Software-oriented, high-speed, and scalable stream password generation device

Abstract

The present invention provides a class of software-oriented, high-speed, and scalable serial cipher algorithm families. The algorithm family adopts an scalable, component-based algorithm framework, including: a primitive mode and a parallel extension mode. The primitive mode adopts a combination structure of a nonlinear source and an FSM with memory, wherein the nonlinear source adopts the form of LFSR in series with NFSR, and the FSM uses a parallel nonlinear function R through two types of components, a connector and a plug-in, to quickly realize nonlinear scrambling, and the nonlinear source and the FSM adopt a combination of head feedback and tail output; the parallel extension mode is to form an extended nonlinear source with a longer period by connecting the LFSR parts of multiple nonlinear sources end to end into a circle, and to form an extended FSM with a larger state by connecting the connectors of multiple FSMs end to end into a circle, and to output a longer key stream each time by correspondingly combining the extended nonlinear source and the FSM in the original head feedback and tail output mode. The algorithm family supports at least 256-bit keys and provides higher encryption efficiency.

Description

Technical Field

[0001] The present invention relates to the technical field of sequence ciphers, and in particular to a group of software-oriented, high-speed and extensible sequence cipher generating devices. Background Art

[0002] Stream cipher is the mainstream algorithm for ensuring data confidentiality and integrity. It has the characteristics of simple implementation, easy hardware implementation, fast encryption and decryption processing speed, and no or limited error propagation. Stream cipher algorithms generally use a short key and a specific key stream generation algorithm to generate a key stream sequence of the same length as the message to be encrypted, and perform bitwise XOR with the plaintext to achieve the purpose of encryption. The operation process of modern stream cipher algorithms can be roughly divided into three stages:

[0003] 1. Loading: Assign initial values ​​to the internal state of the stream cipher based on the key and IV;

[0004] 2. Initialization: The key and IV are fully mixed so that each internal state bit is related to all key and IV bits. During this process, the key stream is not output.

[0005] 3. Key stream generation: Continuously call the key stream generation algorithm of the serial cipher, calculate and output the specified number of key streams according to actual needs, and update the internal state while outputting the key stream.

[0006] Stream cipher algorithms have always played an important role in protecting various generations of 3GPP mobile communication systems. The system architecture and security level in the 5G era have undergone some fundamental changes, which will cause the existing algorithms to fail in many cases. On the one hand, in order to resist quantum attacks, the 3GPP standardization organization requires that the algorithm security level be increased to 256-bit key length. On the other hand, an important change in future mobile communication networks is the virtualization of network functions, which puts forward new requirements for encryption algorithms used to protect traffic, because it needs to be executed quickly in pure software implementation on modern CPUs, reducing the reliance on encryption primitives using dedicated hardware. At peak data rates, the minimum requirements associated with 5G wireless interfaces are 10Gbps uplink and 20Gbps downlink.

[0007] Most traditional designs of stream ciphers run one round to generate a one-bit key stream, such as the standard algorithm RC4. With the rapid development of communication networks and computer networks, some word-oriented key stream generation methods have gradually emerged, such as the LTE standard SNOW3G algorithm, which uses a 32-bit key stream word. However, without any hardware support, these encryption algorithms cannot reach the speed required by 5G in pure software.

[0008] In recent years, many new processors from Intel and ARM have included instructions to accelerate AES and have the ability to process large integer vectors (such as the AVX Advanced Vector Extensions instruction set from Intel). The newly designed SNOW-V and SNOW-Vi sequential cipher algorithms utilize AES-NI and SIMD instructions and use 128-bit key stream words. These are the only sequential cipher algorithms that can achieve the 256-bit key and 20Gbps software implementation efficiency required by the 5G communication standard.

[0009] Existing serial cipher design methods cannot meet the security and efficiency requirements of 5G and future mobile communication networks. The aforementioned SNOW-V and SNOW-Vi serial cipher algorithms adopt the design concept of "linear source + FSM with memory". The key stream word is only a simple nonlinear combination with FSM, and the output is a simple nonlinear operation, which causes a strong linear correlation between the key stream and the linear source, and there is an efficient correlation attack theory analysis. At the same time, each operation only generates a 128-bit key, which lacks the necessary flexibility. Summary of the invention

[0010] The technical problem to be solved by the present invention is to provide a sequence cipher generation device with high encryption rate, high security strength and high compatibility in response to the needs of post-quantum cryptography.

