Implementation method of lightweight stream cipher algorithm based on non-volatile memory

Abstract

This invention discloses a lightweight stream cipher algorithm implementation method based on non-volatile memory. This method combines the CKEY and CIV concepts, constructing a lightweight stream cipher algorithm based on two non-volatile serial ciphers (NFSRs) and one non-volatile memory. The two NFSRs are concatenated, and the initialization vector and key prefix are stored in the non-volatile external memory. A selection function is used to select the participating non-volatile state bits, which participate in the computation during algorithm initialization and key stream generation. Finally, a portion of the states from the two NFSRs are selected and processed by a complex output function to obtain the output bits. During algorithm initialization, the output of the output function participates in updating the internal states; during key stream generation, the output of the output function is the key bits and does not participate in the update. This method reduces hardware overhead while effectively resisting TMDTO attacks, improving algorithm security.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method for realizing a lightweight stream cipher algorithm based on a non-volatile memory. Background Art

[0002] Stream cipher is an important branch of symmetric cryptographic system. It is simple to implement, has fast encryption and decryption speed, and is easy to implement in software and hardware. Stream cipher is widely used. Classic stream cipher algorithms include Grain v1, MICKEY 2.0 and Trivium in eSTREAM. These algorithms generally use bit-level operations and are suitable for resource-constrained environments.

[0003] A structural feature of stream ciphers is that they must have internal states, which makes them vulnerable to time-memory-data tradeoff (TMDTO) attacks. To resist this attack, the length of the internal state of the stream cipher is usually required to be at least twice the length of the key. For example, the internal state of the Grain and Grain-128a series algorithms is twice the length of the key, while the internal state of the Trivium algorithm is greater than twice the length of the key. This situation results in excessive hardware resources being consumed when implementing stream ciphers in hardware. For example, the hardware area of ​​the Trivium algorithm is 2580 gates, which is not suitable for new application scenarios such as resource constraints, low power consumption, and the Internet of Things.

[0004] In order to resist TMDTO and reduce the length of the internal state, researchers have proposed "small state" lightweight stream ciphers in recent years. The so-called small state means that it can resist TMDTO attacks and the length of the internal state is less than twice the length of the key. The corresponding lightweight stream cipher algorithms include Sprout, Fruit, Lizard and Plantlet. The overall structure of these algorithms is highly similar. They are all based on the driving structure of the Grain algorithm and use a linear or nonlinear feedback shift register (Linear / Nonlinear Feedback Shift Register, LFSR / NFSR) series structure. At present, lightweight stream ciphers have formed three general structures: (1) Lizard; (2) CKEY (Continuous Key) structure; (3) CIV (Continuous IV) structure.

[0005] Traditional stream ciphers mostly use feedback shift registers, i.e., volatile registers. In addition to volatile registers, more and more algorithms are beginning to use non-volatile memory. Using values ​​stored in non-volatile memory can not only reduce the size of internal registers and reduce the hardware area of ​​the algorithm, but also provide a higher level of security. The stream ciphers Fruit, Plantlet, and Sprout continuously use keys stored in non-volatile memory during their state updates. The additional key bits will enhance the security beyond the birthday bounds associated with the volatile internal state bits. However, this CKEY construction has been shown to be resistant to the general TMDTO attack to at most half the size of the internal state. In contrast to CKEY, CIV does not use an initial key, but uses an initial value as the non-volatile part. Although this construction method has been proposed, there is no stream cipher algorithm based on the CIV structure so far. Summary of the invention

[0006] The purpose of the present invention is to provide a method for implementing a lightweight stream cipher algorithm based on a non-volatile memory, which has high security strength, can effectively resist TMDTO attacks, has low hardware overhead, and is suitable for resource-constrained environments. The method combines the CKEY and CIV ideas, and is based on two NFSRs and one non-volatile memory to construct a lightweight stream cipher algorithm. The key and initial vector are stored in the non-volatile memory, and functions are selected to make them participate in the initialization and key stream generation processes respectively. While reducing hardware overhead, it can effectively resist TMDTO attacks and improve the security of the algorithm.

