S-box implementation method, device, electronic device, and computer-readable storage medium

Abstract

The present disclosure relates to an S-box implementation method, device, electronic device and computer-readable storage medium, and relates to the technical field of cryptographic algorithms. The S-box implementation method includes: transforming the S-box in a finite field GF(2 8 ) to perform affine transformation on the input elements to obtain the first intermediate variable and the second intermediate variable; the first intermediate variable is transformed in the field GF(2 4 ) and perform a first multiplication and exponentiation operation on the first multiplication and exponentiation results, and obtain the result of the XOR operation; the result of the XOR operation is converted into the field GF(2 4 ) to obtain a third intermediate variable; perform a second multiplication operation on the second intermediate variable and the third intermediate variable over the field GF(2), and perform an exclusive-OR operation on the result of the second multiplication operation to obtain an output result of the S-box. The present disclosure can reduce the number of logic gates required for the linear component of the S-box, compress the depth of the logic gate circuit, and optimize the efficiency of hardware implementation.

Description

Technical Field

[0001] The present disclosure relates to the field of cryptographic algorithm technology, and in particular, to an S-box implementation method, device, electronic device, and computer-readable storage medium. Background Art

[0002] The SM4 algorithm has the advantages of being easy to implement in software and hardware, and having fast encryption and decryption speeds, and has a wide range of applications. The S-box is the only nonlinear component in the SM4 algorithm. The efficiency of the S-box implementation is crucial to the performance of the entire algorithm. Currently, the S-box implementation methods mainly include those based on lookup tables and those based on composite fields. Among them, the implementation method based on lookup tables requires saving all possible outputs of the S-box, which has a low implementation efficiency. The implementation method based on composite fields is to convert the finite field GF(2 8 ) is converted to the composite field GF((2 4 ) 2 ) or GF(((2 2 ) 2 ) 2 ), and multiple linear calculations are required during the calculation process, which makes the number of logic gates required for the circuit implementation of the S-box linear component large, the implementation structure more complex, the logic gate circuit depth greater, and the hardware implementation efficiency low.

[0003] Therefore, how to provide a solution to the above technical problems is a problem that those skilled in the art need to solve at present. Summary of the Invention

[0004] The purpose of the present disclosure is to provide an S-box implementation method, device, electronic device and computer-readable storage medium, which can reduce the number of logic gates required for the linear component of the S-box, simplify the S-box implementation structure based on the composite domain, compress the circuit depth of the logic gates, and optimize the hardware implementation efficiency.

[0005] In a first aspect, the present disclosure provides an S-box implementation method, comprising:

[0006] Based on the affine transformation matrix, the S-box is transformed into the finite field GF(2 8 ) performs an affine transformation on the input elements to obtain a first intermediate variable and a second intermediate variable;

[0007] For the first intermediate variable in the field GF(2 4 ), performing a first multiplication operation and a square operation on the result of the first multiplication operation and the result of the square operation, and obtaining a result of the XOR operation;

[0008] The result of the XOR operation is given by the domain GF(2 4 ) to obtain a third intermediate variable;

[0009] Performing a second multiplication operation on the second intermediate variable and the third intermediate variable over the field GF(2), and performing an XOR operation on the result of the second multiplication operation to obtain an output result of the S-box;

[0010] Wherein, the affine transformation matrix includes the field GF(2 4 ) is obtained by performing linear operations on the input elements on the field GF(2), and a second linear matrix is ​​obtained by performing linear operations on the input elements on the field GF(2).

[0011] Optionally, the affine transformation matrix is ​​used to transform the S-box in the finite field GF(2 8 ) performs an affine transformation on the input elements to obtain the first intermediate variable, including:

[0012] Using the first relation, the S-box is used in the finite field GF(2 8 ) performs an affine transformation on the input elements to obtain a first intermediate variable, wherein the first relational expression is Q=B·U·(A·X+C);

[0013] Wherein, Q is the first intermediate variable, B is the domain GF(2 4 ), X is the input element, A is an 8×8 matrix over the field GF(2), C is an 8×1 matrix over the field GF(2), and U is a field isomorphic affine transformation matrix from a finite field to a composite field.

[0014] Optionally, based on the affine transformation matrix, the S-box is transformed into a finite field GF(2 8 ) performs an affine transformation on the input elements to obtain the second intermediate variable, including:

[0015] Using the second relation, the S-box is used in the finite field GF(2 8 ) performs an affine transformation on the input elements to obtain a second intermediate variable, and the second relation is L=A·U -1 ·M·U·(A·X+C);

[0016] Wherein, L is the second intermediate variable, A is an 8×8 matrix on the field GF(2), C is an 8×1 matrix on the field GF(2), U is the field isomorphic affine transformation matrix from the finite field to the composite field, U -1 is a field isomorphic affine transformation matrix from a composite field to a finite field, and M is a second linear matrix obtained by linear operations on the input elements on the field GF(2).

