A white-box block cipher encryption method and system using matrix transformation to construct a lookup table

Abstract

The present invention discloses a white-box block cipher encryption method and system that uses matrix transformation to construct a lookup table. The invention mainly solves the problems of low efficiency of encryption and decryption operations of existing white-box cryptographic algorithms, insufficient security against various attack methods, and large storage space overhead by designing a generalized unbalanced Feistel structure round function and white-boxing it, and can be applied to various scenarios with a small memory occupancy. The method includes applying the designed cryptographic algorithm encryption round function to perform multiple rounds of iterations on plaintext data, and using a matrix-transformed lookup table to hide the encryption key during the encryption and decryption process to ensure security. Lightweight ARX operations are mainly used in the algorithm round function, and data diffusion is completed using modular addition, circular shift, XOR, and bitwise AND basic operations. The method provided by the present invention can effectively ensure the computing efficiency and security in the process of data encryption and decryption, and can reduce storage space occupancy and resist various attacks.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security, and specifically designs an 8-branch white box block cipher encryption method based on XOR, modular addition, cyclic shift and AND operations and using matrix transformation to construct a lookup table. Background Art

[0002] Block ciphers are deployed on a variety of untrusted terminals, which can be regarded as terminals in white-box attack environments and face the risk of being obtained by attackers or even tampered with. For hardware devices that are greatly affected by memory, block cipher algorithms with small footprint and high security should be used to ensure security in white-box environments. White-box block ciphers have the advantages of fast encryption and decryption speed, high security, and easy deployment of software and hardware platforms, and can be applied to a variety of environments.

[0003] Deukjo Hong et al. published an article titled "HIGHT: A New Block Cipher Suitable for Low-Resource Device" (In Proceedings of 8th International Workshop on Cryptographic Hardware and Embedded Systems. Springer, Berlin, Heidelberg, 2006: pp. 46-59) which discloses a lightweight block cipher algorithm HIGHT. The lightweight block cipher algorithm is based on an ARX structure, with a data block length of 64 bits, a key length of 128 bits, and 32 iterations. It can be used for hardware implementation in resource-constrained environments that do not require high encryption and decryption operation rates, and can provide high security at a lightweight size. However, some of the algorithm's operation functions have a large number of operations on an 8-bit microcontroller, which affects the implementation efficiency, and does not consider security in a white-box environment.

[0004] Patent document 1 (publication number: CN113541942A, publication date: October 22, 2021) discloses a digital content encryption and decryption method based on the ARX white-box block cipher. This method performs ARX loop operations and AES algorithm round function operations during the encryption process and generates a lookup table to encrypt and decrypt digital content. However, the method is relatively complex in constructing the white-box cryptographic algorithm lookup table, which affects the algorithm's operational efficiency to a certain extent.

[0005] Patent document 2 (publication number: CN111431697A, publication date: July 17, 2020) discloses a method for implementing a new lightweight block cipher CORL. This method designs a new structure algorithm through a generalized Feistel structure, so that one round of iteration can change three-quarters of the packet data without requiring too many hardware resources. However, this method only describes the encryption and decryption process of the packet data, and does not consider the deployment issues in vulnerable environments. In the current situation where white-box attacks are becoming more frequent, the ability to deal with white-box attacks has not yet been taken into account by this method.

[0006] Through the analysis of the above literature, we can know that the main problems of the current block cipher algorithm are mainly in two aspects: on the one hand, the operation efficiency is not high and it is not suitable for lightweight hardware and software implementation; on the other hand, the security is insufficient and does not consider various attack environments, especially the resistance in the white box attack environment. The new white box block cipher algorithm designed by the present invention can not only apply the lightweight ARX structure to reduce storage space and improve operation efficiency, but also implement it in a white box manner under the premise of ensuring operation efficiency, so as to better deal with attacks in the white box environment and provide good security to deal with various attacks. Summary of the invention

[0007] From the perspectives of computational efficiency and white-box environment security, this paper designs an 8-branch white-box block cipher algorithm that uses matrix transformation to construct a lookup table, abandons the S-box in traditional block ciphers, occupies less memory, and has higher computational efficiency. In addition, the algorithm is implemented in a white-box manner by designing a lookup table, taking into account the security in a white-box environment, and achieving the design goal of security and efficiency.

