithm PASSERO for multiple platforms. Background Art

[0002] As a mainstream information encryption method, block cipher algorithms are widely used in the field of network and information security and play an important role. Since the Rijndael block cipher was selected as the Advanced Encryption Standard AES, the block cipher algorithm has been widely used in various environments.

[0003] In order to improve the implementation efficiency of the AES algorithm, the efficient AES instruction set AESNI was proposed and mainly used in high-end environments with sufficient software and hardware resources. In recent years, some cryptographic algorithms based on AESNI have been proposed in the international academic community, such as AEGIS, Tixixin-346, ROCCA, etc. These cryptographic algorithms can be efficiently implemented in environments that support AESNI instructions. In the CAES0AR competition, AEGIS was selected into the final combination of high-performance applications; and ROCCA is the first cryptographic algorithm proposed for 6G systems. However, the AESNI instruction set is a special SIMD instruction set with high application cost. It is only suitable for high-end environments with abundant software and hardware resources. It is inefficient or even unusable in resource-constrained environments, which leads to the low efficiency of the above algorithms in restricted environments that do not support AESNI instructions.

[0004] Bit slicing is a method that can efficiently implement cryptographic algorithms in resource-constrained environments. It was originally introduced as an effective method to implement DES block ciphers. Later, bit slicing was applied to the AES cryptographic algorithm, enabling AES to be efficiently implemented in resource-constrained environments. Fixed slicing is a recently proposed improved bit slicing technology. Its principle is to fix the bits in a certain slice of the cryptographic algorithm, and then adjust other slices accordingly to align the bits of the S-box operation, with the aim of reducing the linear layer cost of implementing the cryptographic algorithm with bit slicing. For example, when AES is implemented using fixed slicing technology, first, the bits in one round of AES are fixed, which is equivalent to omitting the row shift operation; secondly, in order to align the bits of the S-box operation, the other slices in one round of AES also need to be fixed; finally, the column confusion operation of four consecutive rounds of AES is adjusted.

[0005] The universality and efficient implementation of cryptographic algorithms on different platforms have always been the focus of cryptographic engineering. In order to improve the universality of the ROCCA algorithm on different platforms and obtain efficient implementation, the present invention improves the ROCCA algorithm structure based on the fixed-slice AES idea, and proposes an implementation method of the cryptographic algorithm PASSERO for multiple platforms, which can not only be efficiently implemented based on fixed slices in a resource-constrained environment, but also can be efficiently implemented using the AESNI and XOR instructions of the SIMD instruction set to implement the PASSERO algorithm in an environment with sufficient software and hardware resources. Summary of the invention

[0006] The purpose of the present invention is to provide an implementation method of a multi-platform cryptographic algorithm PASSERO, which is an improved algorithm of the ROCCA algorithm structure. It can not only be efficiently implemented based on fixed slices in a resource-constrained environment, but also can be efficiently implemented using the AESNI instruction set in an environment with sufficient software and hardware resources.

[0007] The technical solution for achieving the purpose of the present invention is:

[0008] A method for implementing a multi-platform cryptographic algorithm PASSERO comprises the following steps:

[0009] (1) PASSERO algorithm round function design

[0010] The overall structure of the PASSERO round function is similar to that of the ROCCA round function. However, based on the fixed-slice AES implementation concept, the PASSERO round function uses the AES four-round iteration component. The permutation operation in the ROCCA round function structure is replaced to achieve a better diffusion obfuscation effect.

[0011] (2) PASSERO algorithm structure design

[0012] The overall structure of the PASSERO algorithm is the same as that of the ROCCA algorithm, including four parts: initialization, processing associated data, encrypting plaintext, and generating a flag. However, based on the round function structure, PASSERO reduces the number of ROCCA round function iterations from 20 to 5 in the initialization part. In the associated data processing part, PASSERO sets the associated data to 256 bits. In the plaintext encryption part, the ciphertext is obtained by AES(STA[3],STA[6])⊕A(M) and AES(STA[2]⊕STA[4],STA[0])⊕A(M). In the flag generation part, the number of round function iterations is reduced from 20 in ROCCA to 5.

[0013] (3) Implementation method based on fixed slices in resource-constrained environments

[0014] Determine the input and output variables and implementation modules according to the PASSERO algorithm structure, and implement PASSERO using fixed-slice AES technology;

[0015] (4) Efficient implementation methods in an environment with sufficient resources

[0016] According to the PASSERO algorithm structure, the input and output variables and implementation modules are determined, and the AESNI instruction and XOR instruction of the SIMD instruction set are further used to implement PASSERO.

[0017] Furthermore, the PASSERO algorithm round function design described in step (1) includes the following specific steps:

[0018] (1.1) The overall structure of the PASSERO round function is similar to that of the ROCCA round function. The input and output are both 8×128 bits. First, a new permutation operation is designed for the 8×128-bit input state to disrupt the order of the input state. Second, through component expansion, 4 AES four-round iteration components and 4 XOR components are used to operate the permuted state to obtain the output state.