[0017] Optionally, the process of performing a second multiplication operation on the second intermediate variable and the third intermediate variable over the field GF(2), and performing an XOR operation on the result of the second multiplication operation to obtain the output result of the S-box includes:

[0018] dividing the second intermediate variable into a plurality of intermediate variable groups, the number of the intermediate variable groups being the same as the number of the third intermediate variables;

[0019] Performing a second multiplication operation on each of the second intermediate variables in the i-th intermediate variable group and the i-th third intermediate variable over the field GF(2), where i=1, 2, ..., n, and n is the number of the intermediate variable groups;

[0020] An XOR operation is performed on the result of the second multiplication operation over the field GF(2) to obtain an output result of the S-box.

[0021] Optionally, the result of the XOR operation is within the domain GF(2 4 ) to obtain the third intermediate variable.

[0022] In the domain GF(2 4 ) processing the result of the XOR operation through a NAND gate to obtain a first sub-variable;

[0023] In the domain GF(2 4 ) processing the result of the XOR operation through a NOR gate to obtain a second sub-variable;

[0024] In the domain GF(2 4 ) processing the first sub-variable and the second sub-variable through an XNOR gate to obtain a third sub-variable;

[0025] In the domain GF(2 4 ) selects one channel of input data from its multiple channels of input data according to a selection logic as a fourth sub-variable output, wherein the input data of the first data selector is any one of the result of the XOR operation and a preset value;

[0026] In the domain GF(2 4 ) selects one input data from its multiple input data as a third intermediate variable output through a second data selector according to the selection logic, and the input data is any one of the first sub-variable, the second sub-variable, the third sub-variable, the fourth sub-variable, the result of the XOR operation and the preset value.

[0027] Optionally, the affine transformation matrix is ​​used to transform the S-box in the finite field GF(2 8The process of performing an affine transformation on the input elements of ) includes:

[0028] determining a logic gate circuit including the fewest logic gates when the minimum circuit depth is determined based on an affine transformation matrix;

[0029] The logic gate circuit is used to control the S-box in the finite field GF(2 8 ) performs an affine transform on the input elements.

[0030] Optionally, the process of determining the logic gate circuit including the least logic gates when the minimum circuit depth is determined based on the affine transformation matrix includes:

[0031] Based on the affine transformation matrix, a recursive algorithm is used to iterate in ascending order of circuit depth and number of logic gates to determine a logic gate circuit including the least logic gates when the circuit depth is minimum.

[0032] In a second aspect, the present disclosure provides an S-box implementation device, comprising:

[0033] Input processing module, used to transform the S-box in the finite field GF(2 8 ) performs an affine transformation on the input elements to obtain a first intermediate variable and a second intermediate variable;

[0034] The multiplication and addition processing module is used to process the first intermediate variable in the domain GF(2 4 ), performing a first multiplication operation and a square operation on the result of the first multiplication operation and the result of the square operation, and obtaining a result of the XOR operation;

[0035] The inverse processing module is used to process the result of the XOR operation in the domain GF(2 4 ) to obtain a third intermediate variable;

[0036] an output processing module, configured to perform a second multiplication operation on the second intermediate variable and the third intermediate variable over the field GF(2), and perform an XOR operation on the result of the second multiplication operation to obtain an output result of the S-box;

[0037] Wherein, the affine transformation matrix includes the field GF(2 4 ) is obtained by performing linear operations on the input elements on the field GF(2), and a second linear matrix is ​​obtained by performing linear operations on the input elements on the field GF(2).

[0038] In a third aspect, the present disclosure provides an electronic device, comprising:

[0039] Memory for storing computer programs;

[0040] A processor, configured to implement the steps of the S-box implementation method as described above when executing the computer program.

[0041] In a fourth aspect, the present disclosure provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the S-box implementation method as described in any one of the above are implemented.

[0042] It can be seen that the present disclosure first determines the affine transformation matrix, which includes transforming the field GF(2 4 ) and the linear operation on the input elements on the field GF(2) are separated to obtain the linear matrix, and the finite field GF(2) is first transformed by the affine transformation matrix. 8 ) on the input elements, so that the composite field does not need to be transformed on the finite field GF(2 8 ) input elements, thereby reducing the number of logic gates required for the linear components of the S-box, simplifying the S-box implementation structure based on the composite domain, compressing the circuit depth of the logic gates, and optimizing the hardware implementation efficiency.

[0043] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present disclosure, the following will briefly introduce the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0045] Figure 1 4 is a flowchart showing a method for implementing an S-box according to an exemplary embodiment;

[0046] Figure 2 FIG1 is a structural diagram of an S-box implementation circuit according to an exemplary embodiment;

[0047] Figure 3 The figure is a structural diagram of an S-box implementation device according to an exemplary embodiment. DETAILED DESCRIPTION

[0048] The core of this disclosure is to provide an S-box implementation method, device, electronic device and computer-readable storage medium, which can reduce the number of logic gates required for the linear components of the S-box, simplify the S-box implementation structure based on the composite domain, compress the circuit depth of the logic gates, and optimize the hardware implementation efficiency.

[0049] To make the objectives, technical solutions, and advantages of the embodiments of the present disclosure more clear, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present disclosure without making any creative efforts shall fall within the scope of protection of the present disclosure.