[0008] The present invention can solve the problems of low efficiency and insufficient security in block ciphers through the above two designs. The technical solution of the present invention includes:

[0009] A white box block cipher encryption method using matrix transformation to construct a lookup table comprises the following steps:

[0010] Step S1: Preprocessing of plaintext data. The 128-bit plaintext is used as the first round of encrypted data and divided into 8 blocks from low to high bits. The length of each block is 16 bits, which are respectively denoted as X 0 , X 1 , X 2 , X 3 , X 4 , X 5 , X 6 , X 7 The initial key is 128 bits, expressed as Mk = (Mk 7 ,Mk 6 ,…,Mk0 ), the algorithm's public key rk i (i=0,1,…,7) and round key sk i (i=0,1,…,191) is generated by the key generation algorithm in step S2;

[0011] Step S2: Key generation algorithm. The key generation algorithm of this cryptographic algorithm is divided into two parts, namely the generation of 8 public keys and the generation of 192 round keys:

[0012] (2a) Public key generation algorithm: i=2,…,7;rk 0 =Mk 0 rk 1 =Mk 1 ;

[0013] (2b) Round key generation algorithm:

[0014]

[0015] is a finite field modulo mod2 16 Addition operation, δ j It is a preset 2-byte hexadecimal constant. j>7 , modulo MK 0-7 The master key Mk is then updated by the above method;

[0016] Step S3: Round function encryption. The 8 plaintext data blocks in step S1 enter the 8 branches of the encryption round function of the cryptographic algorithm from low to high bits respectively:

[0017] (3a) Perform initial transformation on plaintext X: Subsequent P 1 -P 7 According to the round function algorithm, circular shift, bitwise AND, modular addition and XOR operations are performed respectively.

[0018] (3b) Record the encrypted intermediate variable after circular shift and bitwise AND

[0019] M i =[(P i <<<1)&(P i <<<5)]&(P i <<<7)i=0,4;M j =[(P j <<<2)&(P j <<<4)]&(P j <<<6)j=2,6;

[0020] (3c) The first round of encryption result after modular addition and XOR mixing operation is

[0021] The length of each block data is 16 bits, which are used as the data to be encrypted in the second round of encryption for iteration;

[0022] Step S4: The encryption round function generates a lookup table. Each round of the cryptographic algorithm is made into a lookup table using a partial assignment method to hide the key information, thus achieving a white-box effect on the cryptographic algorithm. Even if the lookup table details are fully disclosed, an attacker cannot directly extract the key information from the lookup table.

[0023] The process of generating a white-box lookup table is to convert one round of encryption into 64 lookup tables. The detailed steps of constructing the lookup table are:

[0024] Step S1: Take the input X of the first round branch 1 0 For example, enter X 0 For 16-bit binary data, the first round of encryption is performed.

[0025]

[0026] Income X 0 ' is the input of branch 3 of the second iteration, which is still 16-bit data. The results obtained by the remaining 7 branches correspond to different branches of the second iteration;

[0027] Step S2: Convert the The result of the operation is converted into a matrix form. The input and output of this operation can hide the key information. B1, B2, B3, and B4 are small matrices in the block matrix. The matrix operation combines these matrices according to specific rules.

[0028] Step S3: Obfuscate the mapping relationship between input and output through encoding. Represent each small matrix split in step S2 as a lookup table, which can obtain the output corresponding to the input, but the intermediate data has been obfuscated. At this time, 64 lookup tables can be designed for a round of 8 branches. The input and output of each round of iteration can be obtained through the table lookup operation, but the key information will not be leaked;

[0029] Step S4: Each possible 8-bit input corresponds to an 8-bit output, so the size of each constructed lookup table is 2 8 ×8=256 bytes, 64 lookup tables are made in each round, and the algorithm has 48 rounds of iterations. Therefore, the memory space occupied by this white box cryptographic algorithm is 256 bytes.

[0030] ×64×48=768KB.

