A fast software implementation method of SM4 based on register optimization

Abstract

The invention discloses a register-optimized SM4 fast software implementation method, which comprises: based on a bit slicing method and an AVX2 (Advanced Vector Extension 2) instruction set, 64 groups of plaintext data are encrypted and decrypted in parallel, a data packing process is introduced in the plaintext data arrangement, and data transposition and round function operations are performed inside the register; by separating the key arrangement, the key arrangement is divided into an expansion operation and a copy operation, the expansion operation is preprocessed in a key generation function, and the copy operation is performed during the algorithm execution process, thereby reducing the time required for the key arrangement.

Description

Technical Field

[0001] The present invention relates to a register-optimized SM4 fast software implementation method, which can greatly improve the implementation efficiency of the SM4 algorithm and belongs to the intersection of computer software engineering and security technology. Background Art

[0002] The SM4 algorithm, formerly the SMS4 algorithm, is the first commercial encryption algorithm officially announced in China. As a commercial block symmetric encryption algorithm independently designed by my country, it was approved as an industry standard by the National Cryptography Administration in March 2012 and is widely used in the WAPI wireless network standard to protect the confidentiality of data. In June 2021, the SM4 algorithm was included in the ISO / IEC international standard and officially released, marking the further improvement of my country's international standard system for commercial encryption algorithms.

[0003] With the gradual application of SM4 algorithm in defense, military, industry and commerce, etc., it is now necessary to ensure not only the security of the algorithm, but also the efficiency of algorithm implementation in practical applications. Among the software rapid implementation methods, the commonly used method in current research is the bit slicing method, which is implemented in combination with an extended instruction set based on hardware acceleration. In the process of using the bit slicing method to implement the algorithm, due to the large parallel scale and the insufficient number of instruction registers, frequent data interaction operations are required between the memory and the registers during the encryption and decryption process, resulting in a decrease in the algorithm's operating efficiency. Summary of the invention

[0004] The present invention proposes a new SM4 software fast implementation method based on the bit slicing method and AVX2 instructions. The invention involves two parts: 1. By changing the data storage method, the access operations between the memory and the register in the data arrangement and linear transformation process are reduced; 2. By separating the key arrangement and preprocessing, the key arrangement process is simplified.

[0005] The present invention adopts the following scheme to implement a fast software implementation method of SM4 based on register optimization, step 1: data packaging: let X i (i∈[0,35]) is 32-bit data, and any set of plaintext data in SM4 can be expressed as M=(X 0 ,X 1 ,X 2 ,X 3 ), and convert 64 groups of plaintext X i Arranged in consecutive memory locations;

[0006] Step 2: Data transposition: Transpose the 64 plaintext groups X in memory i Put it into the register, and iPerform data transposition operation, and then put the data into memory so that each group of plaintext (j∈[0,7],i∈[0,3], Represents X i The j-th bit in the data is arranged in consecutive memory locations;

[0007] Step 3: Key arrangement: Copy each round key into 64 groups and arrange them in the same storage format as the plaintext, so that the rk of each group of round keys is j ,rk j+8 ,rk j+16 ,rk j+24 (j∈[0,7],rk j The data representing the j-th bit of the round key are arranged in consecutive memory locations.

[0008] Step 4: Perform round function operation in the register. The round function of the SM4 algorithm is Among them, rk i is the round key of the current iteration, T is a The reversible transformation uses the byte reordering instruction in the AVX2 instruction set to complete the shift operation of the linear transformation in the T transformation.

[0009] Step 5: Data reverse transposition: Transpose the 64 ciphertext X i (i∈[32,35]) is reversed, which will make each group of plaintext X i Data is arranged in consecutive memory locations.

[0010] Step 6: The reverse process of data packaging: adjust the storage format of the ciphertext data, and convert the (X 35 ,X 34 ,X 33 ,X 32 ) data is stored in consecutive memory locations.

[0011] In step 1, data packaging is introduced in the data arrangement process. A set of plaintext data of SM4 can be expressed as M = (X 0 ,X 1 ,X 2 ,X 3 ), where X i (0≤i≤3) is 32 bits, and the data packing operation is completed by the unpack instruction in the AVX2 instruction set, which can mainly pack each X of the 64 groups of plaintext i Placed in consecutive memory locations, such as Figure 1 As shown ( X represents the jth group of data 0 ).