[0011] In order to solve the above technical problems, the present invention provides a family of software-oriented, high-speed, and scalable sequence password generation devices, including:

[0012] 1) An extensible, component-based algorithm framework that defines standard component libraries and parallel expansion modes including linear feedback shift registers (LFSRs), nonlinear feedback shift registers (NFSRs), finite automata (FSM) connectors and plug-ins, which can be used to build a family of efficient and secure sequence cryptographic algorithms;

[0013] 2) The primitive algorithm of the present invention adopts a combination structure of a nonlinear source and an FSM with memory, wherein the nonlinear source adopts the form of LFSR in series with NFSR, and the FSM uses parallel AES round functions through two types of components, connectors and plug-ins, to quickly implement nonlinear scrambling, and the nonlinear source and FSM adopt a combination of head feedback and tail output;

[0014] 3) The parallel expansion mode of the present invention is to connect the LFSR parts of multiple nonlinear sources end to end into a loop to form an extended nonlinear source with a longer period, connect the connectors of multiple FSMs end to end into a loop to form an extended FSM with a larger state, and output a longer key stream each time by correspondingly combining the extended nonlinear source and the FSM in the manner of original head feedback and tail output;

[0015] 4) The algorithm of the present invention is divided into an initialization phase and a key stream generation phase. For the initialization phase, an idea of ​​loading the key and initial vector (IV) into the FSM state is proposed, which is helpful for rapid diffusion and analysis of the number of active S-boxes. An update scheme of simultaneously feeding back the key stream to the LFSR and NFSR and a key usage method using FP(1)-mode in the last round are proposed.

[0016] The nonlinear source of the present invention can take into account both long period and nonlinearity.

[0017] The LFSR uses an even-odd structure on a finite field. The storage value in each LFSR is used to update the odd-numbered storage unit of the LFSR after the operation result of the update function f. It is also used as the input of the FSM. The original odd-numbered storage unit value is assigned to the even-numbered storage unit. The original even-numbered storage unit value is used as the output of the LFSR for the update of the NFSR. The LFSR uses a 256-bit register, which is suitable for fast parallel implementation of extended instruction sets such as AVX. It has provable maximum periodicity, rich selection resources, and can support algorithm expansion.

[0018] The NFSR uses a 128-bit register, and the feedback function directly uses the AES round function R. The storage value in each beat of the NFSR is XORed with the operation result of the function R and the output of the LFSR to update the storage unit of the NFSR. The original NFSR storage unit value is used as the output of the nonlinear source to generate the key stream.

[0019] The present invention can effectively resist correlation attacks by connecting a nonlinear source to a FSM with memory.

[0020] The connector of FSM is used to connect the nonlinear source at both ends of FSM. At the head end of FSM, the operation result of function f is XORed with the state of the head end and the state of the tail end of FSM through the operation result of AES round function R as the update of the state of the head end of FSM. At the tail end of FSM, the state of the tail end is XORed with the output of the nonlinear source through the operation result of AES round function R as the key stream word output at this moment.

[0021] The FSM plug-in is used in the middle of the FSM and can be added or deleted according to the needs of security and efficiency. The update of the FSM plug-in is the result of the operation of the plug-in state XORing its previous state through the AES round function R.

[0022] The original algorithm of the present invention supports 256-bit keys and 128-bit IVs, outputs 128-bit key stream blocks, and supports 256-bit security. The LFSR contains 16 16-bit register units. The FSM has 1 connector and 2 plug-ins. The initialization process key stream word is used to update the nonlinear source, and the key is reloaded to the LFSR and FSM state in the last round of initialization. The loading scheme puts the key and initialization vector into the FSM, and the nonlinear source is set to 0.

[0023] The extended algorithm of the present invention supports 256-bit keys and 256-bit IVs, outputs 256-bit key stream blocks, and supports 256-bit security. The nonlinear source includes two groups of LFSRs and two groups of NFSRs, and the FSM includes two groups of connectors. The LFSR is composed of two 256-bit LFSRs connected end to end and fed back to each other to form a 512-bit LFSR. The initialization process key stream word is used to update the nonlinear source, and the key is reloaded to the LFSR state in the last round of initialization. The loading scheme puts the key and the initial vector into the FSM, and the nonlinear source is set to 0.