[0007] The technical solution for achieving the purpose of the present invention is:

[0008] The implementation method of the lightweight stream cipher algorithm based on non-volatile memory mainly includes the following steps:

[0009] (1) Constructing a lightweight stream cipher algorithm

[0010] Select two NFSR components, NFSR1 and NFSR2, design a non-volatile memory, and construct a lightweight stream cipher algorithm;

[0011] The construction method is: connect NFSR1 and NFSR2 in series, and select the internal state bits of the two NFSRs as the input of the nonlinear output function, so that the states of the two NFSR registers are further confused, and the nonlinearity of the algorithm is further provided; in order to ensure the lightweight of NFSR and resist TMDTO attack, a non-volatile memory is used to store the initial vector and key prefix, and a selection function is used to select the participating non-volatile state bits, which are used for the initialization of the algorithm and the key stream generation process respectively;

[0012] During the algorithm initialization process, the output of the output function participates in the update of the internal state;

[0013] In the key stream generation phase, the output of the output function is the key bit and does not participate in the update;

[0014] For the selection of NFSR1, the present invention selects the 32-bit NFSR A of ACHTERBAHN-128 / 80 in the candidate algorithm of eSTREAM Phase 2 (hardware combination). 11 As NFSR1, despite the relatively large algebraic paradigm, the designers of ACHTERBAHN provide a compact hardware implementation of the feedback function. NFSR1 can provide nonlinearity to the algorithm, guaranteeing its ability to resist algebraic attacks and fast correlation attacks;

[0015] Selection of NFSR2, the 100-bit NFSR2 used in the present invention comes from the modification of the 128-bit NFSR in the Grain-128AEAD algorithm, and the update function of the 100-bit register is constructed by modifying the taps; in order to improve the nonlinearity of NFSR2, the nonlinear term of the NFSR2 update function is added; finally, the update function of NFSR2 consists of linear terms and nonlinear terms, each tap appears only once, the nonlinearity is 549656723456, and the elasticity is 4, and the algebraic degree is 4;

[0016] The non-volatile memory is 132 bits, and its state consists of a 100-bit initial vector and the first 32 bits of a 128-bit initial key. The non-volatile memory has the advantages of no loss during power failure and fast reading speed, and has a smaller overhead than a register of the same length. In this 132-bit memory, the initial vector occupies the high-order 100 bits, the initial key occupies the low-order 32 bits, and the value stored in the non-volatile memory remains unchanged throughout the process. A selection function is set to select one non-volatile state bit each time to participate in the internal state update, so that the initial vector and the key are more fully obfuscated and diffused.

[0017] (2) Algorithm structure output function design

[0018] The output function of the algorithm structure is a nonlinear function, which consists of a linear function, a quadratic function and two trigonometric functions. By taking multiple internal state bits as input, the state of the register is fully mixed to further enhance the nonlinear nature, good correlation and statistical characteristics of the password;

[0019] (3) Algorithm initialization

[0020] In the initialization phase, the key is loaded into two NFSRs, and the bits in the non-volatile memory are selected to participate in the iteration according to the selection function. One output bit participates in the update of the two NFSR state bits. After 384 rounds of iteration, the initial key is XORed into the two NFSR states again, and 132 rounds of iteration are performed again to better diffuse and confuse the state bits. At this time, the output bit no longer participates in the update of the state;

[0021] (4) Generate key stream

[0022] After the algorithm is initialized, the output of the algorithm is the key bit. Each round of iteration generates a 1-bit key, and the output bits of multiple iterations constitute the key stream;

[0023] (5) Algorithm encryption and decryption

[0024] When encrypting data, a key stream is generated based on the size of the plaintext, and is XORed with the plaintext bit by bit to generate ciphertext; when decrypting, the key stream is XORed with the ciphertext bit by bit to restore the plaintext.

