A lightweight stream cipher generation method and system

Abstract

This invention relates to the field of cryptography and discloses a lightweight stream cipher generation method and system. It involves setting up three shift registers A, B, and C. A and B are linear feedback shift registers, while C is a non-linear feedback shift register. A and B are clocked by C. Two different sets of taps are selected from shift register C, and their Hamming weights W1 and W2 are calculated respectively. Shift registers A and B are then clocked by shifting by W1 and W2 times respectively. Several taps are selected from shift registers A and B as inputs to a non-linear Boolean function H, and a key sequence is output. The plaintext sequence is encrypted using the key sequence to obtain the ciphertext sequence. The method enhances the security of the algorithm by introducing Hamming weight clocking of other shift registers only and by utilizing feedforward Boolean function inputs. The design is simple, and the algorithm has high security.

Description

Technical Field

[0001] This invention relates to the field of cryptography, specifically to a lightweight stream cipher generation method and system. Background Technology

[0002] The Internet of Things (IoT) is an important component of the next generation of information technology and a product of a significant stage in the development of the "information age." However, using traditional symmetric cryptographic algorithms to address the increasingly prominent data security issues in the IoT field has encountered difficulties. The main reason is that the application components used in the IoT differ from traditional desktop computers and high-performance computers; they employ micro-computing devices with relatively limited computing power and storage capacity. Therefore, data security is severely threatened. In this context, stream ciphers have gained attention from the cryptographic community due to their simple structure, relatively simple hardware and software implementation, and high encryption / decryption efficiency. The eSTREAM project, launched in Europe in 2004, has also promoted the design and research of lightweight stream ciphers. The eSTREAM project is divided into software and hardware groups. The software group requires that the newly designed stream ciphers have a higher throughput than the AES stream cipher constructed using the counter mode, while the hardware group requires that the newly designed stream ciphers have higher hardware implementation efficiency than 80-bit AES and be suitable for resource-constrained environments. The final selected stream ciphers in the software group were HC-128, Rabbit, Salsa20, and SOSEMANUK, while the final selected stream ciphers in the hardware group were Grain, MICKEY2.0, and Trivium. In addition, several new stream ciphers were proposed, such as the lightweight stream cipher WG-7 based on the eSTREAM candidate algorithm and the dedicated lightweight stream cipher A2U2. In September 2011, encryption algorithm 128-EEA3 and integrity algorithm 128-EIA3 officially became the LTE international communication encryption standard. The core of these two algorithms is a stream cipher algorithm called ZUC. This marked the first time that my country's commercial cryptography participated in international standards competition, greatly enhancing my country's status and influence in the global mobile communications field. It has significant and far-reaching implications for the development of my country's mobile communications industry and commercial cryptography industry, and its successful standardization represents a major breakthrough for my country in the international cryptography field.

[0003] Lightweight stream ciphers lag far behind block ciphers in design, presenting even greater challenges. A structural characteristic of stream ciphers is their inherent internal state, making them vulnerable to Time Memory Data Tradeoff (TMD) attacks. To resist this attack, the internal state of a stream cipher is typically required to be at least twice the key length, as seen in the Grain and Grain-128a series of stream ciphers. The Trivium algorithm, for example, has an internal state that is more than twice the key length. This results in excessively high hardware resource consumption for stream cipher implementations; for instance, the Trivium algorithm requires 2580 gates, making it unsuitable for resource-constrained, low-power, and IoT applications. To both resist TMD attacks and reduce the internal state length, researchers have recently proposed "small-state" lightweight stream ciphers. Lightweight stream ciphers that resist TMD attacks and have an internal state length less than twice the key length are called small-state lightweight stream ciphers. The small-state design concept of stream ciphers is commendable because it facilitates lightweight algorithms and meets the needs of practical scenarios. However, the design method of continuously adding new components and increasing complexity based on the existing driving model, such as adding round key functions, changing the initialization process, and adding counters, is questionable because it violates the traditional design concept of simplicity and ease of analysis. Moreover, the analysis results show that doing so may actually lead to security risks. Summary of the Invention

[0004] To address this issue, the present invention provides a lightweight stream cipher generation method and system to solve the problems of existing stream cipher design methods being overly complex and prone to security vulnerabilities.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] According to a first aspect of the present invention, a lightweight stream cipher generation method is proposed, the method comprising:

[0007] Two different sets of taps are selected from shift register C, and their Hamming weights W1 and W2 are calculated respectively. Shift registers A and B are then clocked and shifted by W1 and W2 times respectively. Shift registers A and B are linear feedback shift registers, while shift register C is a non-linear feedback shift register. A and B are clocked by C, meaning that the number of shifts of A and B per clock cycle is determined by the state of C. The taps are bit strings of a certain length.