[0024] After adopting such a design, the present invention has at least the following advantages:

[0025] 1. Scalable, component-based overall algorithm structure: defines a standard component library and extension mode, which can be used to build a family of efficient and secure sequence cryptographic algorithms.

[0026] 2. Algorithm components that can be implemented in high-speed parallel: The LFSR components used have extremely high software implementation efficiency and scalability.

[0027] 3. Simple operation: Only three basic operations, XOR, circular shift and AES round function, are used, and no operations such as modular addition are used.

[0028] 4. High security: It provides 256-bit security and can be used in the post-quantum era.

[0029] 5. Innovation in loading method: For the first time, Key-IV is loaded into FSM instead of source, which makes full diffusion faster and has better differential security bound. By analyzing the number of active S-boxes, a clear initialization anti-differential security bound can be given. Currently, SNOW-V and most sequence cipher algorithms cannot give an effective security bound under the independence assumption.

[0030] 6. Highly efficient software implementation: Using a large output of more than 128 bits, efficiency tests show that the original algorithm of the present invention has a software implementation efficiency of 63.37 Gbps, while the software implementation efficiency of the extended algorithm is 98.54 Gbps; the original algorithm has an advantage in short message encryption speed, and the encryption rate of messages of about 100 bytes can reach the 20 Gbps required by 5G communications, which can be used for short data packet transmission scenarios; the extended algorithm has a high encryption speed for long messages, can optimize the processing of big data, and can quickly process a large amount of information after initialization once, which can be used for high-traffic services.

[0031] 7. Huge parallel potential: With the development of AES-NI and AVX512 instruction sets, multiple parallel AES round function operations may only require one instruction in the future, and the software efficiency of the algorithm will be greatly improved.

[0032] 8. Reusability: The LFSR and FSM parts of the original algorithm and the extended algorithm are highly consistent. Reuse can be achieved by adding a small amount of control circuits. To implement the two algorithms, it is only necessary to expand the implementation resources of the algorithms. In particular, from the expansion of the original algorithm to the extended algorithm, the FSM part only adds one AES round function unit, with a high degree of resource reuse and strong reconfigurability. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The above is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0034] Figure 1 is the structural diagram of the nonlinear source;

[0035] Figure 2 It is the structural diagram of the FSM connector;

[0036] Figure 3 This is the structure diagram of the FSM plugin;

[0037] Figure 4 It is a schematic diagram of the connection method between the nonlinear source and the FSM;

[0038] Figure 5 is a schematic diagram of the expansion of nonlinear sources;

[0039] Figure 6 It is a schematic diagram of the expansion of FSM;

[0040] Figure 7 It is the structural diagram of the key stream generation phase of the primitive algorithm;

[0041] Figure 8 It is the structural diagram of the initialization phase of the primitive algorithm;

[0042] Fig. 9 It is a structural diagram of the key stream generation phase of the extended algorithm;

[0043] Fig.10 It is the structural diagram of the initialization phase of the expansion algorithm. DETAILED DESCRIPTION

[0044] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0045] The present invention is oriented to the requirements of post-quantum cryptography, supports at least 256-bit keys, and has a speed that meets the 5G requirement of 20Gbps, while taking into account the processing speed of both short and long data. It is oriented to software-defined networks and takes into account hardware implementation. The software implementation makes full use of the underlying instruction sets such as AVX and the AES-NI acceleration instruction set. The output key stream word is based on 128 bits.

[0046] The present invention adopts an extensible and component-based algorithm framework and provides two serial cryptographic algorithm embodiments: the original algorithm and the extended algorithm, which output 128-bit and 256-bit key stream words in a single run. It has better security, flexibility and faster software encryption efficiency than SNOW-V and SNOW-Vi.

[0047] The algorithm of the present invention adopts a "nonlinear source + nonlinear FSM" structure to effectively resist related attacks.

[0048] Part I: The nonlinear source takes the form of a linear feedback shift register (LFSR) connected in series with a nonlinear feedback shift register (NFSR) ( Figure 1 ), which can take into account both long cycles and nonlinearity.

[0049] As components of nonlinear sources, the LFSR and NFSR selected in the present invention have the following characteristics:

[0050] LFSR:

[0051] 1. Linear drive on a limited extended domain, based on a 16-bit unit word length;

[0052] 2. Use a 256-bit register base, update half of the state at a time, and use the AVX instruction set for fast implementation;

[0053] 3. Meet the maximum cycle;

[0054] 4. The tap position and register size are compatible with LOL series expansion.