[0025] The beneficial effects of the present invention are:

[0026] (1) The method of the present invention adopts two key filters, and the output function has a good algebraic degree and the function is balanced, which can better resist algebraic attacks and can effectively resist ordinary statistical attacks, strong attacks, general guessing attacks, etc.

[0027] (2) The method of the present invention has a small internal state, uses an initial value and a key prefix as its non-volatile state, has a small area, low power consumption, and is suitable for resource-constrained environments.

[0028] (3) The algorithm of the present invention is simple, each component is independent, and the software and hardware are easy to implement. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a key initialization structure diagram in the method of the present invention;

[0030] Figure 2 This is a diagram of the key generation structure in the method of the present invention. DETAILED DESCRIPTION

[0031] The present invention will be further described in detail below in conjunction with the embodiments and drawings, but the present invention is not limited thereto.

[0032] Example

[0033] The implementation method of the lightweight stream cipher algorithm based on non-volatile memory mainly includes the following steps:

[0034] (1) Constructing a lightweight stream cipher algorithm

[0035] Select two NFSR components, NFSR1 and NFSR2, design a non-volatile memory, and construct a lightweight stream cipher algorithm;

[0036] The construction method is: connect NFSR1 and NFSR2 in series, and select the internal state bits of the two NFSRs as the input of the nonlinear output function, so that the states of the two NFSR registers are further confused, and the nonlinearity of the algorithm is further provided; in order to ensure the lightweight of NFSR and resist TMDTO attack, a non-volatile memory is used to store the initial vector and key prefix, and a selection function is used to select the participating non-volatile state bits, which are used for the initialization of the algorithm and the key stream generation process respectively;

[0037] During the algorithm initialization process, the output of the output function participates in the update of the internal state;

[0038] In the key stream generation phase, the output of the output function is the key bit and does not participate in the update;

[0039] Select the 32-bit NFSRA of ACHTERBAHN-128 / 80 from the candidate algorithm of eSTREAM Phase 2 (Hardware Combination) 11 As NFSR1;

[0040] The 100-bit NFSR2 is selected from the modification of the 128-bit NFSR in the Grain-128AEAD algorithm. The update function of the 100-bit register is constructed by modifying the taps. The update function of NFSR2 consists of linear terms and nonlinear terms. Each tap appears only once, the nonlinearity is 549656723456, and the elasticity is 4, and the algebraic degree is 4.

[0041] The non-volatile memory is 132 bits, and its state consists of a 100-bit initial vector and the first 32 bits of a 128-bit initial key. In the 132-bit memory, the initial vector occupies the high-order 100 bits, the initial key occupies the low-order 32 bits, and the value stored in the non-volatile memory remains unchanged during the whole process. A selection function is set to select one non-volatile state bit each time to participate in the internal state update, so that the initial vector and the key are more fully obfuscated and diffused.

[0042] (2) Algorithm structure output function design

[0043] The output function of the algorithm structure is a nonlinear function, which consists of a linear function, a quadratic function and two trigonometric functions. By taking multiple internal state bits as input, the state of the register is fully mixed to further enhance the nonlinear nature, good correlation and statistical characteristics of the password;

[0044] (3) Algorithm initialization

[0045] In the initialization phase, the key is loaded into two NFSRs, and the bits in the non-volatile memory are selected to participate in the iteration according to the selection function. One output bit participates in the update of the two NFSR state bits. After 384 rounds of iteration, the initial key is XORed into the two NFSR states again, and 132 rounds of iteration are performed again to better diffuse and confuse the state bits. At this time, the output bit no longer participates in the update of the state;

[0046] (4) Generate key stream

[0047] After the algorithm is initialized, the output of the algorithm is the key bit. Each round of iteration generates a 1-bit key, and the output bits of multiple iterations constitute the key stream;

[0048] (5) Algorithm encryption and decryption

[0049] When encrypting data, a key stream is generated based on the size of the plaintext, and is XORed with the plaintext bit by bit to generate ciphertext; when decrypting, the key stream is XORed with the ciphertext bit by bit to restore the plaintext.

