Parallelized, Scalable Linear Feedback Shift Register

Abstract

The present invention provides a parallelized and scalable linear feedback shift register. The register is defined in a finite field GF(2 m ), including: n = 2 × k register units, the register units include: even-numbered register units #imgabs0# and odd-numbered register units #imgabs1#, and the odd-numbered register units store values ​​#imgabs2# and k irreducible polynomials g k‑1 (x),…,the root (α k‑1 ,…,α0) is XORed with the permutation σ of the stored value #imgabs3# in the even-numbered register unit, and the result is used as the stored value #imgabs4# in the odd-numbered register unit at the next moment. The stored value #imgabs5# in the odd-numbered register unit at the previous moment is used as the stored value #imgabs6# in the even-numbered register unit at the next moment. The linear feedback shift register provided by the present invention is highly parallelizable and efficient, and is particularly suitable for software implementation in modern CPUs that support vector calculations.

Description

Technical Field

[0001] The invention relates to the technical field of sequence ciphers, and in particular to a parallelized and expandable linear feedback shift register. Background Art

[0002] As people's demand for fast software-implemented cryptographic algorithms becomes increasingly strong, word-based design methods are gradually being widely adopted by designers of serial ciphers. Linear Feedback Shift Register (LFSR) is usually used as a driving component of a serial cipher and is the core component of a serial cipher algorithm. Serial ciphers for software implementation usually require word-based LFSR design. In recent years, the cryptography community has proposed a series of word-based LFSR designs.

[0003] LFSR mainly consists of two parts, namely shift register and linear feedback logic. The word-based LFSR consists of n serially connected registers a0,…,a n-1 Each register stores an m-bit word a i =(a i,m-1 ,…,a i,0 ), usually defined over a finite field F q In the above, q can be a prime number or a power of 2. LFSR is divided into Fibonacci mode and Galois mode according to linear feedback logic ( Figure 1 , Figure 2 ), where the Fibonacci pattern shifts n serial registers rightward by one unit at each moment, and the new leftmost state unit is obtained according to the linear operation of other units in the register. If the configuration information c i ≠0, then the corresponding register a i is the feedback tap, indicating a i Participate in linear feedback logic; and each register state update of the Galois mode can be generated by the corresponding state extraction configuration and linear operation, and then shifted right by one unit as a whole; there is a certain conversion relationship between the two.

[0004] The LFSR sequence that reaches the maximum period is the most needed in cryptographic research, that is, the update function of the LFSR sequence is primitive.

[0005] The LFSR design used in existing sequence ciphers is usually a Fibonacci pattern, which often updates m bits each time. For example, in the LFSR design over a finite field characterized by 2, let the element in the LFSR at time t be To calculate the element in the LFSR at time t+1 You need to do the following two steps:

[0006] 1. Call the feedback function f to calculate the m-bit word Right now:

[0007]

[0008] 2. All n registers are shifted from high to low and the newly generated Fill to the highest position, that is:

[0009]

[0010] where c i ·a i The finite field GF(2 m ) multiplication operation. Each GF(2 m ) is a primitive polynomial of degree m g(x)=x on the polynomial ring F2[x] m +b m-1 x m-1 +…+b0 definition, that is: GF(2 m )=F2[x] / g(x). i ·a i Medium i The value of is usually 0, 1, α, α -1 , where α represents the root of g(x). i =0, c i ·a i =0; when c i =1, c i ·a i =a i ; When c i =α,

[0011]

[0012] When c i =α -1 hour,

[0013]

[0014] Current LFSRs often update each register sequentially, with all c i a i The finite field GF(2 m )=F2[X] / g(x) often use the same definition of g(x), with low parallelization degree and update efficiency, and slow speed. Modern CPUs generally introduce highly parallel vector operation instructions (such as AVX, AVX2, SSE, etc.), and existing LFSRs are difficult to give full play to the speed advantage of such instructions.