[0050] Please refer to Figure 1 , Figure 1 This is a flowchart of the steps of an S-box implementation method provided by the present disclosure, and the S-box implementation method includes:

[0051] S101: Based on the affine transformation matrix, the S-box is transformed into a finite field GF(2 8 ) performs an affine transformation on the input elements to obtain a first intermediate variable and a second intermediate variable;

[0052] Specifically, the S-box in this disclosure can be applied to the SM4 algorithm. As the only nonlinear device in the SM4 algorithm, the S-box is the key to the encryption process. The algebraic representation of the S-box in this disclosure is Sbox(X)=A·(A·X+C) -1 +C, where A is an 8×8 matrix over GF(2), C is an 8×1 matrix over GF(2), the front and back affine transformations are the same, both A·X+C, X is the S-box in the finite field GF(2 8 ), the input element X can be represented as an 8-bit vector (X0, X1, X2, X3, X4, X5, X6, X7), where:

[0053]

[0054] The present invention relates the finite field GF(2 8 ) is converted into an inverse operation on a composite field. Specifically, the finite field GF(2 8 ) is irreducible polynomial for multiplication operation f(x)=x 8 +x 7 +x 6 +x 5 +x 4 +x 3 +x 2 +1. Select GF(2 4 ) on an irreducible polynomial t(x)=x 2 +x+v, v=0x7B, constructing a composite field GF((2 4 ) 2 ), the finite field GF(2 8 ) is represented by G=g0Y+g1Y 16 , G∈GF(28 ), g0, g1∈GF(2 4 ), based on this we can get GF(2 8 ) on the inverse G -1 :

[0055] G -1 =((g0+g1) 2 v+g0g1) -1 (g1Y+g0Y 16 );

[0056] It is understandable that the above process can be divided into the following six steps:

[0057] T1=(g0+g1) 2 v, T2=g0g1, T3=T1+T2, T4=(T3) -1 , T5=T4g1,T6=T4g0,correspondingly, G -1 =(T5Y+T6Y 16 ).

[0058] It is understandable that finding GF(2 8 ) on the inverse G -1 =(T5Y+T6Y 16 ) need to complete the domain GF(2 4 ) on the addition operation, multiplication operation, exponentiation operation and inversion operation, among which only the multiplication operation and inversion operation are nonlinear, and nonlinear operations also include some linear operations, and linear operations only need to be performed using XOR gates. In order to reduce the number of logic gates used in the S-box, the present disclosure provides an S-box implementation circuit, please refer to Figure 2 , Figure 2 The structure diagram of an S-box implementation circuit shown in an exemplary embodiment of the present disclosure includes a head module 01, a multiplication and addition module 02, an inversion module 03 and a tail module 04. The head module 01 is used to perform a series of linear operations on the input element X, and the linear operations include but are not limited to the front affine transformation, the back affine transformation, the domain isomorphic linear transformation, the domain GF(2 4 ) and the linear transformation of the input elements on the field GF(2), and obtain the corresponding intermediate variables. At the same time, the exponentiation operation corresponding to T1 is completed to obtain the result of the exponentiation operation. The exponentiation operation result and the intermediate variables are used for the multiplication and addition operations in the subsequent multiplication and addition module 02; the multiplication and addition module 02 is used to complete the T2 operation and the T3 operation to obtain the addition result of the multiplication and exponentiation operation; the inversion module 03 is used to complete the T4 operation to obtain the composite field GF(2 4 ), the tail module 04 is used to complete the T5 and T6 operations to obtain the output result of the S box.

[0059] Specifically, considering the front and back affine transformations and field isomorphism transformations of the input elements of the S-box, the first linear matrix and the second linear matrix are combined to transform the S-box in the finite field GF(2 8 ) can obtain the 18-bit first intermediate variable (Q0, ..., Q7) and the 32-bit second intermediate variable (L0, ..., L7) by performing affine transformation on the input element X on GF(2). Specifically, all the linear operations mentioned above are performed in the head module, which is implemented by logic gate circuits. Considering that linear operations only need to be performed using XOR gates (exclusive OR gates), the exclusive OR operation with constants can be completed by converting some XOR operations into XONR (exclusive OR gate) operations. S-box in the finite field GF(2 8 ) enters the header module for affine transformation, outputting a total of 50-bit intermediate variables. Based on the 50×8 matrix corresponding to the linear transformation, a recursive algorithm can be used to iterate from the smallest to the largest circuit depth and number of logic gates, starting from the minimum value 1, and exhaustively searching for the circuit implementation with the fewest logic gates when the header module reaches the minimum circuit depth. The 18-bit first intermediate variables (Q0, ..., Q7) and 32-bit second intermediate variables (L0, ..., L7) obtained in the present disclosure are as follows:

[0060] Q5=XOR(X1,X5), L11=XOR(X2,X3), L18=XNOR(X0,X2), Z3=XOR(X0,X4), Z4=XOR(X7,X2 ), Z5=XOR(X5,X3), Z6=XNOR(X4,X7), Q4=XOR(Z5,X0), Q6=XOR(Z3,X6), Q9=XOR(L18,X4 ), Q15=XOR(Q5,X6), L1=XOR(Z5,X6), L5=XOR(L11,Z6), L6=XOR(Z4,Z5), L12=XOR(L11 , 0=XOR(Q5,Z3), L31=XOR(Q5,X4), Z14=XOR(L18,X6), Z15=XNOR(Z6,X2), Q0=XOR(Q4,L 26), Q1=XNOR(Q6,X7), Q2=XNOR(L5,X5), Q3=XOR(L1,Z6), Q7=XOR(L1,L18), Q8=XNOR(Q 4, X7), Q10= 14=XOR(L5,Z14), Q16=XOR(L12,Q5), L2=XOR(Q6,L5), L3=XOR(L1,Z4) L4=XOR(L5,L18)