[0055] NFSR:

[0056] 1. Use 128-bit registers;

[0057] 2. The feedback function directly uses the AES round function.

[0058] Part 2: FSM uses parallelism and makes full use of AES round functions to quickly implement nonlinear scrambling. The components of FSM are divided into two categories: connectors and plug-ins:

[0059] The connector is used to connect the nonlinear source at both ends of the FSM. The specific structure is as follows: Figure 2 .

[0060] Plugin for FSM center ( Figure 2The structure can be added or deleted according to the needs of security and efficiency. Figure 3 .

[0061] Part III: Connection and output of nonlinear source and FSM Figure 4 , connecting the FSM with memory through nonlinear source can effectively resist the correlation attack. For the convenience of description, the present invention refers to the above connection combination as the single machine structure of the present invention.

[0062] The following describes the expansion mode, including parallel expansion and serial expansion. Here, the present invention firstly recommends parallel expansion for large output and high-speed encryption:

[0063] The nonlinear source can be expanded by connecting the LFSR parts of multiple nonlinear sources end to end to form a loop to obtain a nonlinear source with a longer period and larger state. For example, the case of expanding two Figure 5 shown.

[0064] The expansion of FSM can also be achieved by connecting multiple FSM connectors end to end to form a loop to form a new FSM with a larger state. For example, the expansion of two Figure 6 shown.

[0065] The present invention further combines the above-mentioned extended nonlinear source with the FSM as follows Figure 4 The combination of the nonlinear source and the connection and output mode of the FSM shown above can obtain the extended LOL sequence password, which can be regarded as a parallel combination of multiple single-machine structures of the present invention, called the parallel multi-machine structure of the present invention, for example, the above two situations are called the parallel dual-machine structure of the present invention. Specific parameters, such as the selection of components and the number of n in the FSM, are determined by the specific algorithm.

[0066] In order to meet higher security requirements, the present invention can also adopt a serial expansion mode, using a larger state source and FSM memory, which will be further studied as the requirements progress. In addition, in order to meet more different usage environments and requirements, the present invention can innovate more diverse expansion modes to make the serial password of the present invention richer.

[0067] Next, the present invention designs a primitive algorithm sequence cipher according to the single-machine structure of the present invention, and designs a basic extended algorithm sequence cipher according to the parallel dual-machine structure of the present invention.

[0068] The present invention first makes the following conventions for the symbols used in the whole text:

[0069] The algorithm uses 128-bit registers as storage units.

[0070] The state of LFSR is recorded as (H, L), the state of NFSR is recorded as N, the state of FSM is recorded as S, and the key stream word is recorded as Z; the subscript corresponds to the register number, and the superscript corresponds to the time.

[0071] State correspondence: A 128-bit register state S can be divided into eight 16-bit words w7,…,w0 from high to low, or it can be divided into 16 8-bit bytes b from high to low 15 ,…,b0, that is, S=(w7,…,w0)=(b 15 ,…,b0).

[0072] Swash letters It represents the combination of byte substitution (SubByte), row shift (ShiftRow), and column mixing (MixColumn) operations in the AES round function, that is, 1 128-bit register state S = (w 15 ,…,w0) and the 4×4 byte state matrix in AES are as follows:

[0073]

[0074] Example 1: Primitive Algorithm (128 bits output per round)

[0075] The original algorithm supports 256-bit keys and 128-bit IVs. The internal state of the original algorithm is 768 bits, which are stored in 6 128-bit registers. The states of the 256-bit LFSR are H, L, and the period is 2 256 -1. The state of the 128-bit NFSR is N, and the feedback function is The memory states of the FSM are S0, S1, and S2, i.e., n=3 FSM connectors and 1 FSM plug-in are used, and the parallel The output function of the primitive algorithm extracts a 128-bit state of the nonlinear source and the FSM respectively, performs XOR, and outputs a 128-bit key stream block.

