An sm4 second-order threshold mask method

Abstract

The application discloses an SM4 second-order threshold mask method, which adopts one-time isomorphic mapping based on a polynomial basis to realize tower field decomposition of an SM4 algorithm S box, divides an SM4 algorithm encryption module into smaller components, designs a mask scheme for each component based on a threshold mask theory, uses an automatic search means to find an optimal threshold mask meeting a condition for the SM4 algorithm S box after the tower field decomposition, introduces a post rotation technology to realize random number multiplexing, reduces the use of random numbers in the mask scheme, and guarantees that the algorithm can effectively resist a second-order power consumption attack while reducing hardware resource consumption.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, and particularly to an SM4 second-order threshold masking method for resisting second-order power consumption attacks. BACKGROUND

[0002] Power Attack (PA) is a common side-channel attack method, and its core idea is to obtain sensitive data in the execution of a cryptographic algorithm by monitoring the power consumption information leaked by an encrypted electronic device during operation, and then to break the cryptographic algorithm. In recent years, power attack methods have made great progress, posing a serious threat to cryptographic devices, mainly including Simple Power Attack (SPA), Differential Power Attack (DPA), Correlation Power Attack (CPA), and the like. The proposal of High-Order Power Attack (HOPA) methods further exacerbates the threat to cryptographic devices.

[0003] To resist side-channel attacks, a series of protection techniques have been proposed. Among all side-channel protection techniques, masking is a technique that uses random numbers to mask real secret information, and then resists power attacks, mainly including ISW masking, polynomial masking, DOM masking, threshold masking, and the like. Threshold masking adopts the idea of secret sharing multi-party secure computation, and cuts the secret information into multiple shares for separate calculation, so that the attacker cannot speculate the secret information according to the power consumption information in the calculation process. Threshold masking is the first side-channel protection technique that can be theoretically proved to avoid complete detection of intermediate values in the presence of glitches, and threshold masking is more easily extended to high-order to resist the threat of high-order power attacks.

[0004] SM4 algorithm is a commercial symmetric cipher algorithm developed by China. In March 2012, it was released as a cryptographic industry standard by the State Cryptography Administration. In June 2021, the SM4 block cipher algorithm was officially released as an international standard by the standardization organization ISO / IEC. SM4 algorithm is widely used in China's government office, bank, tax, power and other information systems. With the upgrading of China's information technology industry, the improvement of SM4 algorithm protection capability is increasingly valued. In recent years, researchers have carried out threshold masking protection research work on SM4 algorithm. Literature [1] optimizes the implementation of SM4 algorithm and designs a first-order anti-power analysis attack addition masking scheme, but the addition masking cannot be effectively extended to the second order. Literature [2] designs a three-share second-order threshold masking of SM4 algorithm S-box that can resist second-order power analysis attacks based on virtual value method and decomposition method, but this work only constructs a masking scheme for S-box. Literature [3] obtains the masked S-box through random row and column transformation and masking processing, and uses the S-box to encrypt the plaintext so that the power consumption leakage is irrelevant to the sensitive data. Literature [4] realizes the composite field decomposition of SM4 algorithm S-box through twice isomorphic mapping, and designs a Boolean masking scheme based on the composite field.

[0005] Reference:

[0006] [1] Bai X. Anti-power analysis attack SMS4 cipher algorithm VLSI design technology research [D]. China University of Science and Technology, 2008;

[0007] [2] Li X, Zhong W, Zhang S, Yang X. A threshold implementation scheme of SM4 algorithm S-box [J]. Journal of Cryptography, 2018, 5(06): 641-650. DOI: 10.13868 / j.cnki.jcr.000273;

[0008] [3] Li Y, Zhang Y, Lu B. An implementation method of SM4 algorithm masking S-box resistant to power analysis attack [P]. Beijing: CN106936569A, 2017-07-07;

[0009] [4] Wang B, Chen J, Li H. Masking method and device of SM4 algorithm [P]. Beijing: CN106357380A, 2017-01-25. SUMMARY

[0010] In order to enable SM4 to resist second-order power analysis attacks while not significantly increasing the hardware cost of algorithm implementation, the present application proposes a new method of SM4 second-order threshold masking, which can effectively resist second-order power analysis attacks.