[0019] The idea of ​​fixed-slice AES is: first, the bits in a fixed AES round remain unchanged, which is equivalent to omitting the row shift operation; second, in order to align the bits of the S-box operation, the other slices in an AES round need to be fixed; finally, the column confusion operation of four consecutive rounds of AES needs to be adjusted; therefore, in order to use fixed slices to implement the algorithm efficiently, the PASSERRO round function uses the components of the four-round iteration of AES;

[0020] (1.2) Replace the permutation operation in the ROCCA round function structure to achieve a better diffusion obfuscation effect. The permutation operation is: first, exhaustively search for new permutations by randomly shuffling the 8×128-bit input state, then use the MILP solver to measure the lower bound of the active S-box of the new permutation, and then compare it with the lower bound of the active S-box of the permutation in the ROCCA round function structure. If the lower bound of the active S-box of the new permutation is higher than the lower bound of the active S-box of the permutation in the ROCCA round function, then select this new permutation, otherwise continue to exhaustively search for new permutations until a permutation with a better diffusion obfuscation effect is selected. The new permutations are shown in Table 1.

[0021] (1.3) Based on the transformation components and permutations, the PASSERO round function structure is described as follows: The round function R is transformed from input to output using R(STA,x0,x1)→STA newIn brief, STA represents the state of the PASSERO algorithm. STA consists of 8 parts: STA = (STA[0], STA[1], ... STA[7]), each part is 128 bits in size; x0, x1 are 128-bit constant values; AES(X, Y) 4 Represents four rounds of AES iterations, i.e. AES(X,Y) 4 =AES(AES(AES(AES(X,Y),Y),Y),Y), where ShiftRow and SubBytes are the same operations as in the AES algorithm; new Indicates the updated state, i.e. STA new =(STA new [0],STA new [1],...STA new [7]);

[0022] The specific round function structure of PASSERO is expressed by the calculation method shown in Table 1:

[0023] Table 1 Description of PASSERO round function R

[0024]

[0025] (1.5) Considering that the algorithm input plaintext is very long, a round encryption state bit R_ENC is set. When it is 0, the round function R is set to calculate STA new [1] STA new [3] STA new [5] and STA new [6], the AES operation is iterated only once to reduce computational complexity; when it is 1, the calculation method of the round function R described in (1.3) is adopted.

[0026] Furthermore, the PASSERO algorithm structure design described in step (2) has the same overall structure as the ROCCA algorithm, which includes four parts: initialization, processing associated data, encrypting plaintext, and generating flags. The specific steps are as follows:

[0027] (2.1) In the initialization part, based on the round function structure, the lower bound of the active S-box in the initialization part is tested by the MILP solver, and then compared with the lower bound test of the active S-box in the initialization part of the ROCCA algorithm, it is determined that PASSERO reduces the number of ROCCA round function iterations from 20 to 5 in the initialization part;

[0028] (2.2) In the part of processing associated data, PASSERO sets the associated data to 256 bits, that is, only one round function R is needed to obtain a new state;

[0029] (2.3) In the encrypted plaintext part, by and The encryption is completed in the manner of obtaining the ciphertext, where M indicates the ciphertext, and the A(M) operation refers to Mix Columns ο Shift Rows ο Sub Bytes (M), and Mix Columns, Shift Row, and Sub Bytes are the same operations as those in the AES algorithm;

[0030] (2.4) In the generation of the flag part, the number of iteration rounds of the function is reduced from 20 to 5 by the test method (2.1). Furthermore, the implementation method based on fixed slices in a resource-constrained environment described in step (3) is specifically as follows:

[0031] (3.1) Input a 128-bit random number N and a 256-bit key K, where the 256-bit key K is divided into a high 128-bit key K0 and a low 128-bit key K1; set z0 and z1 to z0 = 428a2f98d728ae227137449123, z1 = b5c0fbcfec4d3b2fe9b5dba58189dbbc; initialize the state STA, set STA[0] = K1, STA[1] = N, STA[2] = z1, STA[3] = z0, STA[5]=0, STA[6]=K0, STA[7]=0;

[0032] (3.2) Set the round encryption status bit R_ENC to 1. According to the STA and z0 and z1 obtained in (3.1), iterate the round function R(STA,z0,z1) for 5 rounds to obtain the new STA new , where the implementation of the four AES components of the round function R uses the fixed slice AES technology, that is, one fixed slice AES operation can operate two AES components in parallel, so that only two fixed slice AES operations need to be called in the implementation of the four AES components of the round function R;

[0033] (3.3) Input 256-bit associated data AD, where AD is divided into high 128 bits AD0 and low 128 bits AD1;

[0034] (3.4) If the input AD is not empty, according to the obtained STA new And AD0, AD1, round function R (STA new ,AD0,AD1) iterates 1 round to further obtain the new state STAnew , go to (3.5); if input AD is empty, go to (3.5);

[0035] (3.5) Set the round encryption state bit R_ENC to 0, input the plaintext M, the bit length size of M, and the state STA new , set the length of ciphertext C to be the same as the plaintext length, and the ciphertext is initially empty, and calculate the ciphertext C through the following operations;

[0036] (3.5.1) First calculate the number of iterations d = size / 256, then divide the plaintext M into 256-bit units according to the number of iterations d, and in each iteration process, the 256-bit plaintext is further divided into the high 128 bits M i,0 and the lower 128 bits M i,1 , that is, M=M 0,0 ||M 0,1 ||M 1,0 ||M 1,1 ||...M i,0 ||M i,1 ...M d-1,0 ||M d-1,1 (0≤i≤d-1); Divide the ciphertext C in the same way, then C=C 0,0 ||C 0,1 ||C 1,0 ||C 1,1 ||...C i,0 ||C i,1 ...C d-1,0 ||C d-1,1 (0≤i≤d-1);

[0037] (3.5.2) In each iteration, C i,0 The calculation method is C i,1 The calculation method is

