Gcm optimization method and system based on block cipher algorithm and bit slice

Abstract

This invention discloses a GCM optimization method and system based on block cipher algorithms and bit slicing, belonging to the field of cryptographic algorithm technology. The input sequence is converted from standard block form to bit slice form using a data form conversion algorithm. The bit slice form data is used as input to the block cipher algorithm, and after multiple rounds of iterative computation, the output sequence, still in bit slice form, is obtained. The proposed friendly variant omits the data form conversion (i.e., backward conversion) at the output of the parallel block cipher algorithm, directly XORing the plaintext blocks in standard form with the bit slice form output sequence to obtain the ciphertext output. While ensuring security, the optimized GCM yields a friendly variant GCM mode based on bit slice implementation. + This reduces the overhead of data format conversion throughout the authentication and encryption process.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cryptographic algorithm, and particularly relates to a GCM optimization method and system based on block cipher algorithm and bit slicing. BACKGROUND

[0002] The statements in this section merely provide background information related to the present application and do not necessarily constitute the prior art.

[0003] For cryptographic algorithms, there are many strategies for fast software implementation, and the most simple and efficient one is to use custom instruction set extensions, of which a typical example is the AES extension instruction set (Advanced Encryption Standard New Instructions, AES-NI). AES-NI has been embedded in many Intel and AMD processors, which significantly improves the speed of application programs when using AES to complete encryption and decryption. For cryptographic algorithms that lack instruction set extensions, the bit slicing technique is considered an effective strategy for fast software implementation, which involves converting the cryptographic algorithm into a series of logical bit operations, so that an n-bit processor can simultaneously complete parallel encryption processing on n groups. Therefore, when the hardware implementation complexity of the target cryptographic algorithm is small and the underlying processor has a sufficient number of long registers, the software implementation using the bit slicing technique can be more efficient.

[0004] Figure 1 Galois / Counter Mode (GCM) is a widely used authenticated encryption scheme designed by McGrew and Viega, which is constructed according to a block cipher algorithm with a block length of 128 bits, such as the Advanced Encryption Standard (AES). It adopts the Encrypt-then-MAC mode, which combines the Counter (CTR) mode with the Wegman-Carter Message Authentication Code (MAC) based on the block cipher. The MAC uses a general hash function defined in the binary Galois field.

[0005] However, the inventors discovered that traditional GCM implementations based on bit slicing still have shortcomings: for encryption algorithms using bit slicing strategies, execution speed or throughput largely depends on the number of logic gates required to implement the encryption algorithm, and optimizing the bit slicing implementation of the encryption algorithm by minimizing the number of logic gates is a logical approach. However, the overhead incurred during the conversion between standard block cipher form and bit slicing form when using bit slicing strategies is also not negligible. Traditional GCM implementations based on block cipher algorithms and bit slicing undergo two data form conversions: one from standard block form to bit slicing form before encryption begins, and another from bit slicing form back to standard block form after encryption. For the conversion after encryption, since the ciphertext output is always randomly and uniformly distributed without any regularity, it is difficult to perform targeted optimization. Therefore, reducing the cost of the two data form conversion processes without changing security has become a technical problem that urgently needs to be solved in the current technology. Summary of the Invention

[0006] To address the shortcomings of existing technologies, the purpose of this invention is to provide a GCM optimization method and system based on block cipher algorithms and bit slicing. While ensuring security, it provides a user-friendly variant of the GCM mode implemented based on bit slicing. + This reduces the overhead of data format conversion throughout the authentication and encryption process.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solution:

[0008] The first aspect of this invention provides a GCM optimization method based on block cipher algorithms and bit slicing, comprising the following steps:

[0009] Convert the data format of the counter blocks to be encrypted; convert them from standard block format to bit slice format;

[0010] The calculation is performed on the counter blocks in the form of bit slices based on the block cipher algorithm;

[0011] The calculation result is XORed with the plaintext block in standard form to obtain the ciphertext output.

[0012] Furthermore, the length of the "nonce" part is fixed at 96 bits, and the length of the "counter" part is fixed at 32 bits.

[0013] Furthermore, the values ​​of the counter groups to be encrypted are all different.

[0014] Furthermore, the specific process of calculating the counter blocks in bit slice form based on the block cipher algorithm is as follows: the data in bit slice form is used as the input of the SM4 block cipher algorithm, and after multiple rounds of iterative operation of the function, the output sequence in bit slice form is obtained.