[0012] In step 2, the packed data is transposed using AVX2 instructions, and the data transposition process is only performed inside the register, that is, the main process of each transposition operation is only in the YMM register. The (j∈[0,7],i∈[0,3]) bits are placed in the same register.

[0013] In step 3, in order to ensure the correctness of the algorithm, the key is arranged. The key is preprocessed before encryption. During the preprocessing operation, each bit of each round key is judged: if the current bit is 1, 8-bit data 0xff is stored; if the current bit is 0, 8-bit data 0x0 is stored. The processed key data is pre-stored, and then the round key is copied into 64 groups for encryption operation.

[0014] In step 4, a round function operation is performed inside the register. In the linear shift transformation process, since the AVX2 instruction set does not have a circular shift instruction, the circular left shift process requires two shift instructions and an XOR instruction to complete the shift; and since the number of bits of the circular shift in the present invention is in bytes, a circular shift process in the present invention can be completed by a data rearrangement instruction in the AVX2 instruction set.

[0015] In the original bit slicing method, 256 groups of data can be encrypted and decrypted in parallel. In the algorithm implementation process, data arrangement only includes the process of data transposition, and it takes 3136 logic instructions and 896 data reading operations to implement one data arrangement. According to the delay and throughput of instructions given in Intel's official documents, the delay of logic instructions is 1 clock cycle, and a data reading instruction requires multiple clock cycles. The frequent data interaction operations between memory and registers consume a lot of time. Therefore, in order to improve the implementation efficiency of data arrangement, the present invention introduces the operation of data packaging in the data arrangement process, and then performs data transposition, and the data transposition process is only performed inside the register, reducing the interaction operation with the memory. After data arrangement, the number of parallel groups of the method of the present invention is 64 groups. In the encryption of 256 groups of plaintexts of the same number, the data arrangement in the present invention requires 1728 logic instructions and 256 data read operations, which fully reduces the read operations between registers and memory. After testing, the number of instructions required for data arrangement is reduced by 44%, the number of memory reads required is reduced by 71%, and the read operations between registers and memory are fully reduced. The total time consumption is reduced by 66%.

[0016] Any set of plaintext data in SM4 can be expressed as M = (X 0 ,X 1 ,X 2 ,X 3), in data arrangement, through data packaging operation, 64 groups of plaintext X i Arrange in consecutive memory locations. In the data packing process, use the unpack instruction to operate on the lower 64 bits of data and the upper 64 bits of data respectively. Transpose the packed data and replace the X i In (j∈[0,7],i∈[0,3], Represents X i In data transposition, the X bits in the 64 plaintext data are placed in the same register. 0 ,X 1 ,X 2 ,X 3 The data is placed in 8 YMM registers for data transposition. In the subsequent round function operation, the AVX2 instruction set is used to operate 64 sets of data in parallel, and the 4 S boxes in the algorithm can operate in parallel.

[0017] In the linear transformation of the round function (including 0 XOR process), under the same conditions, to encrypt 256 groups of plaintext, in the original bit slicing method, the number of logical instructions required is 5120, and the number of memory reads required is 10240 times; the number of logical instructions required in the linear transformation of the present invention is 8704, and the number of memory reads required is 2048 times. Although compared with the original linear transformation, the number of instructions required in this paper is slightly increased, but the number of memory reads is greatly reduced. Compared with the original linear transformation method, the total time consumption of the linear transformation in this article is reduced by 70%, and the efficiency is greatly improved.

[0018] In order to ensure the correctness of the algorithm, after the plaintext is data-formatted, the key needs to be data-formatted. This is optimized in the present invention by performing an expansion operation on the key in advance before encryption and pre-storing the expanded ciphertext data, thereby reducing the time consumed by key formatting during the algorithm process.

[0019] During the expansion operation, for each round key, each bit is judged: if the current bit is 1, 8-bit data 0xff is stored; if the current bit is 0, 8-bit data 0x0 is stored. The data storage format of each round key is: rk[k] = ((uint32_t)temp[k] << 24) | ((uint32_t)temp[k+8] << 16) | ((uint32_t)temp[k+16] << 8) | ((uint32_t)temp[k+24]) (k∈[0,8], rk represents the round key to be stored in each round, and temp[k] represents the kth 8-bit data).