[0076] First, let’s introduce LFSR. The LFSR of this primitive algorithm is defined in the finite field There are 16 16-bit registers in total, denoted as: a0,…,a 15 These 16 registers are stored in two 128-bit registers, where H corresponds to the 8 words with odd subscripts and L corresponds to the 8 words with even subscripts, that is:

[0077] H=(a 15 ,…,a3,a1)

[0078] L=(a 14,…,a2,a0)

[0079] Define α7,…,α0 as the roots of 16th-order irreducible polynomials g7(y),…,g0(y) respectively. Where g7,…,g0 are defined as follows:

[0080]

[0081] definition

[0082] C=(α7,…,α1,α0)

[0083] The operation λ can be defined according to C C : for:

[0084]

[0085] Define the permutation σ: for:

[0086]

[0087] Define the function f: for:

[0088]

[0089] H and L at time t≥0 can be expressed as follows:

[0090]

[0091] The original algorithm updates the entire H in each round, and the update function of LFSR can be expressed as

[0092]

[0093] The following is an introduction to the NFSR component. The NFSR consists of a 128-bit register. Each round of the primitive algorithm will call The function updates the state N. And the L of the LFSR is XORed with the updated N. Therefore, the update function of the NFSR at time t≥0 can be expressed as:

[0094]

[0095] The update function of the primitive algorithm is:

[0096] Key stream generation phase (t≥0)

[0097] 1. Calculate intermediate variables:

[0098]

[0099] F t=f(H t ,L t )

[0100] 2. Calculate the output:

[0101]

[0102] 3. Update source:

[0103]

[0104] H t+1 =F t

[0105] L t+1 =H t

[0106] 4. Update FSM:

[0107]

[0108] The overall schematic diagram is as follows Figure 7 As shown:

[0109] Initialization phase (Round load ≤t≤0 time)

[0110] 1. Calculate intermediate variables:

[0111]

[0112] F t =f(H t ,L t )

[0113] 2. Calculate output (not output, used to update the source):

[0114]

[0115] 3. Update source: Z t Used to update N and H, initialize the last round (i.e.: t = -1 time) and reload the 128-bit key information K h .

[0116]

[0117] L t+1 =H t

[0118]

[0119] 4. Update FSM:

[0120]

[0121] The overall schematic diagram is as follows Figure 8 According to the security analysis results, the initial number of rounds of this primitive algorithm is 12, which is the parameter Round in the description of the initialization phase. load The value is -12.

[0122] The loading scheme of the original algorithm is: the 256-bit key is divided into two 128-bit words, that is, K = (K h ,K l ); record the 128-bit IV as 128-bit word IV. At t = Round load At this moment, the key and IV are loaded, and the LFSR and NFSR states are set to a constant 0.

[0123]

[0124] H t =L t =N t =0

[0125] The initialization process uses FP(1)-mode, that is, at time t = -1, the key K = (K h ,K l ) to status and H t .

[0126] Example 2: Extended Algorithm (256 bits output per round)

[0127] The extended algorithm supports 256-bit keys and 256-bit IVs. The internal state of the extended algorithm has a total of 1280 bits of state, which is stored in 10 128-bit registers. H0, L0 and H1, L1 are two 256-bit LFSR states connected end to end and fed back to each other, forming a 512-bit LFSR with a period of 2 512 -1. N0 and N1 are both 128-bit NFSR states, and the feedback function is S0, S1, S2, S3 constitute the FSM memory, which is equivalent to using the FSM connector with n1=2, n2=2, without using the FSM plug-in, and connecting them in parallel The function is updated. In general, corresponding to the LOL dual-machine structure, H0, L0, N0, S0, S1, and H1, L1, N1, S2, S3 respectively constitute the LOL single-machine structure. Each single-machine structure extracts the nonlinear source and the 128-bit state of the FSM for XOR and outputs it. The overall output is 256-bit key stream words per round. The cascade of H0 and H1 constitutes a 256-bit register H = (H1, H0), and the cascade of L0 and L1 constitutes a 256-bit register L = (L1, L0).

[0128] First, let's introduce LFSR. The LFSR of the extended algorithm consists of 32 16-bit words, denoted as: a0, ..., a 31 These 32 words are stored in two 256-bit registers H and L according to the parity of the subscript digits, and H and L are divided into four 128-bit registers H0, H1, L0, L1 according to the high and low points, namely:

[0129] H=(H1,H0)=(a 31 ,…,a 17 ,a 15 ,…,a1)

[0130] L=(L1,L0)=(a 30 ,…,a 16 ,a 14 ,…,a0)

[0131] Define α0,…,α 15 is an irreducible polynomial g0(y),…,g 15 The roots of (y), where g0,…,g7 are defined as, g8,…,g 15 is defined as.