[0015] On the other hand, the high complexity of parallelizing large-bit words in a sequential update manner limits the theoretical design from a construction perspective, and the available tap resources are not abundant from a search perspective. Summary of the invention

[0016] The technical problem to be solved by the present invention is to provide a parallelized and scalable linear feedback shift register which is highly parallelizable and efficient and is particularly suitable for software implementation of modern CPUs supporting vector calculations.

[0017] In order to solve the above technical problems, the present invention provides a parallel and scalable linear feedback shift register, which is defined in a finite field GF(2 m ), based on a unit word length of m bits, the register includes: n=2×k register units, the register units include: even-numbered register units and odd numbered register units The value stored in the odd-numbered register unit and k irreducible polynomials g k-1 (x),…,the root (α k-1 ,…,α0) and the value stored in the even-numbered register unit The result is used as the storage value in the odd-numbered storage unit at the next moment. The value stored in the odd-numbered register at the previous moment As the register value in the even-numbered register unit at the next moment

[0018] The update function of the present invention at time t The specific definitions are as follows:

[0019]

[0020] in, represents the storage value of the even-numbered storage unit at time t, Indicates the storage value of the even-numbered storage unit at time t+1, represents the storage value of the odd-numbered storage unit at time t, represents the storage value of the odd-numbered storage unit at time t+1, represents the roots of k irreducible polynomials The vector is composed of roots, × represents the finite field multiplication of the corresponding components of two vectors, and σ represents vector permutation.

[0021] The above update function is a Feistel-like structure, updating half of the state each time Output half state As a LFSR sequence.

[0022] The present invention can prove that the maximum period 2 nm -1. The proof method is to first derive the generator matrix of the register, which has the following form

[0023]

[0024] Where I is the unit matrix, M σ is the shift matrix corresponding to the permutation σ (composed of the m-dimensional all-zero matrix 0 m and the m-dimensional unit matrix I 16 ), M C is the block diagonal matrix corresponding to the irreducible polynomial

[0025]

[0026] The diagonal elements are That corresponds to the irreducible polynomial g i (y) = y m +b i,m-1 y m-1 +…+b i,1 y+b i,0 ∈F2[y] matrix:

[0027]

[0028] Furthermore, mathematical tools are used to obtain the characteristic polynomial of G, and it is verified whether the characteristic polynomial is a primitive polynomial, thereby verifying that the present invention has the maximum period.

[0029] After adopting such a design, the present invention has at least the following advantages:

[0030] A general design method for large-period Galois-type LFSR over finite fields is proposed. This type of design option is resource-rich and easy to quickly verify the maximum period characteristics. The proposed Feistel-like structure has extremely high software implementation efficiency and can greatly improve the practicality of LFSR on modern CPUs. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The above is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0032] Figure 1 It is a schematic diagram of the principle of Fibonacci mode LFSR;

[0033] Figure 2 It is a schematic diagram of the principle of Galois mode LFSR;

[0034] Figure 3 This is a schematic diagram of the principle of the Feistel-like update function of the LFSR;

[0035] Figure 4 It is a schematic diagram of the overall structure of LFSR. DETAILED DESCRIPTION

[0036] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0037] In recent years, many new processors from Intel and ARM have the ability to process large integer vectors (such as the AVX advanced vector extension instruction set from Intel). The present invention combines the instruction structure of modern computers and proposes a highly parallel LFSR design scheme. The LFSR designed according to this scheme is highly parallelizable and efficient, and is particularly suitable for software implementation of modern CPUs that support vector calculations.

[0038] The LFSR of the present invention has the following characteristics:

[0039] 1. Linear drive on a limited extension domain, based on a unit word length of m bits; using multiple different The units are updated in parallel by multiplication over the field and XOR-connected through the polynomial basis correspondence.