[0038] (3.5.3) According to STA new And the input M i,0 、M i,1 , call the round function R(STA new ,M i,0 ,M i,1 )Get the new status STA new ;

[0039] (3.5.4)d=d-1;

[0040] (3.5.5) If d is not 0, go to (3.5.2) to continue the iteration; otherwise, end the iteration calculation and go to (3.6);

[0041] (3.6) Through link C 0,0 ||C 0,1 ||C 1,0 ||C 1,1 ||...C i,0 ||C i,1 ...C size / 256-1,0 ||C size / 256-1,1 (0≤i≤size / 256-1) get the complete ciphertext C;

[0042] (3.7) Set the round encryption status bit R_ENC to 1, according to STA new And size / 256, for round function R(STA new ,1,size / 256) Iterate 5 rounds to get the new state STA new ;

[0043] (3.8) According to the updated STA new ,pass Generate a 128-bit flag T;

[0044] (3.9) Complete encryption;

[0045] In this environment, the decryption process is exactly the same as the encryption process, except that the input parameter of the encryption part is changed from plaintext M to ciphertext C.

[0046] Furthermore, the efficient implementation method described in step (4) in an environment with sufficient resources comprises the following specific steps:

[0047] (4.1) Input a 128-bit random number N and a 256-bit key K, where the 256-bit key K is divided into a high 128-bit key K0 and a low 128-bit key K1; set z0 and z1 to z0 = 428a2f98d728ae227137449123 and z1 = b5c0fbcfec4d3b2fe9b5dba58189dbbc respectively; initialize the state STA, and set STA [0] = K1, STA[1] = N, STA[2] = z1, STA[3] = z0, STA[4] = N⊕K1, STA[5] = 0, STA[6] = K0, STA[7] = 0; wherein the XOR operation ⊕ is implemented by calling the _mm_xor_si128 instruction of the SIMD instruction set, and the division of the high 128 bits K0 and the low 128 bits K1 is obtained by calling the _mm_loadu_si128 instruction;

[0048] (4.2) Set the round encryption state bit R_ENC to 1. According to STA and z0, z1 obtained from (4.1), iterate the round function R(STA,z0,z1) for 5 rounds to obtain the new state STAnew , where the XOR operation ⊕ in the round function R is implemented by calling the _mm_xor_si128 instruction, and the AES operation is implemented by calling the _mm_aesenc_si128 instruction;

[0049] (4.3) Input 256-bit associated data AD, where AD is divided into upper 128 bits AD0 and lower 128 bits AD1;

[0050] (4.4) If the input AD is not empty, according to the obtained STA new And AD0, AD1, round function R (STA new ,AD0,AD1) iterate 1 round to get the new state STA new , go to (4.5); if input AD is empty, go to (4.5);

[0051] (4.5) Set the round encryption state bit R_ENC to 0, input the plaintext M, the bit length size of M, and the state STA new , set the length of ciphertext C to be the same as the plaintext length, and the ciphertext is initially empty, and calculate the ciphertext C through the following operations:

[0052] (4.5.1) First calculate the number of iterations d = size / 256, then divide the plaintext M into 256-bit units according to the number of iterations d, and in each iteration process, the 256-bit plaintext is further divided into the high 128 bits M i,0 and the lower 128 bits M i,1 , that is, M=M 0,0 ||M 0,1 ||M 1,0 ||M 1,1 ||...M i,0 ||M i,1 ...M d-1,0 ||M d-1,1 (0≤i≤d-1); Divide the ciphertext C in the same way, C=C 0,0 ||C 0,1 ||C 1,0 ||C 1,1 ||...C i,0 ||C i,1 ...C d-1,0 ||C d-1,1 (0≤i≤d-1); the high 128 bits M i,0 and the lower 128 bits M i,1 The division is achieved by calling the _mm_loadu_si128 instruction;

[0053] (4.5.2) In each iteration, the high 128-bit ciphertext C i,0 The calculation method is It does this by calling _mm_aesenc_si128(M i,0 ,_mm_aesenc_si128(STA[3],STA[6])) implementation; low 128-bit ciphertext C i,1 The calculation method is It does this by calling _mm_aesenc_si128(M i,1 ,_mm_aesenc_si128(_mm_xor_si128(STA[2],STA[4]),STA[0]));

[0054] (4.5.3) According to STA new And the input M i,0 、M i,1 , call the round function R(STA new ,M i,0 ,M i,1 )Get the new status STA new ;

[0055] (4.5.4)d=d-1;

[0056] (4.5.5) If d is not 0, go to (4.5.2) to continue the iteration; otherwise, end the iteration calculation and go to (4.6);

[0057] (4.6) Through link C 0,0 ||C 0,1 ||C 1,0 ||C 1,1 ||...C i,0 ||C i,1 ...C size / 256-1,0 ||C size / 256-1,1 (0≤i≤size / 256-1) to get the complete ciphertext C. The linking operation is implemented by calling the _mm_loadu_si128 instruction;

[0058] (4.7) Set the round encryption status bit R_ENC to 1, according to STA new And size / 256, for round function R(STA new ,1,size / 256) Iterate 5 rounds to get a new STA new ;

[0059] (4.8) According to the updated STA new ,pass Generate a 128-bit flag T, which is obtained by calling 7 times the _mm_xor_si128 instruction;

[0060] (4.9) Complete encryption;

[0061] In this environment, the decryption process is exactly the same as the encryption process, except that the input parameter of the encryption part is changed from plaintext M to ciphertext C.