[0015] Furthermore, the specific process of ciphertext output is as follows: the output sequence in the form of 128-bit slices from the beginning and end of the register is XORed with two 128-bit plaintext blocks respectively to generate multiple 128-bit ciphertext outputs.

[0016] Furthermore, for the output ciphertext, a finite field multiplication is called to obtain the authentication tag.

[0017] Furthermore, a hash function based on finite field multiplication is invoked to compress the ciphertext output into an authentication tag of a certain length to ensure integrity.

[0018] A second aspect of the present invention provides a GCM optimization system based on block cipher algorithms and bit slicing, comprising:

[0019] The data conversion module is configured to convert the data format of the counter blocks to be encrypted from standard block format to bit slice format.

[0020] The block cipher module is configured to compute counter blocks in the form of bit slices based on a block cipher algorithm;

[0021] The ciphertext output module is configured to perform an XOR operation between the calculation result and the plaintext block in standard form to obtain the ciphertext output.

[0022] A third aspect of the present invention provides a medium having a program stored thereon, which, when executed by a processor, implements the steps in the GCM optimization method based on block cipher algorithms and bit slicing as described in the first aspect of the present invention.

[0023] A fourth aspect of the present invention provides an apparatus including a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps in the GCM optimization method based on block cipher algorithm and bit slicing as described in the first aspect of the present invention.

[0024] The above one or more technical solutions have the following beneficial effects:

[0025] This invention discloses a GCM optimization method based on block cipher algorithms and bit slicing. In the implementation of bit slicing, the input sequence needs to be converted from standard block form to bit slice form using a data form conversion algorithm. The bit slice form data serves as the input to the block cipher algorithm, and after multiple rounds of iterative computation, the output sequence is still in bit slice form. The friendly variant proposed in this invention omits the data form conversion (i.e., backward conversion) at the output of the parallel block cipher algorithm, directly XORing the plaintext blocks in standard form with the bit slice form output sequence to obtain the ciphertext output. While ensuring security, the optimized GCM yields a friendly variant GCM mode based on bit slice implementation. +， This reduces the overhead of data format conversion throughout the authentication and encryption process.

[0026] The friendly variant of the authentication encryption mode of this invention, GCM + The security of this method remains unchanged from the original GCM because the output of the parallel block cipher algorithm, whether in standard block form or bit slice form, should be randomly and uniformly distributed. Therefore, the 128-bit ciphertext output obtained by XORing the plaintext in standard 128-bit block form should also be randomly and uniformly distributed. Furthermore, after obtaining the ciphertext output, a hash function based on finite field multiplication is called to compress the ciphertext output into an authentication tag of a certain length to ensure integrity.

[0027] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0028] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0029] Figure 1 Here is a flowchart of the existing GCM encryption process;

[0030] Figure 2 This is a schematic diagram of the counter grouping structure according to Embodiment 1 of the present invention;

[0031] Figure 3 This is an embodiment of the GCM of the present invention. + The encryption process flowchart. Detailed Implementation

[0032] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0033] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0034] Terminology Explanation:

[0035] nonce: nonce is short for Number once. In cryptography, nonce is an arbitrary or non-repeating random value that is used only once. In this embodiment, a 96-bit "nonce" part is randomly generated.

[0036] Counter: A counter is an unordered container used to record the number of times various values ​​occur. In this embodiment, the 32-bit "counter" part is incremented (+1), making the values ​​of each counter group distinct.

[0037] It is known that bit-slice implementations can fully support the parallel operation mode of block cipher algorithms, such as the Authentication Code Mode (GCM). However, applications based on bit-slice implementations inevitably involve the conversion of data between standard block format and bit-slice format; in other words, this data format conversion is indispensable in bit-slice implementations. Data format conversion includes both forward conversion from standard block format to bit-slice format and backward conversion from bit-slice format back to standard block format. Considering the non-negligible overhead of data format conversion, in addition to optimizing existing conversion algorithms, this invention also proposes a user-friendly variant of GCM, GCM. + Its implementation process is simpler and more efficient because it no longer requires a post-transformation, while still maintaining the same security as the original authentication encryption mode, GCM. The specific implementation process is as follows:

[0038] Example 1:

[0039] Embodiment 1 of the present invention provides a GCM optimization method based on block cipher algorithms and bit slicing, comprising the following steps:

[0040] like Figure 2As shown, step 1: fix the length of the "nonce" part of the counter group to be encrypted to 96 bits, and fix the length of the "counter" part to 32 bits.