[0061] L7=XOR(Q9,Z5), L9=XOR(L5,L31), L10=XOR(Q15,Z6), L13=XOR(L6,L30), L16=XOR(L1,L15), L17=XOR(Q15,Z4), L22=X OR(L12,L19)、L23=XOR(L14,Z14)、L24=XOR(L31,Z4)、L25=XNOR(Q15,X7)、L27=XOR(L30,Z15)、Q17=X6、L0=Q16、L8=Q13

[0062] L20=Q13 L21=L6, L28=Q14, L29=L14.

[0063] S102: For the first intermediate variable in the field GF(2 4 ), performing a first multiplication operation and an exponentiation operation on the result of the first multiplication operation and the result of the exponentiation operation, and obtaining a result of the exclusive-OR operation;

[0064] Specifically, the first intermediate variable is used as the input of the multiplication and addition module, and the multiplication and addition module is calculated according to GF(2 4 ) is the logical expression for the inverse operation on the first multiplication operation. The circuit implementation includes the minimum logic gates when the circuit depth is minimized, completes the multiplication operation and the addition operation, and performs an XOR operation on the result of the first multiplication operation and the result of the exponentiation operation to obtain a 4-bit intermediate variable (U0, U1, U2, U3):

[0065] T20=NAND(Q6,Q12), T21=NAND(Q3,Q14), T22=NAND(Q1,Q16), T10=XOR(NOR(Q3,Q14),NAND(Q0,Q7)), T11=XOR(N OR(Q4,Q13),NAND(Q10,Q11)), T12=XOR(NOR(Q2,Q17),NAND(Q5,Q9)), T13=XOR(NOR(Q8,Q15),NAND(Q2,Q17));

[0066] U0=XOR(T10,XOR(T20,T22));

[0067] U1=XOR(T11,XOR(T21,T20));

[0068] U2=XOR(T12,XOR(T21,T22));

[0069] U3=XOR(T13,XOR(T21,NAND(Q4,Q13))).

[0070] S103: The result of the XOR operation is in the field GF(2 4 ) to obtain a third intermediate variable;

[0071] Specifically, the 4-bit intermediate variables (U0, U1, U2, U3) output by the multiplication and addition module are used as the input of the inversion module, according to GF(2 4 ) and output a 4-bit third intermediate variable (V0, V1, V2, V3).

[0072] It can be understood that the inversion module implements the logic of the inversion operation through a logic gate circuit. In order to further reduce the number of logic gates used in the S-box, a two-way data selector can be used to implement the function of the logic gate.

[0073] Correspondingly, in the field GF(2 4) is processed by a NAND gate on the result of the XOR operation to obtain a first subvariable, a NOR gate is used to process the result of the XOR operation to obtain a second subvariable, and an XNOR gate is used to process the first subvariable and the second subvariable to obtain a third subvariable; a first data selector is used to select one input data from its multiple input data according to a selection logic as a fourth subvariable output, the input data of the first data selector is any one of the result of the XOR operation and a preset value, and a second data selector is used to select one input data from its multiple input data according to a selection logic as a third intermediate variable output, the input data is any one of the first subvariable, the second subvariable, the third subvariable, the fourth subvariable, the result of the XOR operation, and the preset value.

[0074] Specifically, the third intermediate variable (V0, V1, V2, V3) is obtained:

[0075] T0 = ​​NAND(U0, U2), T1 = NOR(U1, U3), T2 = XNOR(T0, T1), V0 = MUX(U2, T2, U3), V2 = MUX(U0, T2, U1), T3 = MUX(U1, U2, 1), V1 = MUX(T2, U3, T3), T4 = MUX(U3, U0, 1), V3 = MUX(T2, U1, T4). MUX represents a two-way data selector. Taking V0 = MUX(U2, T2, U3) as an example, the input / output logic of the two-way data selector is explained. Assuming U2 is non-zero, the value of T2 is output as V0. Otherwise, the value of U3 is output as V0. Here, the first subvariable is T0, the second subvariable is T1, the third subvariable is T2, and the fourth subvariable includes T3 and T4.

[0076] S104: Perform a second multiplication operation on the second intermediate variable and the third intermediate variable over the field GF(2), and perform an XOR operation on the result of the second multiplication operation to obtain an output result of the S-box;

[0077] Specifically, the second intermediate variable and the third intermediate variable are used as input variables of the tail module, and a second multiplication operation is performed on the field GF(2), that is, the 32-bit (L0, ..., L31) and the 4-bit (V0, V1, V2, V3) are subjected to a second multiplication operation, and then the result of the second multiplication operation is subjected to the corresponding XOR operation bit by bit to obtain the 8-bit output (Y0, Y1, Y2, Y3, Y4, Y5, Y6, Y7) of the S-box.