[0040] 2. Adoption Figure 3 The Feistel-like update function shown in Figure 2 requires that the number of registers in the LFSR is an even number, that is, n = 2k, and half of the states are updated at a time. In simple terms, the states of the LFSR are divided into and Two parts; definition (α k-1 ,…,α0) are k irreducible polynomials of degree m g k-1 (x),…,the roots of g0(x), define Define the operation of two vectors × as the corresponding multiplication of each component, that is, (x k-1 ,…,x0)×(y k-1 ,…,y0)=(x k-1 ·y k-1 ,…,x0·y0), where · is finite field multiplication; define (x k-1 ,…,x0), the update function f of LFSR at time t can be expressed as:

[0041]

[0042] In this way, the update method of the entire LFSR constitutes a Feistel structure, which can ensure that all The components can be realized by first left shift and then XOR, and the σ and × operations can be performed in parallel.

[0043] 3. Output half of the state each time As a LFSR sequence.

[0044] 4. Satisfy the maximum period: As long as the above structure selects the appropriate irreducible polynomial and permutation σ, it can ensure that the characteristic polynomial of the generated matrix is ​​a primitive polynomial, and then determine that the period of the LFSR is 2 nm -1.

[0045] 5. The application of advanced instruction sets such as AVX for parallel and rapid implementation can greatly improve the practicality of LFSR on modern CPUs.

[0046] 6. Large cycle and high throughput, using a base 256-bit register and outputting at least 128 bits each time.

[0047] 7. A general design method for large-period Galois-type LFSRs over finite fields. There are abundant resources for such design options.

[0048] To embody the above characteristics and advantages of the present invention, two embodiments are given below.

[0049] Example 1

[0050] When m=16 and k=8, the LFSR is defined in a finite field. There are 16 16-bit registers in total, denoted as: a0,…,a 15 These 16 registers are stored in two 128-bit registers, where H corresponds to the 8 words with odd subscripts and L corresponds to the 8 words with even subscripts, that is:

[0051] H=(a 15 ,…,a3,a1)

[0052] L=(a 14 ,…,a4,a2)

[0053] Define α0,…,α7 as the roots of 16th-degree irreducible polynomials g0(x),…,g7(x) respectively. Where g0,…,g7 are defined as follows:

[0054]

[0055] definition but Define the permutation σ: for:

[0056]

[0057] H and L at time t≥0 can be expressed as follows:

[0058]

[0059] The entire H is updated in each round, and the update function of LFSR is It can be expressed as

[0060]

[0061] The connection diagram of LFSR is as follows Figure 4 shown.

[0062] Proof: The period of LFSR is τ = 2 256 -1.

[0063] First, derive the generator matrix of LFSR. According to the formula,

[0064]

[0065] Among them, the generator matrix G is:

[0066]

[0067] I i is the i×i unit matrix, M σ is the matrix corresponding to the σ shift

[0068]

[0069] M C is the following block diagonal matrix:

[0070]

[0071] The primitive polynomial g i (x) is expressed as follows:

[0072] g i (x) = x 16 +b i,15 x 15 +…+b i,1 x+b i,0 ∈F2[x]

[0073] Due to α i Yes i The root of (x) is Constitute a set of finite fields The base of.

[0074] For 16-bit unit a 2i+1 =(ai,15 ,…,a i,1 ,a i,0 ), can be written in polynomial form:

[0075]

[0076] for

[0077]

[0078] but The definition of is:

[0079]

[0080] Using mathematical tools, we can find the characteristic polynomial of G as follows:

[0081] η 256 (x) = x 256 +x 252 +x 251 +x 250 +x 246 +x 245 +x 242 +x 241 +x 238 +x 234 +x 229 +x 227 +x 225 +x 222 +x 220 +x 219 +x 217 +x 215 +x 214 +x 213 +x 212 +x 211 +x 210 +x 208 +x 207 +x 204 +x 203 +x 198 +x 196 +x 194 +x 191 +x 186 +x 185 +x 184 +x 183 +x 182 +x 179 +x 178 +x 177 +x 175 +x 170 +x 168 +x 167 +x 166 +x165 +x 161 +x 160 +x 157 +x 154 +x 153 +x 152 +x 151 +x 150 +x 148 +x 147 +x 146 +x 145 +x 144 +x 141 +x 140 +x 139 +x 138 +x 134 +x 133 +x 131 +x 130 +x 126 +x 123 +x 122 +x 121 +x 119 +x 118 +x 116 +x 115 +x 113 +x 110 +x 109 +x 108 +x 107 +x 104 +x 103 +x 102 +x 101 +x 100 +x 98 +x 97 +x 94 +x 93 +x 92 +x 89 +x 88 +x 86 +x 84 +x 83 +x 82 +x 81 +x 80 +x 79 +x 78 +x 77 +x 76 +x 74 +x 72 +x 71 +x 70 +x 69 +x 67 +x 66 +x 65 +x 63 +x 62+x 61 +x 60 +x 56 +x 53 +x 52 +x 51 +x 50 +x 48 +x 47 +x 44 +x 42 +x 39 +x 38 +x 37 +x 34 +x 32 +x 31 +x 30 +x 29 +x 28 +x 26 +x 25 +x 24 +x 21 +x 20 +x 9 +x 8 +1

[0082] Proven 256 (x) is a primitive polynomial, which ensures that the period of the generated LFSR is 2 256 -1.

[0083] Example 2

[0084] When m=16, k=16, the LFSR consists of 32 16-bit words, denoted as: a0,…,a 31 .

[0085] These 32 words are stored in two 256-bit registers, H and L, according to the parity of the subscript digits, namely:

[0086] H=(a 31 ,…,a 17 ,a 15 ,…,a1)

[0087] L=(a 30 ,…,a 16 ,a 14 ,…,a0)

[0088] Define α0,…,α 15 is an irreducible polynomial g0(x),…,g 15 The roots of (x), where g0,…,g7 are defined as, g8,…,g 15 is defined as.

[0089]

[0090] definition but Define the permutation σ: for:

[0091]

[0092] H and L at time t≥0 can be expressed as follows:

[0093]

[0094] The entire H is updated in each round, and the update function of LFSR is It can be expressed as

[0095]

[0096]

[0097]

[0098] Prove that the period of LFSR is τ = 2 512 -1.

[0099] Its generator matrix G can be expressed as:

[0100]

[0101] The scale is 512×512, and the corresponding relationship of each element is as described in Example 1. The characteristic polynomial of G is