[0041] Step 2: Use a set of distinct counter group values ​​(usually incrementing the current counter value by +1 to obtain the next counter value) as the input sequence for the block cipher algorithm.

[0042] Step 3: Convert the data format of the counter blocks to be encrypted; convert them from standard block format to bit slice format;

[0043] Step 4: Calculate the counter blocks in bit slice form based on the block cipher algorithm; XOR the calculation result with the plaintext blocks in standard form to obtain the ciphertext output.

[0044] As a further technical solution, the specific process of calculating the counter blocks in bit slice form based on the block cipher algorithm is as follows: the data in bit slice form is used as the input of the SM4 block cipher algorithm, and after multiple rounds of iterative operation of the function, the output sequence in bit slice form is obtained.

[0045] As a further technical solution, the specific process of ciphertext output is as follows: directly take the output sequence in the form of 128-bit slices from the beginning and end of the register and XOR it with two 128-bit plaintext blocks respectively to generate multiple 128-bit ciphertext outputs.

[0046] Step 5: For the output ciphertext, use finite field multiplication to obtain the authentication tag.

[0047] As a further technical solution, a hash function based on finite field multiplication is invoked to compress the ciphertext output into an authentication tag of a certain length to ensure integrity.

[0048] This invention primarily focuses on the authentication and encryption phase of GCM. It references recommendations from multiple standard documents, such as... Figure 2 As shown, in this invention, the length of the "nonce" part is fixed at 96 bits, and the length of the "counter" part is fixed at 32 bits. The specific encryption process is as follows: Let the nonce input be N∈{0,1} 96 The message input is M∈{0,1} * The encryption function can then be represented as GCM.Enc k (N, M). The concatenation of N and the integer 2 ((N||2) = 128 bits) serves as the initial value for the counter grouping, completing the operation in counter (CTR) mode: C = GCTR k (N, M). By calling GHASH H(C) Compresses the ciphertext into a digest to ensure integrity, where H is the encrypted 128-bit block 0. 128 The resulting hash key is H = Enc k (0 128 If we write C as a 128-bit block, i.e., C = (C1, C2, ..., Cn), then we have Where · represents finite field multiplication, GF(2 128 From the irreducible polynomial P = x 128 +x 7 +x 2 It can be constructed by adding x and 1. Alternatively, it can be calculated repeatedly. Get GHASH H (C), i = 0, 1, ..., n, and the modulo operation is also performed based on the aforementioned finite field. Finally, the authentication tag T, consisting of t bits, is a truncated... The result was obtained.

[0049] The proposed user-friendly variant omits the data format transformation (i.e., backward transformation) at the output of the parallel block cipher algorithm. Instead, it directly XORs the plaintext blocks in standard form with the bit-slice output sequence to obtain the ciphertext output. Assuming a 256-bit long register YMM0~YMM is used in an Intel processor... 15 Specifically, the software implementation of this invention is based on the x86 architecture and uses general-purpose registers YMM0 to YMM0. 15 There are 16 in total, and each general-purpose register has a bit width of 256 bits. Figure 3 The block cipher section indicates the SM4 block cipher algorithm (standard plaintext block length is 128 bits). The output sequence of 128 bits from the beginning and end of the register can be XORed with two 128-bit plaintext blocks respectively to produce multiple 128-bit ciphertext outputs.

[0050] This invention argues that the security of the friendly variant GCM+ of the authentication encryption mode remains unchanged from the original GCM because the output of the parallel block cipher algorithm, whether in the form of standard blocks or bit slices, should be randomly and uniformly distributed. Therefore, the 128-bit ciphertext output obtained by XORing the plaintext in the form of 128-bit standard blocks should also be randomly and uniformly distributed.

[0051] Example 2:

[0052] Embodiment 2 of the present invention provides a GCM optimization system based on block cipher algorithms and bit slicing, comprising:

[0053] The data conversion module is configured to convert the data format of the counter blocks to be encrypted from standard block format to bit slice format.