[0078] As an optional embodiment, the second intermediate variable can be divided into multiple intermediate variable groups, and the number of intermediate variable groups is the same as the number of third intermediate variables, that is, the second intermediate variable (L0,…,L31) is divided into 4 groups, and each group is (L0,…,L7), (L8,…,L15), (L16,…,L23), and (L24,…,L31). Then, a second multiplication operation is performed on each second intermediate variable in the i-th intermediate variable group with the i-th third intermediate variable on the field GF(2), i = 1, 2, ..., n, where n is the number of intermediate variable groups, i.e., each group of bits performs a NAND (NAND gate) operation with V0, V1, V2, V3, respectively. The XOR operation with the constant can be completed by converting some NAND operations into AND (AND gate) operations. The result of the second multiplication operation is XORed on the field GF(2), i.e., the results of the four groups of operations are XORed bit by bit, and the 8-bit output (Y0, Y1, Y2, Y3, Y4, Y5, Y6, Y7) of the SM4 algorithm S-box is obtained:

[0079] K0=AND(V0,L0), K1=AND(V0,L1), K2=NAND(V0,L2), K3=AND(V0,L3), K4=NAND(V0,L4), K5=NAND( V0,L5), K6=AND(V0,L6), K7=AND(V0,L7), K8=NAND(V1,L8), K9=NAND(V1,L9), K10=NAND(V1,L10)

[0080] K11=NAND(V1,L11), K12=NAND(V1,L12), K13=NAND(V1,L13), K14=NAND(V1,L14), K15=NAND(V1,L15), K16= NAND(V2,L16), K17=NAND(V2,L17), K18=NAND(V2,L18), K19=NAND(V2,L19), K20=NAND(V2,L20), K21=NAND (V2,L21), K22=NAND(V2,L22), K23=NAND(V2,L23), K24=NAND(V3,L24), K25=NAND(V3,L25), K26=NAND(V3, L26), K27=NAND(V3,L27), K28=NAND(V3,L28), K29=NAND(V3,L29), K30=NAND(V3,L30), K31=NAND(V3,L31);

[0081] Y0=XOR(XOR(K0,K8),XOR(K16,K24));

[0082] Y1=XOR(XOR(K1,K9),XOR(K17,K25));

[0083] Y2=XOR(XOR(K2,K10),XOR(K18,K26));

[0084] Y3=XOR(XOR(K3,K11),XOR(K19,K27));

[0085] Y4=XOR(XOR(K4,K12),XOR(K20,K28));

[0086] Y5=XOR(XOR(K5,K13),XOR(K21,K29));

[0087] Y6=XOR(XOR(K6,K14),XOR(K22,K30));

[0088] Y7=XOR(XOR(K7,K15),XOR(K23,K31)).

[0089] In summary, the S-box circuit implementation involved in the present disclosure is shown in Table 1.

[0090] Table 1. Cost table of S-box circuit implementation used in SM4 algorithm

[0091] Head module Multiply-add module Inversion module Tail module total Circuit Depth 3 3 3 3 12 Number of logic gates 49 24 9 56 138

[0092] The circuit depth of the S-box used in the SM4 algorithm in this disclosure is 12, and the number of logic gates required is 138, where the composite field GF(2 4 ) uses a two-way data selector MUX logic element with 9 logic gates, which simplifies the S-box implementation structure based on the composite domain and compresses the logic gate circuit depth of the S-box.

[0093] It can be seen that the present disclosure first determines the affine transformation matrix, which includes transforming the field GF(2 4 ) and the linear operation on the input elements on the field GF(2) are separated to obtain the linear matrix, and the finite field GF(2) is first transformed by the affine transformation matrix. 8 ) on the input elements, so that the composite field does not need to be transformed on the finite field GF(2 8 ) input elements, thereby reducing the number of logic gates required for the linear components of the S-box, simplifying the S-box implementation structure based on the composite domain, compressing the circuit depth of the logic gates, and optimizing the hardware implementation efficiency.

[0094] Based on the above embodiment:

[0095] As an optional embodiment, based on the affine transformation matrix, the S-box is transformed into a finite field GF(2 8 ) performs an affine transformation on the input elements to obtain the first intermediate variable, including:

[0096] Using the first relation, the S-box is used in the finite field GF(2 8 ) performs an affine transformation on the input elements to obtain a first intermediate variable, and the first relationship is Q = B·U·(A·X+C);

[0097] Among them, Q is the first intermediate variable, B is the field GF(2 4 ), where X is the input element, A is an 8×8 matrix over the field GF(2), C is an 8×1 matrix over the field GF(2), and U is the field isomorphic affine transformation matrix from the finite field to the composite field.

[0098] Specifically, considering that the nonlinear operations involved in the multiplication-addition module and the inversion module also include some linear operations, the present disclosure separates all linear operations in the multiplication-addition module and the inversion module from the nonlinear operations, and then considers the front affine transformation to be performed on the input elements of the S-box and the field isomorphic linear transformation from the finite field to the composite field (the matrix representation is denoted as U), it can be obtained:

[0099] Sbox(X)=A·U -1 ·(U·(A·X+C)) -1 +C.