[0011] The present application is a method for SM4 second-order threshold masking, comprising the following steps:

[0012] (1) Disassemble SM4 algorithm into components

[0013] The functions and input and output results of different modules of the SM4 algorithm are analyzed, and the SM4 algorithm is disassembled into nonlinear components and linear components according to the linear and nonlinear characteristics; for the SM4 algorithm, the nonlinear component is the S-box of the algorithm, and the linear component includes: finite state machine, key and state register, random number generator, linear layer, and reverse output sequence; according to the idea of combined secure components, a mask scheme is designed for each of the above components, and is combined to form a mask scheme for the whole SM4 algorithm;

[0014] (2) Design a mask scheme for the nonlinear component based on tower domain decomposition and threshold masking method

[0015] For the nonlinear component of the SM4 algorithm, the idea of disassembly and reconstruction is adopted; first, the nonlinear S-box is disassembled into a 4-bit inverter and a 4-bit multiplier using the tower domain decomposition method; for the 4-bit inverter, an automatic search tool is used to search for a mask scheme; for the 4-bit multiplier, a three-shared mask scheme is used to ensure that the algorithm can resist second-order power attacks, and a ring masker is designed to reduce the circuit area of the multiplier;

[0016] (3) Design a mask scheme for the linear component based on the Boolean masking method

[0017] The linear components in the SM4 algorithm encryption and decryption circuit mainly include: finite state machine, key register, state register, random number generator, linear layer, and reverse output sequence; wherein the finite state machine is used to generate control signals to control other modules to perform operations, and the power consumption change thereof will not cause secret information leakage, so it does not need to be masked and protected; other linear components use a direct Boolean masking method to design a mask scheme;

[0018] (4) Complete the construction of the SM4 algorithm mask scheme

[0019] According to the execution process of the SM4 algorithm, the components are connected, the random numbers in the algorithm are reused, and the circuit layout is optimized to form the final mask scheme.

[0020] The beneficial effects of the present application are:

[0021] (1) The method of the present application can effectively resist second-order power attacks.

[0022] (2) The method of the present application uses automatic search technology to search for a mask scheme, which can quickly design an efficient mask scheme, effectively reducing the design difficulty of the mask scheme.

[0023] (3) The method of the present application has low random number consumption and small circuit area. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 The schematic diagram of the components of the SM4 algorithm split for the method of the application;

[0025] Figure 2 The schematic diagram of the S-box circuit structure after tower field decomposition for the application;

[0026] Figure 3 The schematic diagram of the 4-bit multiplier circuit with threshold mask for the application;

[0027] Figure 4 The flowchart of the 4-bit inverter mask scheme designed for the method of the application. DETAILED DESCRIPTION

[0028] The content of the application will be further described in detail below in combination with the drawings and embodiments, but is not a limitation on the application.

[0029] EMBODIMENT

[0030] An SM4 second-order threshold mask method, comprising the following steps:

[0031] (1) The SM4 algorithm is split into components, referring to Figure 1 , the functions and input and output results of different modules of the SM4 algorithm are analyzed, and the SM4 algorithm is split into nonlinear components and linear components according to the linear and nonlinear characteristics; for the SM4 algorithm, the nonlinear component is the S-box of the algorithm, and the linear component includes: finite state machine, key and state register, random number generator, linear layer, and reverse output sequence; according to the idea of combining secure components, a mask scheme is designed for each of the above components, and is combined to form a mask scheme for the whole SM4 algorithm.