[0008] Several taps are selected from shift registers A and B respectively as inputs to the nonlinear Boolean function H, and a key sequence is output.

[0009] The plaintext sequence is encrypted using the key sequence to obtain the ciphertext sequence.

[0010] Furthermore, the number of shifts for A and B per clock cycle is determined by the state of C, specifically including:

[0011] The clock steps of A and B, controlled by C, follow the Hamming weight clocking mode: for times t = 1, 2, ..., when shift register C shifts once, shift register A shifts by... Next, the clock-controlled shift register B is shifted. Next, among them The i-th state x of the shift register C is respectively i The two sets of taps selected, They are respectively The weight of Hamming.

[0012] Furthermore, the method also includes:

[0013] Taps are selected according to preset rules, including: a tap can only be selected once, the distance between the minimum and maximum taps of a monomial is greater than a preset distance value; and the selected set of taps satisfies the property of a positive difference set less than a preset value.

[0014] Furthermore, the method also includes selecting taps that conform to a first-order positive difference set.

[0015] Furthermore, the method also includes an initialization step, specifically including:

[0016] Generate a random key and initialization vector;

[0017] Assign the random key to the initial state of shift register C;

[0018] Assign the first few bits of the initialization vector to shift register A, and the last few bits to shift register B;

[0019] According to the Hamming weight clocking mode, the shift register C is used to clock the shift numbers of A and B respectively;

[0020] Then, XOR the first few bits of the random key with the leftmost bits of the length of shift register A, and XOR the last few bits of the random key with the leftmost bits of the length of shift register B.

[0021] Continuing with the Hamming weight clocking mode, the shift register C is used to clock the shift steps of A and B respectively.

[0022] Furthermore, the lengths of the shift registers A, B, and C are l1, l2, and l3, respectively. The difference between the length l3 of C and the key length is less than a preset value, and the sum of the lengths of A and C (l1+l3) and the sum of the lengths of B and C (l2+l3) are both greater than the key length.

[0023] Furthermore, the plaintext sequence is encrypted using the key sequence to obtain the ciphertext sequence, specifically including:

[0024] Add the key sequence and the plaintext sequence modulo 2 to generate the ciphertext sequence.

[0025] According to a second aspect of the present invention, a lightweight stream cipher generation system is proposed, the system comprising:

[0026] The clocking module is used to select two different sets of taps from shift register C, calculate their Hamming weights W1 and W2 respectively, and clock shift registers A and B to shift by W1 and W2 times respectively. A and B are linear feedback shift registers, and C is a non-linear feedback shift register. A and B are clocked by C, that is, the number of shifts of A and B per clock cycle is determined by the state of C. The taps are bit strings of a certain length.

[0027] The key acquisition module is used to select several taps from shift registers A and B respectively as inputs to the nonlinear Boolean function H, and output a key sequence.

[0028] An encryption module is used to encrypt a plaintext sequence using the key sequence to obtain a ciphertext sequence.

[0029] According to a third aspect of the present invention, a computer storage medium is provided, the computer storage medium containing one or more program instructions, the one or more program instructions being configured to be executed by a lightweight stream cipher generation system as described in any of the preceding embodiments.

[0030] The present invention has the following advantages:

[0031] This invention proposes a lightweight stream cipher generation method and system. It employs three shift registers A, B, and C. A and B are linear feedback shift registers, while C is a nonlinear feedback shift register. A and B are clocked by C. Two different sets of taps are selected from shift register C, and their Hamming weights W1 and W2 are calculated respectively. Shift registers A and B are then clocked by shifting by W1 and W2 times respectively. Several taps are selected from shift registers A and B as inputs to a nonlinear Boolean function H, and a key sequence is output. The plaintext sequence is encrypted using this key sequence to obtain the ciphertext sequence. The method enhances the security of the algorithm by introducing Hamming weight clocking of the other shift registers and utilizing feedforward Boolean function inputs. The design is simple, and the algorithm boasts high security. Attached Figure Description

[0032] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely exemplary, and those skilled in the art can derive other embodiments based on the provided drawings without creative effort.