[0062] The beneficial effects of the present invention are:

[0063] (1) Based on the ROCCA algorithm design concept and the fixed-slice AES technology, the present invention designs an implementation method of a multi-platform cryptographic algorithm PASSERO. The algorithm has strong versatility and can be efficiently implemented on different platforms and environments.

[0064] (2) The multi-platform cryptographic algorithm PASSERO provided by the present invention has certain security. When PASSERO is initialized, the lower bound of the number of active S-boxes in the first round measured by the MILP solver under a single key setting is 4 more than the lower bound of the number of active S-boxes in the fourth round of the ROCCA algorithm, the second round is 35 more than the eighth round of the ROCCA algorithm, and the third round is 53 more than the twelfth round of the ROCCA algorithm. Therefore, even if the round function of PASSERO is set to 5 rounds, it can still resist differential attacks well, and its security against differential attacks is higher than that of the ROCCA algorithm; similar to the security analysis of ROCCA, PASSERO can also effectively resist forgery attacks, integral attacks and state recovery attacks.

[0065] (3) In a resource-constrained environment, the PASSERO algorithm described in the present invention uses fixed-slice AES technology to greatly improve the implementation speed of data encryption and decryption.

[0066] (4) In an environment with sufficient resources, the PASSERO algorithm described in the present invention uses SIMD instructions to partially improve the implementation speed of data encryption and decryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] Figure 1 It is a structure diagram of round function R of the cryptographic algorithm PASSERO for multiple platforms of the present invention;

[0068] Figure 2 The encryption structure diagram of the multi-platform cryptographic algorithm PASSERO of the present invention;

[0069] Figure 3 This is a decryption structure diagram of the multi-platform cryptographic algorithm PASSERO of the present invention;

[0070] Figure 4 The speed comparison chart of encryption and authenticated encryption of PASSERO and ROCCA in a resource-constrained environment;

[0071] Figure 5 This is a comparison chart of the encryption speed of PASSERO, ROCCA, and AEGIS in an environment with sufficient resources;

[0072] Figure 6 The figure is a comparison of the authenticated encryption speed of PASSERO, ROCCA and AEGIS in an environment with sufficient resources. DETAILED DESCRIPTION

[0073] The present invention is further described in detail below with reference to the accompanying drawings and embodiments, but the present invention is not limited thereto.

[0074] Example

[0075] A method for implementing a cryptographic algorithm PASSERO for multiple platforms includes the following steps:

[0076] (1) Design of the round function of the PASSERO algorithm. Its structure is similar to that of ROCCA. However, based on the fixed-slice AES implementation concept, the PASSERO round function uses the AES four-round iteration component. In order to achieve a better diffusion obfuscation effect, the permutation operation in the ROCCA round function structure is changed. The specific steps are as follows:

[0077] (1.1) The overall structure of the PASSERO round function is similar to that of the ROCCA round function. The input and output are both 8×128 bits. First, a new permutation operation is designed for the 8×128-bit input state to disrupt the order of the input state. Second, through component expansion, 4 AES four-round iteration components and 4 XOR components are used to operate the permuted state to obtain the output state.

[0078] (1.2) Replace the permutation operation in the ROCCA round function structure. First, exhaustively search for new permutations by randomly shuffling the 8×128-bit input state. Then, use the MILP solver to measure the lower bound of the active S-box of the new permutation. Then, compare it with the lower bound of the active S-box of the permutation in the ROCCA round function structure. If the lower bound of the active S-box of the new permutation is higher than the lower bound of the active S-box of the permutation in the ROCCA round function, then select this new permutation. Otherwise, continue to exhaustively search for new permutations until a permutation with better diffusion confusion effect is selected. The new permutations are shown in Table 1.

[0079] (1.3) Based on transformation components and permutations, refer to Figure 1 , the PASSERO round function structure is described as follows: the round function R is used from input to output R(STA,x0,x1)→STA new In brief, STA represents the state of the PASSERO algorithm. STA consists of 8 parts: STA = (STA[0], STA[1], ... STA[7]), each part is 128 bits in size; x0, x1 are 128-bit constant values; AES(X, Y) 4Represents four rounds of AES iterations, i.e. AES(X,Y) 4 =AES(AES(AES(AES(X,Y),Y),Y),Y), where ShiftRow and SubBytes are the same operations as in the AES algorithm; new Indicates the updated state, i.e. STA new =(STA new [0],STA new [1],...STA new [7]);

[0080] The specific round function structure of PASSERO is expressed by the calculation method shown in Table 1:

[0081] Table 1 Description of PASSERO round function R

[0082]

[0083] (1.4) Considering that the algorithm input plaintext is very long, a round encryption state bit R_ENC is set. When it is 0, the round function R is set to calculate STA new [1] STA new [3] STA new [5] and STA new [6], the AES operation is iterated only once to reduce computational complexity; when it is 1, the calculation method of the round function R described in (1.3) is adopted.