[0102] η 512 =x 512 +x 511 +x 510 +x 509 +x 505 +x 504 +x 501 +x 500 +x 499 +x 498 +x 497 +x 495 +x 494 +x 492 +x 488 +x 486 +x 483 +x 482 +x 481 +x 479 +x 477 +x 476 +x 475 +x 474 +x 472 +x 471 +x 470 +x466 +x 464 +x 461 +x 460 +x 457 +x 455 +x 454 +x 452 +x 449 +x 448 +x 442 +x 441 +x 440 +x 439 +x 437 +x 435 +x 432 +x 429 +x 426 +x 425 +x 424 +x 423 +x 422 +x 421 +x 420 +x 419 +x 417 +x 416 +x 414 +x 411 +x 410 +x 408 +x 407 +x 405 +x 403 +x 400 +x 396 +x 393 +x 390 +x 389 +x 388 +x 386 +x 381 +x 379 +x 378 +x 377 +x 374 +x 372 +x 369 +x 368 +x 367 +x 360 +x 358 +x 357 +x 355 +x 354 +x 349 +x 346 +x 344 +x 343 +x 341 +x 338 +x 337 +x 336 +x 335 +x 334 +x 333+x 331 +x 330 +x 328 +x 325 +x 324 +x 322 +x 319 +x 318 +x 316 +x 315 +x 312 +x 309 +x 307 +x 304 +x 302 +x 300 +x 297 +x 295 +x 293 +x 292 +x 291 +x 290 +x 285 +x 284 +x 283 +x 280 +x 276 +x 268 +x 267 +x 263 +x 258 +x 257 +x 255 +x 254 +x 252 +x 249 +x 248 +x 245 +x 242 +x 241 +x 240 +x 236 +x 234 +x 232 +x 231 +x 230 +x 227 +x 226 +x 224 +x 219 +x 210 +x 209 +x 207 +x 206 +x 205 +x 203 +x 200 +x 197 +x 196 +x 193 +x 188 +x 187 +x 186 +x 184 +x 180 +x 173 +x172 +x 171 +x 167 +x 166 +x 162 +x 160 +x 159 +x 157 +x 155 +x 151 +x 150 +x 149 +x 147 +x 146 +x 145 +x 144 +x 143 +x 137 +x 134 +x 133 +x 127 +x 126 +x 125 +x 124 +x 123 +x 118 +x 116 +x 115 +x 112 +x 111 +x 109 +x 108 +x 103 +x 102 +x 101 +x 100 +x 99 +x 98 +x 95 +x 94 +x 92 +x 91 +x 90 +x 86 +x 84 +x 81 +x 80 +x 79 +x 78 +x 72 +x 69 +x 68 +x 65 +x 63 +x 62 +x 61 +x 60 +x 58 +x 57 +x 55 +x 54 +x 52 +x 51 +x 49 +x 46 +x 41 +x 40+x 39 +x 38 +x 37 +x 35 +x 31 +x 30 +x 29 +x 27 +x 25 +x 23 +x 22 +x 20 +x 18 +x 17 +x 16 +1

[0103] Proven 512 (x) is a primitive polynomial, which ensures that the period of the LFSR is 2 512 -1.

[0104] The key points of the technical solution of the present invention are:

[0105] The Feistel-like update method of LFSR includes the overall structure of LFSR. Definition of σ and their relationship to the LFSR update function f.

[0106] The maximum period proof method of LFSR is to XOR the updated states on different domains through the correspondence between polynomial bases, and finally use the minimal polynomial of the update matrix to determine the period of LFSR.

[0107] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Those skilled in the art may make some simple modifications, equivalent changes or modifications using the technical contents disclosed above, which all fall within the protection scope of the present invention.

Claims

1. A parallelized and scalable linear feedback shift register, characterized in that: 1) Odd-even structure and Feistel-like updating method of Galois-type linear feedback shift register over finite field; defined over finite field The above comprises: n=2×k register units, the register units comprising: even numbered register units and odd numbered register units The value stored in the odd-numbered register unit and k irreducible polynomials g of degree m k-1 (x),…,the root (α k-1 ,…,a0) and the value stored in the even-numbered register unit. The result is used as the storage value in the odd-numbered storage unit at the next moment. The value stored in the odd-numbered register at the previous moment As the register value in the even-numbered register unit at the next moment Update function at time t for: in, represents the storage value of the even-numbered storage unit at time t, Represents the storage value of the even-numbered storage unit at time t+1, represents the storage value of the odd-numbered storage unit at time t, represents the storage value of the odd-numbered storage unit at time t+1, represents a vector consisting of the roots of k irreducible polynomials, × represents the finite field multiplication of the corresponding components of two vectors, and σ represents vector permutation; Use a Feistel-like update function to update half of the state each time Output half state As a LFSR sequence; Use multiple extended domain multiplications to update each unit in parallel and connect them through polynomial basis correspondences; Support all The components are implemented by left shift followed by XOR, which supports parallel execution of σ and × operations; 2) A maximum period proof method based on the characteristic polynomial of the generator matrix includes: selecting appropriate irreducible polynomials and permutations to prove that the register has a maximum period, and the proof method is: deriving the generator matrix of the register according to the linear feedback shift register update function, and verifying that the characteristic polynomial of the generator matrix is ​​a primitive polynomial; 3) Software-oriented parallel implementation solution.