[0031] New white box block cipher algorithm This cipher algorithm has 48 rounds of iterative round functions. The details are as follows:

[0032] Inter-round iteration: The iteration uses a 48-round generalized unbalanced Feistel round function structure, and the branch iteration rule is: from the left, branch 1 enters branch 3 of the next round, branch 2 enters branch 5 of the next round, branch 3 enters branch 7 of the next round, branch 4 enters branch 8 of the next round, branch 5 enters branch 1 of the next round, branch 6 enters branch 2 of the next round, branch 7 enters branch 4 of the next round, and branch 8 enters branch 6 of the next round;

[0033] Public key participation calculation: 8 public keys rk generated by the above key generation algorithm i (i=0,1,…,7), which are applied before the first round and after the 48th round of the algorithm respectively. i (i=0,1,2,3) acts on the odd-numbered branches before the first round, rk i (i=4,5,6,7) acts on the even-numbered branches after the last round, and acts as XOR or modulo 2 16 Addition operation.

[0034] The encryption and decryption of the white-box cryptographic algorithm using matrix transformation to construct a lookup table requires external encoding.

[0035] Details include:

[0036] The overall encryption process of the algorithm: The overall encryption process of the new white box block cipher algorithm under the action of 8 public keys and 192 round keys is E k , the encryption process is an overall process including 48 rounds of iterative round functions;

[0037] External coding: 16-bit random numbers deployed on an external hardware platform and applied to 8 branches, which has a data obfuscation effect. After input and output coding, an overall algorithm structure including a lookup table can be formed. The operation corresponding to the external coding is converted into a block matrix, and the random number XORed by each branch generates a different block matrix, which is offset by the lookup table formed after the branch operation. At this time, the external input and output coding can offset the internally formed lookup table, which will not affect the overall operation and encryption and decryption process of the algorithm, but the external coding will reduce the operation efficiency to a certain extent to improve security.

[0038] A white box block cipher decryption method using matrix transformation to construct a lookup table comprises the following steps:

[0039] Step S1: Preprocessing of ciphertext data. The encrypted 128-bit ciphertext is used as the first round of decryption data and divided into 8 blocks from low to high, each block is 16 bits long, and is recorded as Y 0 , Y 1 , Y 2 , Y 3 , Y 4 , Y 5 , Y 6 , Y 7 The updated master key is 128 bits, expressed as Mk'=(Mk' 7 ,Mk' 6 ,…,Mk' 0 ), the algorithm's public key rk i (i=0,1,…,7) and round key sk i (i=0,1,…,191) is generated by the aforementioned key generation algorithm;

[0040] Step S2: Use the keys in reverse order. The public key of this cryptographic algorithm is only used in the first and last rounds of decryption. The first round of decryption is used on the even branches, and the last round of decryption is used on the odd branches. Round key sk j (j=0,1,…,191) The order of use is opposite to that of encryption, that is, the first round of decryption uses sk 188 -sk 191 , decryption last round using sk 0 -sk 3 ;

[0041] Step S3: round function decryption. The 8 ciphertext data blocks enter the 8 branches of the decryption round function of the cryptographic algorithm from low to high bits, and reverse decryption is performed according to the branch path during encryption. The XOR operation during decryption is the same as that during encryption, and the modulo 2 16 Addition becomes modulo 2 16 Subtraction operation, the circular left shift operation becomes a circular right shift operation. After 48 rounds of iterations, the encrypted 128-bit ciphertext can be decrypted back to the input 128-bit plaintext;

[0042] Step S4: Decryption table lookup operation. The lookup table generated after each round of encryption of the cryptographic algorithm is subjected to an inverse operation, and the input and output values ​​in the decryption process can be obtained through the table lookup operation in the decryption process to protect the key information.

[0043] Through the above technical solution, it can be shown that the advantages of the invention are:

[0044] First, based on basic operations such as XOR, modular addition, circular shift, and AND operations, a new type of generalized unbalanced Feistel structure 8-branch block cipher was designed. This cryptographic algorithm achieved the lightweight design goal by abandoning the S-box, greatly reducing memory usage, and providing conditions for the algorithm to be deployed in resource-constrained environments.