[0032] (2) Based on the tower field decomposition and the threshold mask method, a mask scheme for the nonlinear component is designed, and the specific process is as follows:

[0033] (2.1) The S-box is tower field decomposed using a method based on a polynomial basis. In order to realize the tower field decomposition from the finite field GF(2 8 ) to the tower field GF(2 4 ) 2 , a first isomorphism mapping matrix needs to be solved first, which is used to map the elements in the finite field to the elements in the tower field, and then the expression form of the inverse element calculation formula in the finite field GF(2 8 ) is derived in the tower field GF(2 4 ) 2 ;

[0034] (2.2) Solving the first isomorphism mapping matrix

[0035] The isomorphism mapping matrix is used to map the elements in the finite field GF(28 ) into tower field GF(2 4 ) 2 , and the isomorphic mapping matrix is solved by using the traversal verification method;

[0036] (2.2.1) initialize the search parameters, and set the initial value of the isomorphic mapping matrix T as:

[0037]

[0038] Let the set to be verified A = {1, 2, 3, …, 2 k -1}, where k represents the size of the field, and in the SM4 algorithm, k = 8 is taken;

[0039] (2.2.2) select the t-th element t from the set A in turn, t ∈ {1, 2, 3, …, 2 k -1};

[0040] (2.2.3) check whether the value of the element t is coprime with 2 k -1, if coprime, then t does not meet the requirement, let t = t + 1, and return to (2.2.2); if not coprime, continue to execute (2.2.4);

[0041] (2.2.4) let Q(y) be a binary polynomial for constructing the finite field GF(2 8 ), and P(z) be a binary polynomial for constructing the composite field GF(2 4 ) 2 , and the polynomials Q(y) and P(z) are respectively represented as:

[0042] Q(y) = y 8 +y 7 +y 6 +y 5 +y 4 +y 2 +1

[0043] P(z) = z 2 +z+v

[0044] where v = 1001, y ∈ GF(2), z ∈ GF(2 4 ), let δ be a prime element of GF(2 4 ) 2 , let P(δ) = δ 2 + δ + v = 0; it is assumed that the mapping relationship between the polynomials Q(y) and P(z) can be represented as a binary polynomial R(w) = w 4 +w+1, δ t is substituted into R(w), and R(δ t), if R(δ t ) ≠ 0, let t = t + 1 go to (2.2.2), otherwise continue to execute (2.2.5);

[0045] (2.2.5) Calculate the value of δ 0 , δ t , δ 2×t , δ 3×t , δ 4×t , δ 5×t , δ 6×t , δ 7×t , fill the resulting results into the expression of the isomorphic mapping matrix T:

[0046] T = [δ 7×t , δ 6×t , δ 5×t , δ 4×t , δ 3×t , δ 2×t , δ t , δ 0 ];

[0047] The value of the isomorphic mapping matrix T is obtained as:

[0048]

[0049] (2.3) According to the isomorphic mapping T matrix, the element inverse element calculation formula under the tower field decomposition is derived, assuming that the element X = e0x δ + e1, e 4 ∈ GF(2 2 ), i ∈ {0, 1} on GF((2 i ) 4 ), the inverse element X -1 = d0x δ + d1, d i ∈ GF(2 4 ), i ∈ {0, 1}, then:

[0050] Xx X -1 = (e1x δ + e0)(d1x δ + d0) = (e1x d1) x δ 2 + (e1x d0 + e0x d1) x δ + e0x d0 = 1;

[0051] Since δ satisfies P(δ) = δ 2 + δ + v = 0, substituting Xx X -1 gets:

[0052]

[0053] (2.4) According to the derivation in (2.3), the S-box of the SM4 algorithm after the decomposition of the tower domain can be split into two components, i.e. a 4-bit inverter and a 4-bit multiplier, as shown in Figure 2

[0054] (2.5) Referring to Figure 3 , for the 4-bit multiplier, a three-share method is used to construct a masking scheme. To ensure the second-order side-channel security of the scheme, first, three-share masking is performed on the two 4-bit inputs {x in ,y in} using four 4-bit random numbers {r0, r1, r2, r3}, and the expression is:

[0055]

[0056] The expression of the multiplier is obtained by multiplying the two component forms of the input:

[0057]

[0058] To ensure the second-order incompleteness, the masking calculation result is split into component functions:

[0059]

[0060]

[0061]

[0062] In the formula, {R1, R2, R3, R4, R5, R6} respectively represent a 4-bit additional random number for ensuring the uniformity of the output result, and the additional random number is added to the calculation result through a ring masker; const i represents a constant in the encryption process; a register is used to store the operation results of the three component functions respectively;

[0063] (2.6) Referring to Figure 4 , a masking scheme is designed for the 4-bit inverter. The truth table of the 4-bit inverter is known as:

[0064] [0×0, 0×1, 0×3, 0×2, 0×f, 0×c, 0×9, 0×b, 0×a, 0×6, 0×8, 0×7, 0×5, 0×e, 0×d, 0×4];

[0065] (2.6.1) According to the truth table, the Boolean expression of the 4-bit inverter is calculated as:

[0066] y0=x2x1x0+x3x0+x0+x1

[0067] ​y1 = x2x1x0 + x3x1x0 + x2x1 + x3x0 + x1

[0068] y2 = x2x1x0 + x3x2x0 + x3x1 + x0 + x1 + x2

[0069] y3 = x2x1x0 + x3x1x0 + x3x2x0 + x3x2x1 + x2x0 + x2x1 + x3x0 + x1 + x2 + x3

[0070] where i ∈ {0, 1, 2, 3}, x i denotes the i-th bit of the input value of the inverse, y i denotes the i-th bit of the output value of the inverse, in order to reduce the design difficulty of the 4-bit inverse mask scheme, an automatic search technique is used to find the mask scheme of the 4-bit inverse, let the initial value of i be 0, and the initial value of j be 0, j ∈ {0, 1, …, 15};

[0071] (2.6.2) Let the output component y i The corresponding component function expression is Initialization to empty;

[0072] (2.6.3) Let j be a 4-bit binary number, and assign each bit from high to low to the input variables x0, x1, x2, x3, respectively;

[0073] (2.6.4) Substitute the values of x0, x1, x2, x3 into the Boolean expression in (2.6.1), and add the calculation result to ;

[0074] (2.6.5) If j < 15, then let j = j + 1, jump to (2.6.3), otherwise continue to execute (2.6.6);

[0075] (2.6.6) Let the component function expression be multiplied by the corresponding output component y i expression to obtain the output component y i after masking:

[0076] y imask = f yi × y i ;

[0077] (2.6.7) If i < 3, then let i = i + 1, jump to (2.6.2), otherwise continue to execute (2.6.8);

[0078] (2.6.8) Generate a logic circuit according to the Boolean function expression.

[0079] (3) Based on the Boolean mask method, the mask scheme of the linear component is designed, refer to Figure 1 The linear components of the SM4 algorithm mainly include: a finite state machine, a key and state register, a random number generator, a linear layer, and a reverse sequence output sequence; the finite state machine is used for generating a control signal to control other modules to perform operations, and the power consumption change thereof will not cause secret information leakage, so that the mask protection is not required; a counter is arranged in the finite state machine to record the execution state of the mask SM4 algorithm, so as to ensure the correctness of the mask result;

[0080] The mask scheme design is performed on other linear components, and the specific process is as follows

[0081] (3.1) The mask design for the key and state register, in order to ensure that the mask can resist the second-order power consumption attack, a direct Boolean mask three-sharing scheme needs to be used, three registers are used to store the key and state intermediate value data, and the key and state register values are updated after each round of iteration encryption is performed;

[0082] The SM4 algorithm round function can be expressed as:

[0083]