[0084] (2) PASSERO algorithm structure design. The overall structure of the PASSERO algorithm is the same as the ROCCA algorithm structure, including initialization, processing associated data, encrypting plaintext, and generating flags. The specific steps are as follows:

[0085] (2.1) In the initialization part, based on the round function structure, the lower bound of the active S-box in the initialization part is tested by the MILP solver, and then compared with the lower bound test of the active S-box in the initialization part of the ROCCA algorithm, it is determined that PASSERO reduces the number of ROCCA round function iterations from 20 to 5 in the initialization part;

[0086] (2.2) In processing the associated data, PASSERO sets the associated data to 256 bits, which means that only one round function R is needed to obtain a new state;

[0087] (2.3) In the encrypted plaintext part, by and The encryption is completed in the manner of obtaining the ciphertext, where M indicates the ciphertext, and the A(M) operation refers to Mix Columns ο Shift Rows ο Sub Bytes (M), and Mix Columns, Shift Row, and Sub Bytes are the same operations as those in the AES algorithm;

[0088] (2.4) In the generation of the mark part, the number of iteration rounds of the function is reduced from 20 to 5 through the test method (2.1).

[0089] (3) Implementation method based on fixed slices in resource-constrained environment, refer to Figure 2-3 , the specific steps are as follows:

[0090] (3.1) Input a 128-bit random number N and a 256-bit key K, where the 256-bit key K is divided into a high 128-bit key K0 and a low 128-bit key K1; set z0 and z1 to z0 = 428a2f98d728ae227137449123, z1 = b5c0fbcfec4d3b2fe9b5dba58189dbbc; initialize the state STA, set STA[0] = K1, STA[1] = N, STA[2] = z1, STA[3] = z0, STA[5]=0, STA[6]=K0, STA[7]=0;

[0091] (3.2) Set the round encryption status bit R_ENC to 1. According to the STA and z0 and z1 obtained in (3.1), iterate the round function R(STA,z0,z1) for 5 rounds to obtain the new STA new , where the implementation of the four AES components of the round function R uses the fixed slice AES technology, that is, one fixed slice AES operation can operate two AES components in parallel, so that only two fixed slice AES operations need to be called in the implementation of the four AES components of the round function R;

[0092] (3.3) Input 256-bit associated data AD, where AD is divided into high 128 bits AD0 and low 128 bits AD1;

[0093] (3.4) If the input AD is not empty, according to the obtained STA new And AD0, AD1, round function R (STA new ,AD0,AD1) iterates 1 round to further obtain the new state STA new , go to (3.5); if input AD is empty, go to (3.5);

[0094] (3.5) Set the round encryption state bit R_ENC to 0, input the plaintext M, the bit length size of M, and the state STAnew , set the length of ciphertext C to be the same as the plaintext length, and the ciphertext is initially empty, and calculate the ciphertext C through the following operations;

[0095] (3.5.1) First calculate the number of iterations d = size / 256, then divide the plaintext M into 256-bit units according to the number of iterations d, and in each iteration process, the 256-bit plaintext is further divided into the high 128 bits M i,0 and the lower 128 bits M i,1 , that is, M=M 0,0 ||M 0,1 ||M 1,0 ||M 1,1 ||...M i,0 ||M i,1 ...M d-1,0 ||M d-1,1 (0≤i≤d-1); Divide the ciphertext C in the same way, then C=C 0,0 ||C 0,1 ||C 1,0 ||C 1,1 ||...C i,0 ||C i,1 ...C d-1,0 ||C d-1,1 (0≤i≤d-1);

[0096] (3.5.2) In each iteration, C i,0 The calculation method is C i,1 The calculation method is

[0097] (3.5.3) According to STA new And the input M i,0 、M i,1 , call the round function R(STA new ,M i,0 ,M i,1 )Get the new status STA new ;

[0098] (3.5.4)d=d-1;

[0099] (3.5.5) If d is not 0, go to (3.5.2) to continue the iteration; otherwise, end the iteration calculation and go to (3.6);

[0100] (3.6) Through link C 0,0 ||C 0,1 ||C 1,0 ||C 1,1 ||...C i,0 ||C i,1 ...Csize / 256-1,0 ||C size / 256-1,1 (0≤i≤size / 256-1) get the complete ciphertext C;

[0101] (3.7) Set the round encryption status bit R_ENC to 1, according to STA new And size / 256, for round function R(STA new ,1,size / 256) Iterate 5 rounds to get the new state STA new ;

[0102] (3.8) According to the updated STA new ,pass Generate a 128-bit flag T;

[0103] (3.9) Complete encryption;

[0104] In this environment, the decryption process is exactly the same as the encryption process, except that the plaintext M input in the encrypted part is converted into the ciphertext C.

[0105] In a resource-constrained environment, the PASSERO algorithm described in the present invention uses fixed-slice AES technology to greatly improve the speed of data encryption and decryption. Figure 4 As shown in the figure, under the same conditions, the encryption speed of the PASSERO algorithm is about 107.84% faster than that of the ROCCA algorithm, and its authenticated encryption speed is about 164.80% faster.

[0106] (4) An efficient implementation method in an environment with sufficient resources. The specific steps are as follows:

[0107] (4.1) Input a 128-bit random number N and a 256-bit key K, where the 256-bit key K is divided into a high 128-bit key K0 and a low 128-bit key K1; set z0 and z1 to z0 = 428a2f98d728ae227137449123 and z1 = b5c0fbcfec4d3b2fe9b5dba58189dbbc respectively; initialize the state STA, and set STA [0] = K1, STA[1] = N, STA[2] = z1, STA[3] = z0, STA[4] = N⊕K1, STA[5] = 0, STA[6] = K0, STA[7] = 0; wherein the XOR operation ⊕ is implemented by calling the _mm_xor_si128 instruction of the SIMD instruction set, and the division of the high 128 bits K0 and the low 128 bits K1 is obtained by calling the _mm_loadu_si128 instruction;