[0033] Figure 1 This is a flowchart illustrating a lightweight stream cipher generation method provided in Embodiment 1 of the present invention;

[0034] Figure 2 This is a flowchart illustrating the implementation of a lightweight stream cipher generation method provided in Embodiment 1 of the present invention. Detailed Implementation

[0035] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0036] Example 1

[0037] like Figure 1 As shown, this embodiment proposes a lightweight stream cipher generation method, the method comprising:

[0038] S100. Select two different sets of taps from shift register C, calculate their Hamming weights W1 and W2 respectively, and clock shift registers A and B to shift by W1 and W2 times respectively. A and B are linear feedback shift registers, and C is a non-linear feedback shift register. A and B are clocked by C, that is, the number of shifts of A and B per clock cycle is determined by the state of C. The taps are bit strings of a certain length.

[0039] S200: Select several taps from shift registers A and B respectively as inputs to the nonlinear Boolean function H, and output the key sequence.

[0040] S300. The plaintext sequence is encrypted using the key sequence to obtain the ciphertext sequence.

[0041] The details are as follows: The stream cipher constructed in this embodiment includes three shift registers A, B, and C over GF(2), with lengths l1, l2, and l3 respectively. A and B are clocked by C, that is, the number of shifts of A and B per clock is determined by the state of C. Among them, A and B adopt linear feedback shift registers (Linear Feedback Shift Register, LFSR), and C adopts a non - linear feedback shift register (Nonlinear Feedback Shift Register, NFSR). A and B are clocked by C, that is, the number of shifts of A and B is determined by the state of C. Their initial states are respectively and x0, and the feedback polynomials are f1, f2, and g respectively.

[0042] For a vector u ∈ GF(2) k , let u=(u1, u2, …, u k ), 1 ≤ i < j ≤ k, and denote u| i,j =(u1, u2, …, u k ). For simplicity, denote u| i,i =u| i . For the i - th state of the shift register C, two groups of bit strings with lengths a and b are respectively selected (that is, taps are selected):

[0043]

[0044] and

[0045]

[0046] where 1 ≤ a, b ≤ l3, 1 ≤ i1 < … < i a ≤ l3, 1 ≤ i1 < … < i b ≤ l3. Denote the Hamming weight of the Hamming weight of The calculation method of the clock - controlled steps of A and B by C is as follows: For t = 1, 2, …, when the shift register C shifts once, the shift register A shifts times, and clocks the shift register B to shift times. Taps are respectively selected from the three shift registers A, B, and C as the inputs of the non - linear Boolean function H, and the output of the Boolean function H is used as the current key bit. To prevent a divide - and - conquer attack, the length of C should be approximately equal to the key length, and the sum of the lengths of A and C, l1 + l3, and the sum of the lengths of B and C, l2 + l3, are both greater than the key length.

[0047] After the key initialization is completed, the process of generating the key - stream bits by the encryption algorithm is as follows, as Figure 2As shown, for times t = 1, 2, ...:

[0048] (1) Select two different sets of taps from shift register C respectively, and calculate the Hamming weights W1 and W2;

[0049] In this embodiment, each tap can only be selected once. The distance between the minimum and maximum taps of a monomial should be as large as possible. Secondly, the selected set of taps should satisfy the property of a positive difference set as small as possible. The property of a positive difference set is described as follows: if the differences between different elements in a set τ occur most frequently (with a frequency of σ), then the set τ is called a positive difference set of order σ. If the differences between elements in the set are all different, then σ = 1, and in this case, 1 is called a complete positive difference set. Here, taps that satisfy the properties of a positive difference set of order 1 are selected.

[0050] (2) Clock-controlled shift registers A and B are shifted W1 and W2 times respectively;

[0051] (3) Select several taps from A and B that conform to the first-order positive difference set, respectively, as inputs to the nonlinear function H, and generate a 1-bit key bit K. i ;

[0052] (4) Key sequence bits K i and plaintext sequence bits P i Modulo-2 addition produces the ciphertext sequence C bits. i .