[0100] Specifically, the linear operation separated from the exponentiation operation T1 and the first multiplication operation T2 is recorded as matrix B, and the matrix B is combined with GF(2 8 ) before the inverse operation and the field isomorphic linear transformation from the finite field to the composite field are fused into an affine transformation on the S-box input elements to obtain Q = B·U·(A·X+C) = F·(X+C), and Q is used for subsequent T2 and T3 calculations.

[0101] As an optional embodiment, based on the affine transformation matrix, the S-box is transformed into a finite field GF(2 8 ) performs an affine transformation on the input elements to obtain the second intermediate variable, including:

[0102] Using the second relation, the S-box is used in the finite field GF(2 8 ) performs an affine transformation on the input elements to obtain the second intermediate variable, and the second relation is L = A·U -1 ·M·U·(A·X+C);

[0103] Where L is the second intermediate variable, A is an 8×8 matrix on the field GF(2), C is an 8×1 matrix on the field GF(2), U is the field isomorphic affine transformation matrix from the finite field to the composite field, U -1 is the field isomorphic affine transformation matrix from the composite field to the finite field, and M is the second linear matrix obtained by the linear operation on the input elements on the field GF(2).

[0104] Specifically, considering that the multiplication operation T5 and the multiplication operation T6 can be combined, they can be regarded as a linear transformation of an 8-bit multiplicand and each bit T of another multiplicand. 4,i The scalar multiplication is recorded as the matrix representation of the four linear transformations, M0, M1, M2, and M3. Consider the previous affine transformation of the input elements of the S-box and the field isomorphic linear transformation from the finite field to the composite field, as well as the GF(2 8 ) after the inverse operation on the field isomorphic linear transformation from the composite field to the finite field (the matrix representation is denoted by U -1 ) and post-affine transformation, these transformations are fused into affine transformations on the S-box input elements to obtain: L = A·U -1 ·M·U·(A·X+C).

[0105] Furthermore, considering the two fused affine transformations of the input element X, the matrix representations F, F0, F1, F2, and F3 of the linear transformations are combined to search for the circuit implementation with the least logic gates when the circuit depth is minimized, and the S-box output result R can be obtained:

[0106] R=T 4,0 ·A·U -1 M0 U (A X + C) + T 4,1 ·A·U -1 M1 U (A X + C) + T 4,2 ·A·U -1 M2 U (A X + C) + T 4,3 ·A·U -1 M3 U (A X + C) = T 4,0 ·F0·(X+C0”)+F1·(X+C1”)·T 4,1 +T 4,2 ·F2·(X+C2”)+T 4,3 ·F3·(X+C3”).

[0107] In summary, the present invention converts the inversion operation on the finite field of the SM4 algorithm S-box into the inversion operation on the composite field, separates the linear combination of the input elements in the inversion operation on the intermediate composite field and adds them to the head module, and integrates the front affine transformation, field isomorphism linear transformation and back affine transformation of the S-box, simplifies the S-box implementation structure based on the composite field, and compresses the logic gate circuit depth of the S-box. A recursive algorithm is used to iterate the head module from small to large according to the circuit depth and the number of logic gates, and an exhaustive search is performed to find the circuit implementation that uses the least logic gates when the head module reaches the minimum circuit depth. A two-way data selector, a logic element, is introduced into the logic gate circuit of the inversion module to reduce the number of logic gates required, reduce the hardware implementation cost and circuit area, reduce the hardware circuit delay, and further improve efficiency.

[0108] Please refer to Figure 3 , Figure 3 This is a schematic structural diagram of an S-box implementation device provided by the present disclosure, which includes:

[0109] Input processing module 11, used for transforming S-box in finite field GF(2 8 ) performs an affine transformation on the input elements to obtain a first intermediate variable and a second intermediate variable;

[0110] The multiplication and addition processing module 12 is used to process the first intermediate variable in the domain GF(2 4 ), performing a first multiplication operation and an exponentiation operation on the result of the first multiplication operation and the result of the exponentiation operation, and obtaining a result of the exclusive-OR operation;

[0111] The inverse processing module 13 is used to calculate the result of the XOR operation in the field GF(2 4 ) to obtain a third intermediate variable;

[0112] An output processing module 14 is configured to perform a second multiplication operation on the second intermediate variable and the third intermediate variable over the field GF(2), and perform an exclusive-OR operation on the result of the second multiplication operation to obtain an output result of the S-box;

[0113] Among them, the affine transformation matrix includes the field GF(2 4 ) is a first linear matrix obtained by linear operations on the input elements over the field GF(2), and a second linear matrix obtained by linear operations on the input elements over the field GF(2).

[0114] It can be seen that the present disclosure first determines the affine transformation matrix, which includes transforming the field GF(2 4 ) and the linear operation on the input elements on the field GF(2) are separated to obtain the linear matrix, and the finite field GF(2) is first transformed by the affine transformation matrix. 8) on the input elements, so that the composite field does not need to be transformed on the finite field GF(2 8 ) input elements, thereby reducing the number of logic gates required for the linear components of the S-box, simplifying the S-box implementation structure based on the composite domain, compressing the circuit depth of the logic gates, and optimizing the hardware implementation efficiency.