[0084] Wherein i is in {0, 1,..., 31}, X i represents 32-bit input data, rk i represents 32-bit round keys, Sbox represents 32-bit output data obtained by inputting 32-bit data into four same Sboxes, and L represents a linear transformation used by the SM4 algorithm; in the initial stage, a random number generator is used to generate two random numbers with a length of 128 bits, which are used for masking of the main key and the input plaintext group respectively, and are stored in registers; the round function expression after the mask is:

[0085]

[0086] So as to obtain the mask scheme of the key and state;

[0087] (3.2) For the random number generator, the application uses a 20-stage linear feedback shift register to generate an additional random number, and a random number seed is generated for the 20-stage linear feedback shift register by a true random number generator when the FPGA chip is powered on; the primitive polynomial of the 20-stage linear feedback shift register used is:

[0088] f(a) = a 20 +a 8 +a 6 +a 5 +a 4 +a 3 +a 2 +a+1;

[0089] In the initial stage, the random number register value is initialized using a random number seed (a n-1 ,…,a1,a0);

[0090] In the next stage, the value of the random number register becomes:

[0091]

[0092] The result stored in the register changes once per clock cycle, where is generated by a shift, is generated by a linear feedback function f(a n-1 ,…,a1,a0), where g i denotes the coefficient of the corresponding term in the feedback function;

[0093] (3.3) For the linear layer, the algebraic expression is as follows:

[0094]

[0095] where B and H represent the 8-bit input and output values of the linear layer, respectively, T represents the isomorphic mapping matrix, A1, A2, C1, C2 are parameters used in the affine transformation of the SM4 algorithm, and then:

[0096]

[0097] In order to reduce the circuit area, when calculating the matrix multiplication, the elements with subscript 1 in the matrix are extracted, and the operations of AND and XOR are replaced by XOR in the matrix multiplication, and the optimized circuit logic expression is obtained as:

[0098]

[0099] where i∈{0,1,…,8}, b i represents the i-th bit of the 8-bit input, h i represents the i-th bit of the 8-bit output, and the use of this variable replacement reduces the use of 64 AND gates and 24 XOR gates compared with the bit-by-bit matrix multiplication operation;

[0100] (3.4) For the reverse output sequence, the algebraic expression of the logic circuit is:

[0101] (X 28 ,X 29 ,X 30 ,X 31 )→(X 31 ,X 30 ,X 29 ,X 28 );

[0102] After the mask, the output components of the three components need to be combined to obtain the calculation result after the unmasking, in order to ensure the security of the encryption process, only the three shared components are combined when the real ciphertext data is finally output, and the intermediate value data is not combined and unmasked, and the algebraic expression is:

[0103]

[0104] The components are combined to obtain the output result, and the final encrypted real ciphertext data is obtained.

[0105] (4) The SM4 algorithm mask scheme is constructed, and the specific process is as follows:

[0106] (4.1) According to the function and execution sequence of each component, the components are connected;

[0107] (4.2) Using the job exchange technology, the mask result of each round of SM4 algorithm is saved to the register, and in the next round of mask, it is used as an additional random number input, reducing the use of random numbers;

[0108] (4.3) Using the method of manual layout and wiring, the positions of the components are adjusted to shorten the wiring length, the circuit layout of the SM4 algorithm implementation is optimized, and the final mask scheme is formed.

[0109] The present application proposes a new method of SM4 second-order threshold mask, which is different from the existing method, the method is based on polynomial basis and uses one isomorphic mapping to realize the tower field decomposition of SM4 algorithm S box, and the SM4 algorithm encryption module is divided into smaller components; based on the threshold mask theory, the mask scheme is designed for each component, for the SM4 algorithm S box after tower field decomposition, the optimal threshold mask meeting the condition is searched by using the automatic search means, and the job exchange technology is introduced to realize random number reuse, reduce the use of random numbers in the mask scheme, ensure that the algorithm can effectively resist the second-order power attack, and reduce the hardware resource overhead.