[0053] Below, based on the above design, we select some parameters to construct a specific stream cipher. The feedback polynomial (characteristic polynomial) of C is taken as:

[0054] g(x) = 1 + x 32 +x 37 +x 72 +x 102 +x 128 +x 44 x 60 +x 61 x 125 +x 63 x 67 +x 69 x 101 +x 80 x 88 +x 110 x 111 +x 115 x 117

[0055] f1(x) = 1 + x + x 2 +x 4 +x 5 +x 6 +x 8 +x10 +x 80

[0056] f2(x) = 1 + x + x 2 +x 3 +x 6 +x 7 +x 9 +x 11 +x 80

[0057] Pick

[0058] The key is obtained using a random number generator as k = (k1, k2, ..., k). 128 Use a random number generator to generate a random initial vector IV = (I1, I2, ..., I...). 128 ).

[0059] The initialization steps are as follows:

[0060] Assign the 128-bit key to the initial state of C (directly assign the binary value to the shift register);

[0061] Assign the first 80 bits of the IV to A, and the last 80 bits of the IV to B;

[0062] According to the Hamming weight clocking mode described above, shift register C is used to clock shift registers A and B for 500 idle cycles (idle cycle means that shift register C shifts according to its own rules, and A and B shift according to the clocking mode of C, but it is not necessary to generate a key stream through nonlinear function H).

[0063] Then, XOR the first 64 bits of the 128-bit key with the leftmost 64 bits of the length of shift register A (in this embodiment, A has a total length of 80 bits), and XOR the last 64 bits of the 128-bit key with the leftmost 64 bits of the length of shift register B.

[0064] Continue using the Hamming weight clocking mode described above, and use shift register C to clock shift registers A and B for 1000 idle cycles respectively;

[0065] After initialization, the current states of the two linear shift registers and the feedforward function H are used to generate the key stream sequence.

[0066] The feedforward function H consists of 11 taps from A and B:

[0067] H = x1·x5 + x2·x8 + x3·x 10 +x7·x9+x4·x6·x 11

[0068] The tap positions of A and B are (3,11,25,65,78) and (1,7,25,34,55,79), respectively.

[0069] A secure stream cipher should be resistant to all known-plaintext attacks, meaning that an adversary should be unable to recover the key even if they intercept an arbitrarily long keystream bit string. In shift register-based stream cipher algorithms, the initial state of the shift register is generally used as the key. For clocked keystream generators, the most basic attack algorithm is a separate-conquer attack, which exhaustively searches for clocked states to recover the initial state of the clocked shift register. For example, for an interleaved stop generator, if and only if the initial state of the clocked shift register C is correctly guessed, the derived sequences of regularly clocked shift registers A and B can be obtained from the derived sequence of the keystream sequence, thus allowing the determination of the initial states of A and B. In this embodiment, because the input shift registers A and B are irregularly clocked, and the computational complexity of the algorithm for exhaustively searching for clocked information is O(n log n), the initial state of A and B can be determined. When the length of C is large enough, such as when the key length is 128, then when l3 = 128, the computational complexity of the algorithm for exhaustively enumerating the clock control information is O(2^3). 128 After exhaustively enumerating the clocked information, if a fast correlation attack or algebraic attack is to be performed, it is necessary to establish faulty linear or algebraic equations about the initial states of shift registers A and B and the key stream bits, and then solve the equations. Therefore, fast correlation attacks and algebraic attacks are ineffective. Furthermore, each key bit participates in internal state updates, the total length of the three shift registers is greater than twice the key length, and a clocked shift register is introduced. The state transition equations of the shift registers are uncertain at each moment, so the TMD method is also ineffective.

[0070] Example 2

[0071] Corresponding to Embodiment 1 above, this embodiment proposes a lightweight stream cipher generation system, the system comprising:

[0072] The clocking module is used to select two different sets of taps from shift register C, calculate their Hamming weights W1 and W2 respectively, and clock shift registers A and B to shift by W1 and W2 times respectively. A and B are linear feedback shift registers, and C is a non-linear feedback shift register. A and B are clocked by C, that is, the number of shifts of A and B per clock cycle is determined by the state of C. The taps are bit strings of a certain length.

[0073] The key acquisition module is used to select several taps from shift registers A and B respectively as inputs to the nonlinear Boolean function H, and output a key sequence.

[0074] An encryption module is used to encrypt a plaintext sequence using the key sequence to obtain a ciphertext sequence.

[0075] The functions performed by each component in the lightweight stream cipher generation system provided in this embodiment of the invention have been described in detail in the above embodiment 1, so they will not be repeated here.

[0076] Example 3

[0077] Corresponding to the above embodiments, this embodiment proposes a computer storage medium containing one or more program instructions, which are used by a lightweight stream cipher generation system to execute the method of Embodiment 1.