[0045] Second, the designed lightweight block cipher is white-boxed. The algorithm is white-boxed through lookup table design, external encoding and other means, which can be applied to vulnerable white-box environments. This white-box construction method can provide security for the algorithm in a white-box environment and better resist existing attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a structural diagram of the encryption round function of the cryptographic algorithm described in the present invention;

[0047] Figure 2 It is the overall encryption process of the cryptographic algorithm described in the present invention;

[0048] Figure 3 This is the cryptographic algorithm key generation process described in the present invention;

[0049] Figure 4 This is the white-box lookup table construction process and external encoding process of the cryptographic algorithm described in the present invention. DETAILED DESCRIPTION

[0050] The implementation process of the present invention is further described below with reference to the accompanying drawings and examples, but the application scope of the present invention is not limited in any way.

[0051] The round function of the white-box block cipher algorithm designed by the present invention mainly adopts the ARX structure design, which has the advantages of being light, occupying little memory, and having high computational efficiency. At the same time, the key lies in the white-box construction process. By applying the lookup table technology and the external encoding technology, the algorithm is implemented in a white-box manner, which can effectively ensure the security in the white-box environment and resist various attacks.

[0052] Reference Figure 1 , the implementation steps of the present invention are further described.

[0053] Step S1: Perform initial transformation on plaintext X: Subsequent P 1 -P 7 According to the round function algorithm, circular shift, bitwise AND, modular addition and XOR operations are performed respectively.

[0054] Step S2: Record the encrypted intermediate variable after circular shift and bitwise AND

[0055] Mi =[(P i <<<1)&(P i <<<5)]&(P i <<<7)i=0,4;M j =[(P j <<<2)&(P j <<<4)]&(P j <<<6)j=2,6;

[0056] Step S3: Record the first round encryption result after modular addition and XOR mixing operation as

[0057] The block data are all 16 bits in length, and are used as the data to be encrypted in the second round of encryption for iteration.

[0058] After the above steps, the data rotation operation of the information in the encryption round function can be realized, with a total of 48 rounds of operation, which can fully guarantee the obfuscation and diffusion of data. However, it should be noted that there are 8 public keys involved in the operation before the first round and after the last round of the algorithm, while there are no public keys in other intermediate rounds.

[0059] Reference Figure 2 , the implementation steps of the present invention are further described.

[0060] Step S1: preprocessing of plaintext data. Divide the 128-bit plaintext as the first round of encrypted data into 8 blocks from low to high, each block is 16 bits long, and are recorded as X0, X1, X2, X3, X4, X5, X6, X7 respectively. The initial key is 128 bits, expressed as Mk = (Mk7, Mk6, ..., Mk0), and the algorithm's public key rki (i = 0, 1, ..., 7) and round key ski (i = 0, 1, ..., 191) are generated by the key generation algorithm in step S2;

[0061] Step S2: Key generation algorithm: The key generation algorithm of this cryptographic algorithm is divided into two parts, namely the generation of 8 public keys and the generation of 192 round keys.

[0062] Step S3: round function encryption. The 8 plaintext data blocks in step S1 enter the 8 branches of the encryption round function of the cryptographic algorithm from low to high, and the encrypted data of the previous round is used as the data to be encrypted in the second round for iteration until the 48th round is iterated;

[0063] Step S4: The encryption round function generates a lookup table. Each round of the cryptographic algorithm is made into a lookup table using a partial assignment method to hide the key information, thus achieving a white-box effect on the cryptographic algorithm. Even if the lookup table details are fully disclosed, an attacker cannot directly extract the key information from the lookup table.

[0064] Reference Figure 3 , the key generation process of the present invention is further described.

[0065]

[0066]

[0067] The white-boxing of this cryptographic algorithm mainly involves the construction of the lookup table and the generation of the external code. Figure 4 These two parts are described and further explained below.

[0068] The encryption round function generates a lookup table. Each round of the cryptographic algorithm is made into a lookup table using a partial assignment method, which hides the key information and achieves a white-box effect on the cryptographic algorithm. Even if the lookup table details are fully disclosed, attackers cannot directly extract the key information from the lookup table.

[0069] Take the input X of the first round branch 1 0 For example, enter X 0 For 16-bit binary data, the first round of encryption is performed.