[0132]

[0133] definition

[0134] C=(α 15 ,…,α0)

[0135] The operation λ can be defined according to C C : for:

[0136]

[0137] Obviously, λ in C Yes and two A parallel combination of the above maps, where Acts on the lower 128 bits (x7,…,x0), Acts on the upper 128 bits (x 15 ,…,x8). It is worth noting that according to the definition of α0,…,α7, Compared with the original algorithm C The definition of is exactly the same, so this part of the circuit can be reused in hardware implementation.

[0138]

[0139] Define the permutation σ: for:

[0140]

[0141] Define the function f: for:

[0142]

[0143] H and L at time t≥0 can be expressed as follows:

[0144]

[0145] The extended algorithm updates the entire H in each round, and the update function of LFSR can be expressed as:

[0146]

[0147] With the definition of L and H, the overall structure of the LFSR of the extended algorithm is similar to that of the original algorithm.

[0148] The following is the NFSR part. The NFSR part consists of two 128-bit NFSRs, denoted as N0 and N1. Each round of the extended algorithm calls one The function updates N0 and N1 respectively. And the L0 and L1 of LFSR are XORed with the updated N0 and N1. Therefore, the update function of NFSR at time t≥0 can be expressed as:

[0149]

[0150] Update function of the extended algorithm:

[0151] Key stream generation phase (t≥0)

[0152] 1. Calculate intermediate variables

[0153]

[0154] 2. Calculate the output: Each time the output 256-bit key stream block is That is: Z0 is in the upper 128 bits and Z1 is in the lower 128 bits.

[0155]

[0156] 3. Update source:

[0157]

[0158] 4. Update FSM:

[0159]

[0160] The overall schematic diagram is as follows Fig. 9 As shown:

[0161] Initialization phase (round load ≤t<0 moment)

[0162] 1. Calculate intermediate variables:

[0163]

[0164] 2. Calculate output (not output, used to update the source):

[0165]

[0166] 3. Update source:

[0167]

[0168] 4. Update FSM:

[0169]

[0170] The overall schematic diagram is as follows Fig.10 According to the security analysis results, the initial round number of the extended algorithm is 12 rounds, that is, the parameter Round load The value is -12.

[0171] Loading scheme of the extended algorithm: Divide the 256-bit key into two 128-bit words, that is, K = (K h ,K l ); Divide the 256-bit IV into two 128-bit words, i.e., IV = (IV h ,IV l ). At t = Round load At this moment, the key and IV are loaded, and the LFSR and NFSR states are set to a constant 0.

[0172]

[0173] H0=L0=H1=L1=N0=N1=0

[0174] The initialization process uses FP(1)-mode, that is, at time t = -1, the key K = (K h ,K l ) to status and

[0175] To illustrate the advantages of the present invention, the security analysis of two embodiments of the present invention is given below: Both the original algorithm and the extended algorithm provide 256-bit security and can resist the following mainstream attack methods.

[0176] 1. Security Analysis of the Primitive Algorithm

[0177] Linear source period analysis: It can be proven that it has a maximum period, which is 2 256 -1.

[0178] Initialization full diffusion rounds: For the initialization phase, test how many rounds of initialization iterations each bit state can go through to affect all internal state bits; the number of rounds required for each bit to achieve full diffusion is 4-5 rounds.

[0179] Selected IV attack under related keys: In the initialization phase, differentials are injected into the key and IV loading positions to evaluate the lower bound of the number of active S-boxes in each round and the upper bound of the differential propagation probability; after 6 rounds of initialization, 48 differentially active S-boxes are generated.

[0180] Correlation analysis: For the key stream generation stage, the upper bound of the linear deviation is evaluated by calculating the lower bound of the number of active S-boxes; at least 4 output blocks are required to construct a linear correlation distinguisher, which will generate at least 83 linear active S-boxes, and the upper bound of the linear deviation is 2 -6×83 =2 -498 .

[0181] Guess determination analysis: For the key stream generation phase, restore the internal state at a certain moment: guess at least 3 128-bit words, the attack complexity is 2 384 , requiring three 128-bit keystream words.

[0182] TMD-TO analysis: Recover the internal state or key at a certain moment; when applied to reconstruct the internal state, the complexity exceeds the complexity of exhaustive search; when applied to recover the key, there is a trivial attack (|IV|<|K|).

[0183] Cubic and Algebraic Attacks: Since multiple AES S-boxes are used, cubic and algebraic attacks are not applicable.