Claims

1. An SM4 second-order threshold masking method, characterized in that, Comprising the following steps: (1) SM4 algorithm is disassembled into components The functions and input-output results of different modules of the SM4 algorithm are analyzed, and the SM4 algorithm is disassembled into nonlinear components and linear components according to the characteristics of linearity and nonlinearity; For the SM4 algorithm, the nonlinear component is the S-box of the algorithm, and the linear component includes: finite state machine, key and state register, random number generator, linear layer, and reverse output sequence; (2) Based on the tower domain decomposition and threshold masking method, a masking scheme for the nonlinear component is designed Using the tower domain decomposition method, the nonlinear S-box is split into a 4-bit inverter and a 4-bit multiplier; For the 4-bit inverter, an automatic search tool is used to search for a masking scheme; For the 4-bit multiplier, a three-shared masking scheme is used to ensure that the algorithm resists second-order power attacks, and a ring masker is designed to reduce the circuit area of the multiplier; (3) Based on the Boolean masking method, a masking scheme for the linear component is designed The finite state machine in the linear component of the SM4 algorithm is used to generate control signals to control other modules to perform operations, and the power consumption change will not cause secret information leakage, so it does not need to be masked for protection; other linear components use the direct Boolean masking method to design the masking scheme; (4) Complete the construction of the SM4 algorithm masking scheme According to the execution process of the SM4 algorithm, connect each component, reuse the random number in the algorithm, and optimize the circuit layout to form the final masking scheme; The specific process of step (2) is as follows: (2.1) The S-box is decomposed into a tower domain using a method based on polynomial bases, in order to achieve decomposition from a finite field. To the Tower Domain The decomposition of the finite field into a tower domain first requires solving for an isomorphism mapping matrix. This matrix is ​​used to map elements in the finite field to elements in the tower domain. Then, the finite field is derived. The formula for calculating the inverse element in the tower domain The representation in; (2.2) Solve the isomorphic mapping matrix An isomorphic mapping matrix is used to map elements in a finite field to elements in a tower field An isomorphic mapping matrix is solved using a method of traversal verification. (2.2.1) Initialize the search parameters, and set the initial value of the isomorphic mapping matrix T as: ； Set to be verified where k represents the size of the field, in the SM4 algorithm, take ; (2.2.2) selecting the t-th element t from the set A in turn, ; (2.2.3) check if the value of element t is coprime with coprime, if not, t does not satisfy the requirement, let t = t + 1, return (2.2.2); if coprime, continue to execute (2.2.4); (2.2.4) Let be a binary polynomial constructing the finite field , be a binary polynomial constructing the composite field , , be represented as ； wherein , , let be a prime element of , let ; the mapping relationship between the polynomials and is expressed as a binary polynomial , substitute into , calculate , if , let jump to (2.2.2), otherwise continue to execute (2.2.5); (2.2.5) Compute the value of the expression for the isomorphism matrix T, filling the resulting result into the expression for the isomorphism matrix T: ； The value of the isomorphic mapping matrix T is: ； (2.3) According to the isomorphic mapping T matrix, the element inverse element calculation formula under the tower field decomposition is derived, let The element on Its inverse element Then we have: ； Also because Satisfies , substitute Get: ； (2.4) According to the derivation in (2.3), the tower domain decomposed SM4 algorithm S-box can be split into two components, i.e. 4-bit inverter and 4-bit multiplier; (2.5) For 4-bit multiplier, the three-share method is used to construct the masking scheme. To ensure the second-order side-channel security of the scheme, first, four 4-bit random numbers are used to mask the two 4-bit inputs and the expression is as follows: ； The expression of the multiplier is obtained by multiplying the two component forms of the input: ； In order to ensure the second-order incompleteness, the masking calculation result is split into component functions: ； In the formula respectively represent a 4-bit additional random number, used to ensure the uniformity of the output result, and the additional random number is added to the calculation result through a ring masker; represent a constant in the encryption process; use a register to store the operation results of the three component functions respectively; (2.6) Design a masking scheme for the 4-bit inverter, and the truth