[0020] Afterwards, the compiled round keys are pre-stored, and 32 round keys need to occupy 1KB of data storage space, which is within an acceptable range.

[0021] The outstanding advantages of the present invention are:

[0022] The present invention realizes a fast software implementation method of SM4 based on register optimization. Compared with the bit slicing method in other public documents, the present method takes into account the memory reading process in the algorithm implementation and reduces the frequent access operations between the memory and the register. It only takes 4.5 clock cycles to encrypt 1 byte using the method in the present invention, which is the fastest encryption and decryption speed among the current SM4 software implementation methods. The encryption efficiency on the AMD Ryzen 75800H platform can reach 11070Mbps, and the present method is applicable to the implementation of other platforms, and has certain reference value for other symmetric encryption algorithms. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the examples of the present invention and do not constitute a limitation of the present invention.

[0024] In the attached picture:

[0025] Figure 1 It is the overall flow chart of the present invention;

[0026] Figure 2 The X in the 64 groups of plain text after the data is packed in the present invention is shown. 0 The storage distribution in memory;

[0027] Figure 3 The distribution and storage changes of data in the register after data transposition in the present invention are shown;

[0028] Figure 4 The distribution of the round keys in the memory after the key expansion in the present invention is shown;

[0029] Figure 5 The overall implementation process of the algorithm in the present invention and the optimization technology used are shown;

[0030] Figure 6 The data transposition algorithm of the present invention is shown;

[0031] Figure 7 The linear transformation process in the present invention is shown. DETAILED DESCRIPTION

[0032] The specific implementation of the method is introduced below. The content described here is only used to illustrate and explain the present invention, and is not used to limit the present invention.

[0033] Based on the bit-slicing method and the AVX2 instruction set, the present invention proposes a new fast software implementation method for SM4. The invention involves two parts: 1. By changing the data storage method, the access operations between memory and registers during data arrangement and linear transformation are reduced; 2. By separating and preprocessing the key arrangement, the process of key arrangement is simplified.

[0034] The data arrangement in the present invention includes two steps: data packing and data transposition. In the data packing operation, the unpack instruction in the AVX2 instruction set is used to operate on the data in the YMM register, and each group of X in each of the 64 groups of plaintexts 0 , X 1 , X 2 , X 3 is placed in adjacent storage positions. After data packing, the 64 groups of X 0 , X 1 , X 2 , X 3 are stored in the form as Figure 2 shown. After that, in order to encrypt the 64 groups of data in parallel, data transposition operations are respectively performed on the 64 groups of X 0 , X 1 , X 2 , X 3 , and the data transposition algorithm used is as Figure 6 shown. Among them, src[r] and src[r + k] (0 ≤ r < 7, 0 < r + k ≤ 7) refer to the r-th and (r + k)-th YMM registers. The logical operations and shift operations in the algorithm are completed through AVX2 instructions, mainly including instructions such as vpandn, vpsrlq, vpor, vpand, vpsllq, etc. The changed distributed storage of the data after data transposition is as Figure 3 shown. After data transposition, it is possible to place each (j ∈ [0, 7]) of each group of plaintexts in the same register, and then use the AVX2 instruction set to operate on the 64 groups of data in parallel, and simplify the S-box operation and linear transformation operation in the SM4 algorithm.

[0035] To ensure the correctness of the algorithm, after data arrangement of the plaintext, data arrangement of the key is required. The present invention separates the key arrangement into expansion and copy operations, and preprocesses the expansion operation, and performs key expansion in the key generation function. In the expansion operation, for each round key, each bit of it is judged: if the current bit is 1, then 8-bit data 0xff is stored; if the current bit is 0, then 8-bit data 0x0 is stored. The distribution of the round keys in memory after key expansion in the expansion process is as Figure 3As shown, the storage format should be: rk[k] = ((uint32_t)temp[k]<<24)|((uint32_t)temp[k+8]<<16)|((uint32_t)temp[k+16]<<8)|((uint32_t)temp[k+24])(k∈[0,8], rk represents the round key to be stored in each round, and temp[k] represents the kth 8-bit data).

[0036] Afterwards, during the encryption process, the round key is copied to the register through AVX2 instructions for algorithm encryption.

[0037] In the process of algorithm encryption, the S-box in the present invention is realized through a logic function, and the realization of the S-box is completed by means of composite domain technology.