[0115] As an optional embodiment, based on the affine transformation matrix, the S-box is transformed into a finite field GF(2 8 ) performs an affine transformation on the input elements to obtain the first intermediate variable, including:

[0116] Using the first relation, the S-box is used in the finite field GF(2 8 ) performs an affine transformation on the input elements to obtain a first intermediate variable, and the first relationship is Q = B·U·(A·X+C);

[0117] Among them, Q is the first intermediate variable, B is the field GF(2 4 ), where X is the input element, A is an 8×8 matrix over the field GF(2), C is an 8×1 matrix over the field GF(2), and U is the field isomorphic affine transformation matrix from the finite field to the composite field.

[0118] As an optional embodiment, based on the affine transformation matrix, the S-box is transformed into a finite field GF(2 8 ) performs an affine transformation on the input elements to obtain the second intermediate variable, including:

[0119] Using the second relation, the S-box is used in the finite field GF(2 8 ) performs an affine transformation on the input elements to obtain the second intermediate variable, and the second relation is L = A·U -1 ·M·U·(A·X+C);

[0120] Where L is the second intermediate variable, A is an 8×8 matrix on the field GF(2), C is an 8×1 matrix on the field GF(2), U is the field isomorphic affine transformation matrix from the finite field to the composite field, U -1 is the field isomorphic affine transformation matrix from the composite field to the finite field, and M is the second linear matrix obtained by the linear operation on the input elements on the field GF(2).

[0121] As an optional embodiment, a process of performing a second multiplication operation on the second intermediate variable and the third intermediate variable over the field GF(2), performing an XOR operation on the result of the second multiplication operation, and obtaining an output result of the S-box includes:

[0122] Dividing the second intermediate variable into a plurality of intermediate variable groups, the number of the intermediate variable groups being the same as the number of the third intermediate variables;

[0123] Perform a second multiplication operation on each second intermediate variable in the i-th intermediate variable group with the i-th third intermediate variable over the field GF(2), where i=1, 2, ..., n, and n is the number of intermediate variable groups;

[0124] The result of the second multiplication operation is XORed over the field GF(2) to obtain the output result of the S-box.

[0125] As an optional embodiment, the result of the XOR operation is in the field GF(2 4 ) to obtain the third intermediate variable.

[0126] In the domain GF(2 4 ) processes the result of the XOR operation through a NAND gate to obtain a first sub-variable;

[0127] In the domain GF(2 4 ) processes the result of the XOR operation through a NOR gate to obtain a second sub-variable;

[0128] In the domain GF(2 4 ) processes the first subvariable and the second subvariable through an XNOR gate to obtain a third subvariable;

[0129] In the domain GF(2 4 ) selects one channel of input data from its multiple channels of input data according to a selection logic as a fourth sub-variable output, wherein the input data of the first data selector is any one of the result of an exclusive-OR operation and a preset value;

[0130] In the domain GF(2 4 ) selects one input data from its multiple input data as the third intermediate variable output through the second data selector according to the selection logic, and the input data is any one of the first subvariable, the second subvariable, the third subvariable, the fourth subvariable, the result of the exclusive OR operation and the preset value.

[0131] As an optional embodiment, based on the affine transformation matrix, the S-box is transformed into a finite field GF(2 8 The process of performing an affine transformation on the input elements of ) includes:

[0132] determining a logic gate circuit including the fewest logic gates when the minimum circuit depth is determined based on an affine transformation matrix;

[0133] Through the logic gate circuit, the S box is connected to the finite field GF(2 8 ) performs an affine transform on the input elements.

[0134] As an optional embodiment, the process of determining the logic gate circuit including the least logic gates when the minimum circuit depth is determined based on the affine transformation matrix includes:

[0135] Based on the affine transformation matrix, a recursive algorithm is used to iterate in ascending order of circuit depth and number of logic gates to determine a logic gate circuit including the least logic gates when the circuit depth is minimum.

[0136] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0137] In another aspect, the present disclosure further provides an electronic device, comprising:

[0138] Memory for storing computer programs;

[0139] A processor is configured to implement the steps of the S-box implementation method described in any one of the above embodiments when executing a computer program.

[0140] Of course, electronic devices may also include various network interfaces, power supplies and other components.

[0141] On the other hand, the present disclosure further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the S-box implementation method described in any one of the above embodiments are implemented.

[0142] Specifically, the computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0143] It should also be noted that, in this specification, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0144] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present disclosure. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure is not limited to the embodiments shown herein, but is intended to be embodied in the widest possible manner consistent with the principles and novel features disclosed herein.

Claims

1. An S-box implementation method, characterized in that: include: Based on the affine transformation matrix, the S-box is transformed into the finite field GF(2 8 ) performs an affine transformation on the input elements to obtain a first intermediate variable and a second intermediate variable; For the first intermediate variable in the field GF(2 4 ), performing a first multiplication operation and a square operation on the result of the first multiplication operation and the result of the square operation, and obtaining a result of the XOR operation; The result of the XOR operation is given in the field GF(2 4 ) to obtain a third intermediate variable; Performing a second multiplication operation on the second intermediate variable and the third intermediate variable over the field GF(2), and performing an XOR operation on the result of the second multiplication operation to obtain an output result of the S-box; Wherein, the affine transformation matrix includes the field GF(2 4 ) is obtained by performing linear operations on the input elements on the field GF(2), and a second linear matrix is ​​obtained by performing linear operations on the input elements on the field GF(2).