[0070]

[0071] Income X 0 ' is the input of branch 3 of the second iteration, which is still 16-bit data. The results obtained by the remaining 7 branches correspond to different branches of the second iteration;

[0072] Will The result of the operation is converted into a matrix form, and the input and output of the operation can hide the key information. The mapping relationship between the input and output is obfuscated by encoding. The split small matrix is ​​represented as a lookup table, which can obtain the output corresponding to the input, but the intermediate data has been obfuscated. At this time, 64 lookup tables can be designed for a round of 8 branches. The input and output of each round of iteration can be obtained through the table lookup operation, but the key information will not be leaked.

[0073] External coding is a 16-bit random number deployed on an external hardware platform and applied to 8 branches, which has a data obfuscation effect. After input and output coding, an overall algorithm structure including a lookup table can be formed. The operation corresponding to the external coding is converted into a block matrix, and the random number of each branch XOR generates a different block matrix, which is offset by the lookup table formed after the branch operation. At this time, the external input and output coding can offset the internally formed lookup table, which will not affect the overall operation and encryption and decryption process of the algorithm, but the external coding will reduce the operation efficiency to a certain extent to improve security.

[0074] The above description in combination with the pictures is a specific example of the present invention and does not constitute any limitation to the present invention. After understanding the technical principle of the present invention, professionals in this field may make deformation or improvement on the method proposed in the present invention in details or form, which still fall within the scope of protection of the present invention.

Claims

1. A white-box block cipher encryption method using matrix transformation to construct a lookup table, characterized in that: The following steps are involved: Step S1: preprocessing of plaintext data; divide the 128-bit plaintext as the first round of encrypted data from low to high into 8 blocks, each block is 16 bits long, respectively recorded as X0, X1, X2, X3, X4, X5, X6, X7, the initial key is 128 bits, expressed as Mk = (Mk7, Mk6, ..., Mk0), the public key of the algorithm is rk i (i=0,1,…,7) and round key sk i (i=0,1,…,191) is generated by the key generation algorithm in step S2; Step S2: Key generation algorithm; The key generation algorithm of the white box block cipher encryption method is divided into two parts, namely the generation of 8 public keys and the generation of 192 round keys: (2a) Public key generation algorithm: (2b) Round key generation algorithm: is a finite field modulo mod2 16 Addition operation, δ j It is a preset 2-byte hexadecimal constant. j>7 , modulo MK 0-7 The round key skj is then updated by the above method; Step S3: round function encryption; the 8 plaintext data blocks in step S1 enter the 8 branches of the encryption round function of the white box block cipher encryption method from low to high respectively: (3a) Perform initial transformation on plaintext X: Subsequently, P1-P7 are subjected to circular shift, bitwise AND, modular addition, and XOR operations respectively according to the round function algorithm; (3b) Record the encrypted intermediate variable after circular shift and bitwise AND M i =[(P i <<<1)&(P i <<<5)]&(P i <<<7),i=0,4;M j =[(P j <<<2)&(P j <<<4)]&(P j <<<6),j ＝2,6； (3c) The first round of encryption result after modular addition and XOR mixing operation is The length of each block data is 16 bits, which are used as the data to be encrypted in the second round of encryption for iteration; Step S4: Generate a lookup table based on the encryption round function; Each round of the white-box block cipher encryption method is made into a lookup table using a partial assignment method to hide the key information, thereby achieving the white-box effect of the cryptographic algorithm. Even if the lookup table details are completely disclosed, attackers cannot directly extract the key information from the lookup table.

2. A white box block cipher encryption method using matrix transformation to construct a lookup table according to claim 1, characterized in that: The process of generating a white-box lookup table is to convert one round of encryption into 64 lookup tables. The detailed steps of constructing the lookup table are as follows: Step S1: Taking the input X0 of the first round of branch 1 as an example, the input X0 is 16-bit binary data, and the first round of encryption is performed. The obtained X0' is the input of branch 3 of the second round of iteration, which is still 16-bit data. The results obtained by the remaining 7 branches correspond to different branches of the second round of iteration. Step S2: Convert the The operation result is converted into a matrix form. The input and output of the operation hide the key information. The matrix is ​​combined according to specific rules through matrix operation. Step S3: By encoding the mapping relationship between input and output, each small matrix split in step S2 is represented as a lookup table, which can obtain the output corresponding to the input, but the intermediate data has been obfuscated. At this time, 64 lookup tables are designed for a round of 8 branches. The input and output of each round of iteration are obtained through table lookup operations, but the key information will not be leaked; Step S4: Each possible 8-bit input corresponds to an 8-bit output, so the size of each constructed lookup table is 2 8 ×8=256 bytes, 64 lookup tables are made in each round, and the algorithm has 48 rounds of iterations; therefore, the white box block cipher encryption method occupies 256 bytes of memory space ×64×48=768KB.