[0054] The block cipher module is configured to compute counter blocks in the form of bit slices based on a block cipher algorithm;

[0055] The ciphertext output module is configured to perform an XOR operation between the calculation result and the plaintext block in standard form to obtain the ciphertext output.

[0056] Example 3:

[0057] Embodiment 3 of the present invention provides a medium on which a program is stored. When the program is executed by a processor, it implements the steps in the GCM optimization method based on block cipher algorithm and bit slicing as described in Embodiment 1 of the present invention.

[0058] Example 4:

[0059] Embodiment 4 of the present invention provides a device including a memory, a processor, and a program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps in the GCM optimization method based on block cipher algorithm and bit slicing as described in Embodiment 1 of the present invention.

[0060] The steps and methods involved in Embodiments 2, 3, and 4 above correspond to those in Embodiment 1. For specific implementation details, please refer to the relevant description section of Embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood as including any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and enabling the processor to perform any of the methods in this invention.

[0061] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computer devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computer device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. The present invention is not limited to any particular combination of hardware and software.

[0062] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A GCM optimization method based on a block cipher algorithm and bit slicing, characterized in that, The method comprises the following steps: data form conversion is performed on the counter block to be encrypted; from the standard block form to the bit slice form; calculation is performed on the counter block in the bit slice form based on the block cipher algorithm; the specific process of the calculation on the counter block in the bit slice form based on the block cipher algorithm is that the data in the bit slice form is taken as the input of the SM4 block cipher algorithm, and after the iteration operation of multiple rounds of functions, an output sequence in the bit slice form is obtained; the calculation result is subjected to an exclusive or operation with the plaintext block in the standard form to obtain the ciphertext output; the specific process of the ciphertext output is that the output sequence in the bit slice form in each of the 128-bit registers is directly subjected to an exclusive or operation with the two 128-bit plaintext blocks to generate multiple 128-bit ciphertext outputs. The GCM optimization method omits the data form conversion at the output of the parallel block cipher algorithm, directly performs an exclusive or operation between the plaintext block in the standard form and the output sequence in the bit slice form, and obtains the ciphertext output.

2. The GCM optimization method based on a block cipher algorithm and bit slicing of claim 1, wherein, The length of the "nonce" part is fixed as 96 bits, and the length of the "counter" part is fixed as 32 bits.

3. The GCM optimization method based on a block cipher algorithm and bit slicing of claim 1, wherein, The values of the counter blocks to be encrypted are different from each other.

4. The GCM optimization method based on a block cipher algorithm and bit slicing of claim 1, wherein, For the output ciphertext, a finite field multiplication is called to obtain an authentication tag.

5. The GCM optimization method based on a block cipher algorithm and bit slicing as claimed in claim 4, wherein, A hash function based on the finite field multiplication is called to compress the ciphertext output into an authentication tag of a certain length to ensure the integrity.

6. A GCM optimization system based on a block cipher algorithm and bit slicing, characterized in that, The method comprises the following steps: a data conversion module configured to perform data form conversion on the counter block to be encrypted; from the standard block form to the bit slice form; a block cipher module configured to perform calculation on the counter block in the bit slice form based on the block cipher algorithm; the specific process of the calculation on the counter block in the bit slice form based on the block cipher algorithm is that the data in the bit slice form is taken as the input of the SM4 block cipher algorithm, and after the iteration operation of multiple rounds of functions, an output sequence in the bit slice form is obtained; a ciphertext output module configured to perform an exclusive or operation between the calculation result and the plaintext block in the standard form to obtain the ciphertext output; the specific process of the ciphertext output is that the output sequence in the bit slice form in each of the 128-bit registers is directly subjected to an exclusive or operation with the two 128-bit plaintext blocks to generate multiple 128-bit ciphertext outputs. The GCM optimization system omits the data form conversion at the output of the parallel block cipher algorithm, directly performs an exclusive or operation between the plaintext block in the standard form and the output sequence in the bit slice form, and obtains the ciphertext output.

7. A computer readable storage medium characterized in that, The computer readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded and executed by the processor of the terminal device to implement the GCM optimization method based on the block cipher algorithm and the bit slice.

8. A terminal device, characterized by, The computer readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded and executed by the processor of the terminal device to implement the GCM optimization method based on the block cipher algorithm and the bit slice.

Images