2. The linear feedback shift register according to claim 1, wherein: When m=16 and k=8, the irreducible polynomial is: g0(x)=x 16 +x 13 +x 12 +x 10 +x 8 +x 7 +x 6 +x 3 +1 g1(x)=x 16 +x 15 +x 12 +x 10 +x 8 +x 5 +x 3 +x+1 g2(x)=x 16 +x 15 +x 14 +x 12 +x 10 +x 7 +x 5 +x 4 +1 g3(x)=x 16 +x 14 +x 11 +x 9 +x 7 +x 5 +x 4 +x 2 +1 g4(x)=x 16 +x 15 +x 13 +x 9 +x 7 +x 4 +1 g5(x)=x 16 +x 14 +x 13 +x 12 +x 11 +x 10 +x 9 +x 7 +x 6 +x 5 +x 3 +x 2 +1 g6(x)=x 16 +x 15 +x 13 +x 9 +x 8 +x 4 +x 3 +x+1 g7(x)=x 16 +x 14 +x 13 +x 12 +x 11 +x 10 +x 7 +x 5 +1 Define the permutation σ: for: The generated matrix is: Among them, I 128 is a 128×128 unit matrix, M σ is the shift matrix corresponding to the permutation σ, M C is a block diagonal matrix corresponding to the irreducible polynomials g0,...,g7; the characteristic polynomial of the generator matrix G is a 256th-order primitive polynomial, and the defined linear feedback shift register has a maximum period of 2 256 -1.

3. The linear feedback shift register according to claim 1, wherein: When m=16, k=16, the irreducible polynomial is: g0(x)=x 16 +x 13 +x 12 +x 10 +x 8 +x 7 +x 6 +x 3 +1 g1(x)=x 16 +x 15 +x 12 +x 10 +x 8 +x 5 +x 3 +x+1 g2(x)=x 16 +x 15 +x 14 +x 12 +x 10 +x 7 +x 5 +x 4 +1 g3(x)=x 16 +x 14 +x 11 +x 9 +x 7 +x 5 +x 4 +x 2 +1 g4(x)=x 16 +x 15 +x 13 +x 9 +x 7 +x 4 +1 g5(x)=x 16 +x 14 +x 13 +x 12 +x 11 +x 10 +x 9 +x 7 +x 6 +x 5 +x 3 +x 2 +1 g6(x)=x 16 +x 15 +x 13 +x 9 +x 8 +x 4 +x 3 +x+1 g7(x)=x 16 +x 14 +x 13 +x 12 +x 11 +x 10 +x 7 +x 5 +1 g8(x)=x 16 +x 15 +x 14 +x 10 +x 8 +x 6 +x 4 +x+1 g9(x)=x 16 +x 14 +x 13 +x 12 +x 11 +x 10 +x 8 +x 7 +x 6 +x 2 +1 g 10 (x)=x 16 +x 11 +x 10 +x 8 +x 7 +x+1 g 11 (x)=x 16 +x 15 +x 13 +x 12 +x 9 +x 7 +x 6 +x 5 +x 3 +x+1 g 12 (x)=x 16 +x 15 +x 14 +x 12 +x 10 +x 8 +x 5 +x 3 +x 2 +x+1 g 13 (x)=x 16 +x 15 +x 12 +x 11 +x 10 +x 9 +x 8 +x 7 +x 5 +x 4 +x 2 +x+1 g 14 (x)=x 16 +x 14 +x 10 +x 7 +x 6 +x 5 +1 g 15 (x)=x 16 +x 15 +x 14 +x 13 +x 12 +x 6 +x 5 +x 3 +1 Define the permutation σ: for: The generated matrix is: Among them, I 256 is a 256×256 unit matrix, M σ is the shift matrix corresponding to the permutation σ, M C is the irreducible polynomial corresponding to g0,...,g 15 The characteristic polynomial of the generator matrix G is a 512th-order primitive polynomial, and the defined linear feedback shift register has a maximum period of 2 512 -1.

Images