[0184] Sliding attack: The FP(1)-mode is used in the initialization phase to naturally resist sliding attacks.

[0185] 2. Security Analysis of the Extension Algorithm

[0186] Linear source period analysis: It can be proven that it has a maximum period, which is 2 512 -1.

[0187] Initialize the number of full diffusion rounds: The number of rounds required to achieve full diffusion for each bit is 5-6 rounds.

[0188] Selected IV attack under related keys: 52 differentially active S-boxes are generated after 6 rounds of initialization.

[0189] Correlation analysis: Three 256-bit output blocks are required to construct a linear correlation discriminator, which will generate at least 99 linearly active S-boxes, and the upper bound of the linear deviation is 2 -594 .

[0190] Guess determination analysis: For the key stream generation phase, restore the internal state at a certain moment: guess at least 4 128-bit words, the attack complexity is 2 512 , requiring four 128-bit keystream words.

[0191] TMD-TO analysis: Whether applied to reconstructing internal states or directly recovering keys, the complexity exceeds the exhaustive search complexity.

[0192] Cubic and Algebraic Attacks: Since multiple AES S-boxes are used, cubic and algebraic attacks are not applicable.

[0193] Sliding attack: The FP(1)-mode is used in the initialization phase to naturally resist sliding attacks.

[0194] It can be seen that the original algorithm and the extended algorithm have higher ability to resist linear correlation attacks than the SNOW-V and SNOW-Vi algorithms.

[0195] The software efficiency of two embodiments of the present invention is given below.

[0196] The original algorithm and the extended algorithm were tested on a desktop computer with CPU Intel i7-6700 3.40GHz, RAM: 4.00GB, Windows 10 operating system, and VS2019 native compiler as the test environment. The test method is to let the above algorithm encrypt messages of different lengths (single thread) and calculate the encryption efficiency in Gbps. The test code uses AVX, AVX2, and AES-NI instruction sets. The achieved rates are shown in Table 1.

[0197] Table 1

[0198]

[0199]

[0200] In Table 1, the location where each algorithm first achieves 20 Gbps encryption efficiency is shown in bold.

[0201] It can be seen that the original algorithm and the extended algorithm have higher encryption efficiency than the SNOW-V and SNOW-Vi algorithms.

[0202] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Those skilled in the art may make some simple modifications, equivalent changes or modifications using the technical contents disclosed above, which all fall within the protection scope of the present invention.

Claims

1. A software-oriented, high-speed, scalable sequence password generation device, characterized in that: The device comprises: a linear feedback shift register LFSR, a nonlinear feedback shift register NFSR, a finite automaton FSM, a primitive algorithm module, and a parallel expansion algorithm module, wherein the FSM comprises a connector and a plug-in; The original algorithm module adopts a combination structure of nonlinear source and FSM with memory, in which the nonlinear source adopts the form of LFSR in series with NFSR. FSM uses two types of components, connectors and plug-ins, to quickly realize nonlinear scrambling by using parallel nonlinear functions R. The nonlinear source and FSM adopt a combination of head feedback and tail output. The parallel expansion algorithm module is to connect the LFSR parts of multiple nonlinear sources end to end into a circle to form an extended nonlinear source with a longer period, connect the connectors of multiple FSMs end to end into a circle to form an extended FSM with a larger state, and output a longer key stream each time by correspondingly combining the extended nonlinear source with the FSM in the original head feedback and tail output mode; The sequence cipher generation device is divided into an initialization phase and a key stream generation phase. For the initialization phase, a method of loading the key and initial vector IV into the FSM state is proposed, which is conducive to rapid diffusion. For the key stream generation phase, an update scheme of simultaneously feeding back the key stream to the LFSR and NFSR and a key usage method of using FP(1)-mode in the last round are proposed. Nonlinear sources can take into account both long periods and nonlinearity; The LFSR adopts an odd-even structure on a finite field. The storage value in each LFSR is used to update the odd-numbered storage unit of the LFSR after the operation result of the update function f. It is also used as the input of the FSM. The original odd-numbered storage unit value is assigned to the even-numbered storage unit. The original even-numbered storage unit value is used as the output of the LFSR for updating the NFSR. The LFSR base is a 256-bit register, which is suitable for parallel and fast implementation of the AVX extended instruction set. It has a provable maximum periodicity and a wide range of parameter selection, which can support algorithm expansion. The NFSR uses a 128-bit register, and the feedback function directly uses function R. The storage value in each beat of the NFSR is XORed with the operation result of function R and the output of the LFSR to update the storage unit of the NFSR. The original NFSR storage unit value is used as the output of the nonlinear source to generate the key stream.