2. The S-box implementation method according to claim 1, wherein: The affine transformation matrix based on the S-box in the finite field GF(2 8 ) performs an affine transformation on the input elements to obtain the first intermediate variable, including: Using the first relation, the S-box is used in the finite field GF(2 8 ) performs an affine transformation on the input elements to obtain a first intermediate variable, wherein the first relational expression is Q=B·U·(A·X+C); Wherein, Q is the first intermediate variable, B is the domain GF(2 4 ), X is the input element, A is an 8×8 matrix over the field GF(2), C is an 8×1 matrix over the field GF(2), and U is a field isomorphic affine transformation matrix from a finite field to a composite field.

3. The S-box implementation method according to claim 1, wherein: Based on the affine transformation matrix, the S-box is transformed into the finite field GF(2 8 ) performs an affine transformation on the input elements to obtain the second intermediate variable, including: Using the second relation, the S-box is used in the finite field GF(2 8 ) performs an affine transformation on the input elements to obtain a second intermediate variable, and the second relation is L=A·U -1 ·M·U·(A·X+C); Wherein, L is the second intermediate variable, A is an 8×8 matrix on the field GF(2), C is an 8×1 matrix on the field GF(2), U is the field isomorphic affine transformation matrix from the finite field to the composite field, U -1 is a field isomorphic affine transformation matrix from a composite field to a finite field, and M is a second linear matrix obtained by linear operations on the input elements on the field GF(2).

4. The S-box implementation method according to claim 1, wherein: The process of performing a second multiplication operation on the second intermediate variable and the third intermediate variable over the field GF(2), and performing an XOR operation on the result of the second multiplication operation to obtain the output result of the S-box includes: dividing the second intermediate variable into a plurality of intermediate variable groups, the number of the intermediate variable groups being the same as the number of the third intermediate variables; Performing a second multiplication operation on each of the second intermediate variables in the i-th intermediate variable group and the i-th third intermediate variable over the field GF(2), where i=1, 2, ..., n, and n is the number of the intermediate variable groups; An XOR operation is performed on the result of the second multiplication operation over the field GF(2) to obtain an output result of the S-box.

5. The S-box implementation method according to claim 1, wherein: The result of the XOR operation is in the domain GF(2 4 ) to obtain the third intermediate variable. In the domain GF(2 4 ) processing the result of the XOR operation through a NAND gate to obtain a first sub-variable; In the domain GF(2 4 ) processing the result of the XOR operation through a NOR gate to obtain a second sub-variable; In the domain GF(2 4 ) processing the first sub-variable and the second sub-variable through an XNOR gate to obtain a third sub-variable; In the domain GF(2 4 ) selects one channel of input data from its multiple channels of input data according to a selection logic as a fourth sub-variable output, wherein the input data of the first data selector is any one of the result of the XOR operation and a preset value; In the domain GF(2 4 ) selects one input data from its multiple input data as a third intermediate variable output through a second data selector according to the selection logic, and the input data is any one of the first sub-variable, the second sub-variable, the third sub-variable, the fourth sub-variable, the result of the XOR operation and the preset value.

6. The S-box implementation method according to any one of claims 1 to 5, characterized in that: The affine transformation matrix based on the S-box in the finite field GF(2 8 The process of performing an affine transformation on the input elements of ) includes: determining a logic gate circuit including the fewest logic gates when the minimum circuit depth is determined based on an affine transformation matrix; The logic gate circuit is used to control the S-box in the finite field GF(2 8 ) performs an affine transform on the input elements.

7. The S-box implementation method according to claim 6, characterized in that: The process of determining the logic gate circuit including the least logic gates when the minimum circuit depth is determined based on the affine transformation matrix includes: Based on the affine transformation matrix, a recursive algorithm is used to iterate in ascending order of circuit depth and number of logic gates to determine a logic gate circuit including the least logic gates when the circuit depth is minimum.

8. An S-box implementation device, characterized in that: include: Input processing module, used to transform the S-box in the finite field GF(2 8 ) performs an affine transformation on the input elements to obtain a first intermediate variable and a second intermediate variable; The multiplication and addition processing module is used to process the first intermediate variable in the domain GF(2 4 ), performing a first multiplication operation and a square operation on the result of the first multiplication operation and the result of the square operation, and obtaining a result of the XOR operation; The inverse processing module is used to process the result of the XOR operation in the domain GF(2 4 ) to obtain a third intermediate variable; an output processing module, configured to perform a second multiplication operation on the second intermediate variable and the third intermediate variable over the field GF(2), and perform an XOR operation on the result of the second multiplication operation to obtain an output result of the S-box; Wherein, the affine transformation matrix includes the field GF(2 4 ) is obtained by performing linear operations on the input elements on the field GF(2), and a second linear matrix is ​​obtained by performing linear operations on the input elements on the field GF(2).

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the S-box implementation method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the S-box implementation method according to any one of claims 1 to 7 are implemented.

Images