[0108] (4.2) Set the round encryption state bit R_ENC to 1. According to STA and z0, z1 obtained from (4.1), iterate the round function R(STA,z0,z1) for 5 rounds to obtain the new state STA new , where the XOR operation ⊕ in the round function R is implemented by calling the _mm_xor_si128 instruction, and the AES operation is implemented by calling the _mm_aesenc_si128 instruction;

[0109] (4.3) Input 256-bit associated data AD, where AD is divided into upper 128 bits AD0 and lower 128 bits AD1;

[0110] (4.4) If the input AD is not empty, according to the obtained STA new And AD0, AD1, round function R (STA new ,AD0,AD1) iterate 1 round to get the new state STA new , go to (4.5); if input AD is empty, go to (4.5);

[0111] (4.5) Set the round encryption state bit R_ENC to 0, input the plaintext M, the bit length size of M, and the state STA new , set the length of ciphertext C to be the same as the plaintext length, and the ciphertext is initially empty, and calculate the ciphertext C through the following operations:

[0112] (4.5.1) First calculate the number of iterations d = size / 256, then divide the plaintext M into 256-bit units according to the number of iterations d, and in each iteration process, the 256-bit plaintext is further divided into the high 128 bits M i,0 and the lower 128 bits M i,1 , that is, M=M 0,0 ||M 0,1 ||M 1,0 ||M 1,1 ||...M i,0 ||M i,1 ...M d-1,0 ||M d-1,1 (0≤i≤d-1); Divide the ciphertext C in the same way, C=C 0,0 ||C 0,1 ||C 1,0 ||C 1,1 ||...C i,0 ||C i,1 ...C d-1,0 ||C d-1,1 (0≤i≤d-1); the high 128 bits M i,0 and the lower 128 bits M i,1The division is achieved by calling the _mm_loadu_si128 instruction;

[0113] (4.5.2) In each iteration, the high 128-bit ciphertext C i,0 The calculation method is AES(STA[3],STA[6])⊕A(M i,0 ), which calls _mm_aesenc_si128(M i,0 ,_mm_aesenc_si128(STA[3],STA[6])) implementation; low 128-bit ciphertext C i,1 The calculation method is It does this by calling _mm_aesenc_si128(M i,1 ,_mm_aesenc_si128(_mm_xor_si128(STA[2],STA[4]),STA[0]));

[0114] (4.5.3) According to STA new And the input M i,0 、M i,1 , call the round function R(STA new ,M i,0 ,M i,1 )Get the new status STA new ;

[0115] (4.5.4)d=d-1;

[0116] (4.5.5) If d is not 0, go to (4.5.2) to continue the iteration; otherwise, end the iteration calculation and go to (4.6);

[0117] (4.6) Through link C 0,0 ||C 0,1 ||C 1,0 ||C 1,1 ||...C i,0 ||C i,1 ...C size / 256-1,0 ||C size / 256-1,1 (0≤i≤size / 256-1) to get the complete ciphertext C. The linking operation is implemented by calling the _mm_loadu_si128 instruction;

[0118] (4.7) Set the round encryption status bit R_ENC to 1, according to STA new And size / 256, for round function R(STA new ,1,size / 256) Iterate 5 rounds to get a new STA new ;

[0119] (4.8) According to the updated STA new ,pass Generate a 128-bit flag T, which is obtained by calling 7 times the _mm_xor_si128 instruction;

[0120] (4.9) Complete encryption;

[0121] In this environment, the decryption process is exactly the same as the encryption process, except that the plaintext M input in the encrypted part is converted into the ciphertext C.

[0122] In an environment with sufficient resources, the PASSERO algorithm described in the present invention uses SIMD instructions to partially improve the speed of data encryption and decryption, such as Figure 5 As shown in Figure 2, under the same conditions, the encryption speed of the PASSERO algorithm is about 138.27% faster than that of the AEGIS-256 algorithm, and is slightly faster than that of the ROCCA algorithm, about 0.61%. Figure 6 As shown in the figure, the authenticated encryption speed of the PASSERO algorithm is increased by about 38.10% compared with the AEGIS-256 algorithm, and the authenticated encryption speed of the ROCCA algorithm is increased by about 51.47%.