[0038] In linear transformation, the process of linear shift is as follows Figure 7 As shown. ROTL8(x) means x is cyclically shifted left by 8 bits within 32 bits, ROTL16(x) means x is cyclically shifted left by 16 bits within 32 bits, and ROTL8(x) means x is cyclically shifted left by 24 bits within 32 bits. S′ 0 ~S′ 7 Represents 8 original registers, that is, the Y where the data is located after passing through the S box 0 ~Y 7 Register (Y i represents the i-th YMM register), T 0 ~T 7 Represents the operation result. After linear transformation, 0 XOR the round function result and store it in X 0 memory location. In the process of linear shift transformation, since there is no circular shift instruction in the AVX2 instruction set, the circular left shift process needs to be completed by shift instructions and XOR instructions. Taking the circular left shift of 8 bits as an example, three instructions are required to complete it: vpslld, vpsrld, and vpxor, namely left shift, right shift, and XOR instructions. In the linear shift implementation process of this method, the number of bits of the circular left shift is a multiple of 8, that is, the circular left shift is performed in bytes. Therefore, the circular left shift process can be shifted using the shuffle byte rearrangement instruction of the AVX2 instruction set, thereby achieving the effect of circular left shift, that is, the operation can be completed with one instruction. Through the replacement of the instruction set, in the operation process of linear shift, the number of instructions in each round is reduced from 110 to 60, and the efficiency is greatly improved.

Claims

1. A fast software implementation method of SM4 based on register optimization, characterized in that: It includes the following steps: Step 1: Data Packaging: Let X i , i∈[0,35] is 32-bit data. Any set of plaintext data in SM4 can be represented as M=(X0,X1,X2,X3). i Arranged in consecutive memory locations; Step 2: Data transposition: Transpose the 64 plaintext groups X in memory i Put it into the register, and i Perform data transposition operation, and then put the data into memory so that each group of plaintext Data is arranged in consecutive memory locations; j∈[0,7],i∈[0,3], Represents X i The jth bit in ; Step 3: Key arrangement: Copy each round key into 64 groups and arrange them in the same storage format as the plaintext, so that the rk of each group of round keys is j ,rk j+8 ,rk j+16 ,rk j+24 Data are arranged in consecutive memory locations; j∈[0,7],rk j represents the j-th bit of the round key; Step 4: Perform round function operation in the register. The round function of SM4 algorithm is X i+4 =F(X i ,X i+1 ,X i+2 ,X i+3 )=X i ⊕T(X i+1 ⊕X i+2 ⊕X i+3 ⊕rk i ), where rk i is the round key of the current iteration, T is a The reversible transformation completes the shift operation of the linear transformation in the T transformation; Step 5: Data reverse transposition: Transpose the 64 ciphertext X i , i∈[32,35] is reversed, which will make each group of plaintext X i Data is arranged in consecutive memory locations; Step 6: The reverse process of data packaging: adjust the storage format of the ciphertext data, and convert the (X 35 ,X 34 ,X 33 ,X 32 ) data is stored in consecutive memory locations.

2. The SM4 fast software implementation method based on register optimization according to claim 1, characterized in that: In step 1, the data packaging operation is introduced in the data arrangement process. A set of plaintext data of SM4 can be expressed as M = (X0, X1, X2, X3), where X i , 0≤i≤3 is 32 bits, and each X of the 64 plaintext i placed in consecutive memory locations, X0 represents the j-th group of data.

3. The SM4 fast software implementation method based on register optimization according to claim 1, characterized in that: In step 2, the packed data is transposed, and the data transposition process is only performed inside the register; through the data transposition operation, each group of plaintext can be The bits are placed in the same register, j∈[0,7],i∈[0,3].

4. The SM4 fast software implementation method based on register optimization according to claim 1 is characterized in that: In step 3, the key is preprocessed before encryption. During the preprocessing operation, each bit of each round key is judged: if the current bit is 1, the 8-bit data 0xff is stored; if the current bit is 0, the 8-bit data 0x0 is stored; and the processed key data is pre-stored, and then the round key is copied into 64 groups for encryption operation.

5. The SM4 fast software implementation method based on register optimization according to claim 1, characterized in that: In step 4, a round function operation is performed inside the register. During the linear shift transformation process, a circular shift process can be completed by a data rearrangement instruction in the AVX2 instruction set.

Images