2. The stream password generating device according to claim 1, characterized in that: Connecting FSM with memory through nonlinear sources can effectively resist correlation attacks; The connector of FSM is used to connect the nonlinear source at both ends of FSM. At the head end of FSM, the operation result of function f is XORed with the state of the head end and the state of the tail end of FSM through the operation result of function R, which is used as the update of the state of the head end of FSM. At the tail end of FSM, the state of the tail end is XORed with the output of the nonlinear source through the operation result of function R, which is used as the key stream output at this moment. The FSM plug-in is used in the middle of the FSM and can be added or deleted according to the needs of security and efficiency. The update of the FSM plug-in is the result of the operation of the function R on the plug-in state XOR and its previous state.

3. The stream password generating device according to claim 1, characterized in that: The device supports at least 256-bit keys.

4. The stream password generating device according to claim 1, characterized in that: The device outputs a key stream based on 128 bits.

5. The stream password generating device according to claim 1, characterized in that: The primitive algorithm module supports 256-bit keys and 128-bit IVs, outputs 128-bit key stream blocks, supports 256-bit security, and selects the AES round function as the function R in the primitive algorithm module; LFSR is defined over a finite field There are 16 16-bit registers in total, and the update function is: F t =f(H t ,L t ) H t+1 =F t L t+1 =H t Among them, H t Indicates the value of the word with an odd subscript in the LFSR at time t, L t represents the value of the word with an even subscript in the LFSR at time t, f represents the update function of the LFSR, F t represents the feedback of LFSR at time t; The update function of NFSR at time t≥0 is: Among them, N t represents the state of NFSR at time t, represents the function R; The memory states of FSM are S0, S1, S2, and the update of FSM at time t≥0 is in, represents the state of FSM at time t, G t Represents the intermediate variable at time t; The key stream output at time t≥0 is Where Z t Indicates the 128-bit key stream output at time t.

6. The stream password generating device according to claim 5, characterized in that: The original algorithm module is in the initialization process Round load ≤t<0, key stream Z t No output, used to update the nonlinear source and reload the key to the LFSR and FSM states in the last round of initialization. Among them, Round load is the number of initialization rounds, (K h ,K l ) is a 256-bit key, K h and K l They are 128-bit words respectively; The key loading scheme is t=Round load , H t =0,L t =0,N t =0 Where IV is a 128-bit initialization vector.

7. The stream password generating device according to claim 1, characterized in that: The parallel expansion algorithm module supports 256-bit keys and 256-bit IVs, outputs 256-bit key stream blocks, supports 256-bit security, selects the AES round function as function R, the nonlinear source includes two groups of LFSRs, two groups of NFSRs, and the FSM includes two groups of connectors; LFSR is defined over a finite field In the above figure, two 256-bit LFSRs are connected end to end and feedback each other to form a 512-bit LFSR. The update function is: in, Indicates the value of the word with an odd subscript in the first group of LFSR at time t, Indicates the value of the word with an even subscript in the first group of LFSR at time t, Indicates the value of the word with an odd subscript in the second group of LFSR at time t, represents the value of the word with an even subscript in the second group of LFSR at time t, and f represents the update function of the entire LFSR. represents the feedback of the overall LFSR at time t; The update function of NFSR at time t≥0 is: in, represents the state of the first group of NFSR at time t, represents the state of the second group of NFSR at time t, Represents function R, i.e., AES round function; The memory states of FSM are S0, S1, S2, S3, and the update of FSM at time t≥0 is in, represents the state of FSM at time t, Represents the intermediate variable at time t; The key stream word output at time t≥0 is in Represents the 256-bit key stream word output at time t.

8. The stream password generating device according to claim 7, characterized in that: The parallel expansion algorithm module is in the initialization process Round load ≤t<0, key stream word Z t No output, used to update the nonlinear source and reload the key to the LFSR state in the last round of initialization. Round load is the number of initialization rounds, (K h ,K l ) is a 256-bit key, K h and K l They are 128-bit words respectively; The key loading scheme is t=Round load , H0=0, L0=0, H1=0, L1=0, N0=0, N1=0. Where (IV h ,IV l ) is a 256-bit initial vector.

Images