Claims

1. A method for implementing a multi-platform cryptographic algorithm PASSERO, characterized in that: The steps include: (1) PASSERO algorithm round function design The overall structure of the PASSERO round function is similar to that of the ROCCA round function. However, based on the fixed-slice AES implementation concept, the PASSERO round function uses the AES four-round iteration component. The permutation operation in the ROCCA round function structure is replaced to achieve a better diffusion obfuscation effect. (2) PASSERO algorithm structure design The overall structure of the PASSERO algorithm is the same as that of the ROCCA algorithm, including initialization, processing associated data, encrypting plaintext, and generating flags. However, based on the round function structure, PASSERO reduces the number of ROCCA round function iterations from 20 to 5 in the initialization part; in the processing of associated data, PASSERO sets the associated data to 256 bits; in the encryption of plaintext, and In the part of generating the sign, the number of iterative round functions is reduced from 20 rounds of ROCCA to 5 rounds. (3) Implementation method based on fixed slices in resource-constrained environments Determine the input and output variables and implementation modules according to the PASSERO algorithm structure, and implement PASSERO using fixed-slice AES technology; (4) Efficient implementation methods in an environment with sufficient resources According to the PASSERO algorithm structure, input and output variables and implementation modules are determined, and the AESNI and XOR instructions of the SIMD instruction set are further used to implement PASSERO. The PASSERO algorithm round function design described in step (1) is specifically designed as follows: (1.1) The overall structure of the PASSERO round function is similar to that of the ROCCA round function. The input and output are both 8×128 bits. First, a new permutation operation is designed for the 8×128-bit input state to disrupt the order of the input state. Second, through component expansion, 4 AES four-round iteration components and 4 XOR components are used to operate the permuted state to obtain the output state. (1.2) Replace the permutation operation in the ROCCA round function structure. First, exhaustively search for new permutations by randomly shuffling the 8×128-bit input state. Then, use the MILP solver to measure the lower bound of the active S-box of the new permutation. Then, compare it with the lower bound of the active S-box of the permutation in the ROCCA round function structure. If the lower bound of the active S-box of the new permutation is higher than the lower bound of the active S-box of the permutation in the ROCCA round function, then select this new permutation. Otherwise, continue to exhaustively search for new permutations until a permutation with better diffusion confusion effect is selected. The new permutations are shown in Table 1. (1.3) Based on the transformation components and permutations, the PASSERO round function structure is described as follows: The round function R is transformed from input to output using R(STA,x0,x1)→STA new In brief, STA represents the state of the PASSERO algorithm. STA consists of 8 parts: STA = (STA[0], STA[1], ... STA[7]), each part is 128 bits in size; x0, x1 are 128-bit constant values; AES(X, Y) 4 Represents four rounds of AES iterations, i.e. AES(X,Y) 4 =AES(AES(AES(AES(X,Y),Y),Y),Y), where MixColumns, ShiftRow, and SubBytes are the same operations as in the AES algorithm; new Indicates the updated state, i.e. STA new =(STA new [0],STA new [1],...STA new [7]); The specific round function structure of PASSERO is expressed by the calculation method shown in Table 1: Table 1 PASSERO round function R description (1.4) Considering that the algorithm input plaintext is very long, a round encryption state bit R_ENC is set. When it is 0, the round function R is set to calculate STA new [1] STA new [3] STA new [5] and STA new [6] The AES operation is only iterated once to reduce the computational complexity; When it is 1, the calculation method of the round function R described in (1.3) is adopted.

2. The method for implementing the cryptographic algorithm PASSERO according to claim 1, characterized in that: The PASSERO algorithm structure design described in step (2) is specifically designed as follows: (2.1) In the initialization part, based on the round function structure, the lower bound of the active S-box in the initialization part is tested by the MILP solver, and then compared with the lower bound test of the active S-box in the initialization part of the ROCCA algorithm, it is determined that PASSERO reduces the number of ROCCA round function iterations from 20 to 5 in the initialization part; (2.2) In the part of processing associated data, PASSERO sets the associated data to 256 bits, that is, only one round function R is needed to obtain a new state; (2.3) In the encrypted plaintext part, by The encryption is completed in the way of obtaining the ciphertext, where M indicates the ciphertext, and the A(M) operation refers to MixColumns, ShiftRow, and SubBytes are the same operations as in the AES algorithm; (2.4) In the generation of the mark part, the number of iteration rounds of the function is reduced from 20 to 5 through the test method (2.1).

3. The method for implementing the cryptographic algorithm PASSERO according to claim 1, characterized in that: The implementation method based on fixed slices in a resource-constrained environment described in step (3) is specifically as follows: (3.1) Input a 128-bit random number N and a 256-bit key K, where the 256-bit key K is divided into a high 128-bit key K0 and a low 128-bit key K1; set z0 and z1 to z0=428a2f98d728ae227137449123 and z1=b5c0fbcfec4d3b2fe9b5dba58189dbbc respectively; Initialize the state STA, set STA[0] = K1, STA[1] = N, STA[2] = z1, STA[3] = z0, STA[5]=0, STA[6]=K0, STA[7]=0; (3.2) Set the round encryption status bit R_ENC to 1. According to the STA and z0 and z1 obtained in (3.1), iterate the round function R(STA,z0,z1) for 5 rounds to obtain the new STA new , where the implementation of the four AES components of the round function R uses the fixed slice AES technology, that is, one fixed slice AES operation operates two AES components in parallel, so that only two fixed slice AES operations need to be called in the implementation of the four AES components of the round function R; (3.3) Input 256-bit associated data AD, where AD is divided into high 128 bits AD0 and low 128 bits AD1; (3.4) If the input AD is not empty, according to the obtained STA new And AD0, AD1, round function R (STA new ,AD0,AD1) iterates 1 round to further obtain the new state STA new , go to (3.5); if input AD is empty, go to (3.5); (3.5) Set the round encryption state bit R_ENC to 0, input the plaintext M, the bit length size of M, and the state STA new , set the length of ciphertext C to be the same as the plaintext length, and the ciphertext is initially empty, and calculate the ciphertext C through the following operations; (3.5.1) First calculate the number of iterations d = size / 256, then divide the plaintext M into 256-bit units according to the number of iterations d, and in each iteration process, the 256-bit plaintext is further divided into the high 128 bits M i,0 and the lower 128 bits M i,1 , that is, M=M 0,0 ||M 0,1 ||M 1,0 ||M 1,1 ||...M i,0 ||M i,1 ...M d-1,0 ||M d-1,1， 0≤i≤d-1; Divide the ciphertext C in the same way, then C=C 0,0 ||C 0,1 ||C 1,0 ||C 1,1 ||...C i,0 ||C i,1 ...C d-1,0 ||C d-1,1 , 0≤i≤d-1; (3.5.2) In each iteration, C i,0 The calculation method is C i,1 The calculation method is (3.5.3) According to STA new And the input M i,0 、M i,1 , call the round function R(STA new ,M i,0 ,M i,1 )Get the new status STA new ; (3.5.4)d=d-1; (3.5.5) If d is not 0, go to (3.5.2) to continue the iteration; otherwise, end the iteration calculation and go to (3.6); (3.6) Through link C 0,0 ||C 0,1 ||C 1,0 ||C 1,1 ||...C i,0 ||C i,1 ...C size / 256-1,0 ||C size / 256-1,1 , 0≤i≤size / 256-1, and get the complete ciphertext C; (3.7) Set the round encryption status bit R_ENC to 1, according to STA new And size / 256, for round function R(STA new ,1,size / 256) Iterate 5 rounds to get the new state STA new ; (3.8) According to the updated STA new ,pass Generate a 128-bit flag T; (3.9) Complete encryption; In this resource-constrained environment, the decryption process is exactly the same as the encryption process, and only the plaintext M of the encrypted input is converted into the ciphertext C.