[0078] Although the present invention has been described in detail above with general descriptions and specific embodiments, modifications or improvements can be made to it, which will be obvious to those skilled in the art. Therefore, all such modifications or improvements made without departing from the spirit of the present invention fall within the scope of protection claimed by the present invention.

Claims

1. A lightweight stream cipher generation method characterized by, The method comprises: Two different sets of taps are selected from the shift register C, and the Hamming weights W1 and W2 are calculated respectively, and the shift registers A and B are clocked W1 and W2 times respectively, wherein A and B are linear feedback shift registers, C is a nonlinear feedback shift register, A and B are clocked by C, that is, the number of shifts of A and B at each clock is determined by the state of C, and the taps are bit strings of a certain length; A plurality of taps are selected from the shift registers A and B respectively as inputs of a nonlinear Boolean function H, and a key sequence is outputted; A plaintext sequence is encrypted using the key sequence to obtain a ciphertext sequence; where A and B are clocked by C according to a Hamming weight clocking scheme: for time t = 1,2,..., shift register C is shifted once, then shift register A is shifted twice, and shift register B is clocked once, where x i i are the Hamming weights of the selected two sets of taps, respectively.​ The method further comprises an initialization step, specifically comprising: generating a random key and an initialization vector; assigning the random key to the initial state of the shift register C; assigning the first number of bits of the initialization vector to the shift register A and the last number of bits to the shift register B; clocking A and B by the shift register C according to the Hamming weight clocking mode for a number of shifts; XORing the first number of bits of the random key with the left number of bits in the length of the shift register A, and XORing the last number of bits of the random key with the left number of bits in the length of the shift register B; continuing to clock A and B by the shift register C according to the Hamming weight clocking mode for a number of shifts.

2. The method of claim 1, wherein The method further comprises: selecting taps according to a preset rule, including: a tap can only be selected once, and the minimum tap and the maximum tap of a monomial have a distance greater than a preset distance value; secondly, the selected tap set satisfies the positive difference set property of less than a preset value.

3. The method of claim 2, wherein The method further comprises: selecting taps that meet the first-order positive difference set.

4. The method of claim 1, wherein The lengths of the shift registers A, B and C are l1, l2 and l3 respectively, the length l3 of C is less than a preset value from the key length, and the sum l1+l3 of the lengths of A and C and the sum l2+l3 of the lengths of B and C are both greater than the key length.

5. The method of claim 1, wherein The plaintext sequence is encrypted using the key sequence to obtain a ciphertext sequence, specifically comprising: mod 2 addition of the key sequence and the plaintext sequence to generate the ciphertext sequence.

6. A lightweight stream cipher generation system, characterized by, The system comprises: A clocking module is used to select two groups of different taps from a shift register C, to calculate Hamming weights W1 and W2 respectively, and to clock shift registers A and B to shift W1 and W2 times respectively, wherein A and B are linear feedback shift registers, C is a nonlinear feedback shift register, and A and B are clocked by C, i.e. the shift number of A and B at each clock is determined by the state of C, and the taps are bit strings of a certain length; wherein the clocking steps of A and B by C are according to a Hamming weight clocking mode: for time t = 1, 2, …, if shift register C shifts once, then shift register A shifts times, and shift register B shifts times, wherein respectively are the Hamming weights of the two groups of taps selected from the i-th state x i of shift register C, respectively. An initialization step specifically includes: generating a random key and an initialization vector; assigning the initial state of shift register C with the random key; assigning the first number of bits of the initialization vector to shift register A and the last number of bits to shift register B; clocking A and B to shift a number of times respectively by shift register C according to the Hamming weight clocking mode; then XORing the first number of bits of the random key with the left number of bits in the length of shift register A, and XORing the last number of bits of the random key with the left number of bits in the length of shift register B; continuing to clock A and B to shift a number of times respectively by shift register C according to the Hamming weight clocking mode. a key acquisition module for selecting a plurality of taps from the shift registers A and B respectively as inputs of a nonlinear Boolean function H, and outputting a key sequence; an encryption module for using the key sequence to encrypt a plaintext sequence to obtain a ciphertext sequence.

7. A computer storage medium, characterized in that The computer storage medium contains one or more program instructions for being executed by a lightweight sequence cipher generation system to perform the method of any one of claims 1-5.

Images