table of the 4-bit inverter is known as: ； (2.6.1) According to the truth table, the Boolean expression of the 4-bit inverter is calculated as: ； In the formula , x i represents the i-th bit of the input value of the inverter, y i represents the i-th bit of the output value of the inverter, in order to reduce the design difficulty of the 4-bit inverter mask scheme, an automatic search technology is used to find the mask scheme of the 4-bit inverter, the initial value of i is 0, and the initial value of j is 0, ; (2.6.2) Set the output component The corresponding component function expression is , initialize to empty; (2.6.3) Let j be represented as a 4-bit binary number, and assign each bit of it from the high bit to the low bit to the input variable ; (2.6.4) Substitute the value of into the Boolean expression in (2.6.1) and add the result of the calculation to ; (2.6.5) If then let jump to (2.6.3), otherwise continue with (2.6.6); (2.6.6) Let component function expression with the corresponding output component The expression is multiplied by the output component The expression after masking: ； (2.6.7) If then let jump to (2.6.2), otherwise continue with (2.6.8); (2.6.8) Generate a logic circuit according to the Boolean function expression; The specific process of step (3) is as follows (3.1) For the key and state register masking design, use a three-register direct Boolean masking scheme to store the key and state intermediate value data, and update the key and state register values after each round of iteration encryption is completed; The SM4 algorithm round function is represented as: ； wherein , X i represents 32-bit input data, rk i represents 32-bit round key, Sbox represents 32-bit data input into 4 identical S-boxes to obtain 32-bit output data, L represents a linear transformation used by the SM4 algorithm; in the initial stage, a random number generator is used to generate 2 random numbers with a length of 128 bits, which are respectively used for masking of the master key and input plaintext grouping, and are respectively stored in a register, and the round function expression after masking is: ； Thus, the key and state masking scheme is obtained; (3.2) For the random number generator, a 20-stage linear feedback shift register is used to generate additional random numbers, and a true random number generator is used to generate a random number seed when the FPGA chip is powered on; the primitive polynomial of the 20-stage linear feedback shift register used is: ； In an initial phase, a random number seed is used Initialize random number register value; In the next stage, the value of the random number register becomes: ； The register-stored result changes once per clock cycle, where is generated by a displacement, is generated by a linear feedback function where denotes the coefficient of the corresponding term in the feedback function; (3.3) For linear layer, its algebraic expression is as follows: ； In the formula, B and H respectively represent linear layer 8-bit input and output values, T represents an isomorphic mapping matrix, is a parameter used in the affine transformation of the SM4 algorithm, and then ； In order to reduce the circuit area, when calculating the matrix multiplication, the elements with subscript 1 in the matrix are extracted, and the operation of and, XOR in the matrix multiplication is replaced by XOR to obtain the optimized circuit logic expression: ； wherein , b i represents the i-th bit of an 8-bit input, h i represents the i-th bit of an 8-bit output, using argument substitution as opposed to a bit-by-bit matrix multiplication operation reduces the use of 64 AND gates and 24 XOR gates; (3.4) For the reverse output sequence, the algebraic expression of the logic circuit is as follows: ； After masking, the output components of the three components need to be combined to obtain the calculation result after unmasking. In order to ensure the security of the encryption process, only the three shared components are combined when the real ciphertext data is finally output, and the intermediate value data will not be combined and unmasked. The algebraic expression is as follows: ； Combine each component to obtain the output result and obtain the final encrypted real ciphertext data.

2. The SM4 second-order threshold mask method of claim 1, wherein, Step (4) completes the construction of the SM4 algorithm masking scheme, and the specific process is as follows: (4.1) According to the function and execution order of each component, connect each component; (4.2) Use the job change technology to save the masking result of each round of SM4 algorithm to the register, and use it as an additional random number input in the next round of masking to reduce the use of random numbers; (4.3) Use the manual layout and wiring method to adjust the position of each component to shorten the wiring length and optimize the circuit layout of SM4 algorithm implementation to form the final masking scheme.

Images