4. The method for implementing the cryptographic algorithm PASSERO according to claim 1, characterized in that: The efficient implementation method described in step (4) in an environment with sufficient resources comprises the following specific steps: (4.1) Input a 128-bit random number N and a 256-bit key K, where the 256-bit key K is divided into a high 128-bit key K0 and a low 128-bit key K1; set z0 and z1 to z0=428a2f98d728ae227137449123 and z1=b5c0fbcfec4d3b2fe9b5dba58189dbbc respectively; Initialize the state STA, set STA[0] = K1, STA[1] = N, STA[2] = z1, STA[3] = z0, STA[5]=0,STA[6]=K0,STA[7]=0;where XOR operation This is achieved by calling the _mm_xor_si128 instruction of the SIMD instruction set, and the division of the upper 128 bits K0 and the lower 128 bits K1 is obtained by calling the _mm_loadu_si128 instruction; (4.2) Set the round encryption state bit R_ENC to 1. According to STA and z0, z1 obtained from (4.1), iterate the round function R(STA,z0,z1) for 5 rounds to obtain the new state STA new , where the XOR operation in the round function R It is implemented by calling the _mm_xor_si128 instruction, and the AES operation is implemented by calling the _mm_aesenc_si128 instruction; (4.3) Input 256-bit associated data AD, where AD is divided into upper 128 bits AD0 and lower 128 bits AD1; (4.4) If the input AD is not empty, according to the obtained STA new And AD0, AD1, round function R (STA new ,AD0,AD1) iterate 1 round to get the new state STA new , go to (4.5); if input AD is empty, go to (4.5); (4.5) Set the round encryption state bit R_ENC to 0, input the plaintext M, the bit length size of M, and the state STA new , set the length of ciphertext C to be the same as the plaintext length, and the ciphertext is initially empty, and calculate the ciphertext C through the following operations: (4.5.1) First calculate the number of iterations d = size / 256, then divide the plaintext M into 256-bit units according to the number of iterations d, and in each iteration process, the 256-bit plaintext is further divided into the high 128 bits M i,0 and the lower 128 bits M i,1 , that is, M=M 0,0 ||M 0,1 ||M 1,0 ||M 1,1 ||...M i,0 ||M i,1 ...M d-1,0 ||M d-1,1 , 0≤i≤d-1; divide the ciphertext C in the same way, C=C 0,0 ||C 0,1 ||C 1,0 ||C 1,1 ||...C i,0 ||C i,1 ...C d-1,0 ||C d-1,1 , 0≤i≤d-1; the high 128 bits M i,0 and the lower 128 bits M i,1 The division is achieved by calling the _mm_loadu_si128 instruction; (4.5.2) In each iteration, the high 128-bit ciphertext C i,0 The calculation method is It does this by calling _mm_aesenc_si128(M i,0 ,_mm_aesenc_si128(STA[3],STA[6])) implementation; low 128-bit ciphertext C i,1 The calculation method is It does this by calling _mm_aesenc_si128(M i,1 ,_mm_aesenc_si128(_mm_xor_si128(STA[2],STA[4]),STA[0])); (4.5.3) According to STA new And the input M i,0 、M i,1 , call the round function R(STA new ,M i,0 ,M i,1 )Get the new status STA new ; (4.5.4)d=d-1; (4.5.5) If d is not 0, go to (4.5.2) to continue the iteration; otherwise, end the iteration calculation and go to (4.6); (4.6) Through link C 0,0 ||C 0,1 ||C 1,0 ||C 1,1 ||...C i,0 ||C i,1 ...C size / 256-1,0 ||C size / 256-1,1 , 0≤i≤size / 256-1, the complete ciphertext C is obtained, and the link operation is implemented by calling the _mm_loadu_si128 instruction; (4.7) Set the round encryption status bit R_ENC to 1, according to STA new And size / 256, for round function R(STA new ,1,size / 256) Iterate 5 rounds to get a new STA new ; (4.8) According to the updated STA new ,pass Generate a 128-bit flag T, which is obtained by calling 7 times the _mm_xor_si128 instruction; (4.9) Complete encryption; In this resource-sufficient environment, the decryption process is exactly the same as the encryption process, and only the plaintext M input in the encrypted part is converted into the ciphertext C.

Images