3. A white-box block cipher encryption method using matrix transformation to construct a lookup table according to claim 1, characterized in that: The white-box block cipher encryption method has 48 rounds of iterative round functions, the details of which are as follows: Inter-round iteration: The iteration uses a 48-round generalized unbalanced Feistel round function structure, and the branch iteration rule is: from the left, branch 1 enters branch 3 of the next round, branch 2 enters branch 5 of the next round, branch 3 enters branch 7 of the next round, branch 4 enters branch 8 of the next round, branch 5 enters branch 1 of the next round, branch 6 enters branch 2 of the next round, branch 7 enters branch 4 of the next round, and branch 8 enters branch 6 of the next round; Public key involved in the operation: 8 public keys rk generated by the above public key generation algorithm i (i=0,1,…,7), respectively, before the first round and after the 48th round of the algorithm, where rk i (i=0,1,2,3) acts on the odd-numbered branches before the first round, rk i (i=4,5,6,7) acts on the even-numbered branches after the last round, and acts as XOR or modulo 2 16 Addition operation.

4. A white-box block cipher encryption method using matrix transformation to construct a lookup table according to claim 1, characterized in that: The encryption and decryption of the white-box cryptographic algorithm requires external encoding, the details of which are as follows: The overall encryption process of the algorithm: The overall encryption process of the white box block cipher encryption method under the action of 8 public keys and 192 round keys is E k , the encryption process is an overall process including 48 rounds of iterative round functions; External coding: The 16-bit random numbers deployed on the external hardware platform act on 8 branches to confuse the data. After input and output coding, an overall algorithm structure including a lookup table is formed. The operation corresponding to the external coding is converted into a block matrix. The random numbers of each branch XOR generate different block matrices, which are offset by the lookup table formed after the branch operation. At this time, the external input and output coding can offset the internally formed lookup table, which will not affect the overall operation and encryption and decryption process of the algorithm. However, the external coding will reduce the computing efficiency to a certain extent to improve security.

5. A white-box block cipher decryption method using matrix transformation to construct a lookup table, characterized in that: The following steps are involved: Step S1: preprocessing of ciphertext data; the encrypted 128-bit ciphertext is used as the first round of decryption data and divided into 8 blocks from low to high evenly, each block is 16 bits long, respectively recorded as Y0, Y1, Y2, Y3, Y4, Y5, Y6, Y7, the updated master key is 128 bits, expressed as Mk'=(Mk'7, Mk'6, ..., Mk'0), the algorithm's public key rk i (i=0,1,…,7) is generated by the public key generation algorithm, round key sk i (i=0,1,…,191) is generated by the round key generation algorithm; Step S2: Use the keys in reverse order; the public key of the white box block cipher encryption method only acts on the first and last rounds of decryption. The first round of decryption acts on the even branches, and the last round of decryption acts on the odd branches. The round key sk j (j=0,1,…,191) The order of use is opposite to that of encryption, that is, the first round of decryption uses sk 188 -sk 191 , the last round of decryption uses sk0-sk3; Step S3: round function decryption; the 8 ciphertext data blocks enter the 8 branches of the decryption round function of the white box block cipher encryption method from low to high, and reverse decryption is performed according to the branch path during encryption. The XOR operation during decryption is the same as that during encryption, modulo 2 16 Addition becomes modulo 2 16 Subtraction operation, the circular left shift operation becomes a circular right shift operation. After 48 rounds of iterations, the encrypted 128-bit ciphertext is decrypted back to the input 128-bit plaintext; Step S4: decryption table lookup operation; perform an inverse operation on the lookup table generated after each round of encryption of the white box block cipher encryption method, obtain the input and output values ​​in the decryption process through the table lookup operation in the decryption process, and protect the key information.

Images