[0050] Furthermore, the lightweight stream cipher algorithm constructed in step (1) is specifically constructed as follows:

[0051] A 128-bit initial key and a 100-bit initial vector are set; the 128-bit initial key is loaded into two NFSR components, the low bit of the initial key is loaded into NFSR2, the high bit is loaded into NFSR1, and the last 4 bits of NFSR1 are filled with 1110; the 100-bit initial vector and the low 32 bits of the initial key are loaded into a 132-bit non-volatile memory, wherein the low bit of the memory is the low 32 bits of the initial key, and the high bit is the 100-bit initial vector; during the initialization process, the bits output by the output function participate in the state update of the two NFSRs, and the bits of the two NFSRs respectively control the selection of bits in the non-volatile components and participate in the state update; after 384 iterations, the initial key is XORed into the internal states of the two NFSRs again, and iterates again for 132 rounds, during which the output bits no longer participate in the state update of the two NFSRs, and then the key stream generation begins; during the key stream generation process, the algorithm outputs a 1-bit key in each iteration.

[0052] Furthermore, the selection of NFSR1 in the lightweight stream cipher algorithm constructed in step (1) is specifically performed as follows:

[0053] The 32-bit NFSR1 is Indicates that Indicates the i-th state bit of NFSR1 at time t; the update function corresponding to NFSR1 is:

[0054]

[0055] In order to conveniently represent the status update results in the initialization phase and the key stream generation phase, Represents the value produced by the update function of NFSR1 at time t.

[0056] Furthermore, the selection of NFSR2 in the lightweight stream cipher algorithm constructed in step (1) is specifically performed as follows:

[0057] The status of the 100-bit NFSR2 is Indicates that represents the i-th state bit of NFSR2 at time t, and the update function corresponding to NFSR2 is:

[0058]

[0059] Among them, the first-order term is a linear term, and the second-order and higher terms are nonlinear terms; is the 0th bit of NFSR1 at time t; d t is the non-volatile state bit selected at time t; for convenience, the state update results are represented in the initialization phase and the key stream generation phase as follows: Represents the value produced by the update function of NFSR2 at time t.

[0060] Furthermore, the non-volatile memory design in the lightweight stream cipher algorithm constructed in step (1) is specifically designed as follows:

[0061] The non-volatile memory 128-bit initial key is K=k0,k1,…,k 127 Indicates that the 100-bit initialization vector is IV = iv0, iv1, ..., iv 99 express;

[0062] For this 132-bit nonvolatile internal state, in clock cycle t, the key-initialization vector selects bit d t Calculated as:

[0063]

[0064] Where cn is the index subscript of the initial key in the non-volatile memory, That is, cn is determined by the five bits of NFSR1, and the decimal number represented by the five bits is the index of the key prefix, where represents the i-th state bit of NFSR1 at time t; cm is the index subscript of the initial vector in the non-volatile memory, That is, cm is determined by the 7 bits of NFSR2, and the decimal number represented by the 7 bits is the index of the initial vector, where Indicates the i-th state bit of NFSR2 at time t.

[0065] Furthermore, in the design of the output function of the algorithm structure in step (2), in order to compensate for the security defect caused by the small internal state, the output function of the present invention has more input bits and a larger algebraic degree, further confusing the states of the two NFSRs, and its input bits try to select taps different from the bits of the update functions of the two NFSRs. The specific method is as follows:

[0066] The output function consists of a linear function with 7 terms Quadratic bent function with 4 terms 7-term trigonometric functions And 4 trigonometric functions Composition, among which,

[0067]

[0068]

[0069]

[0070]

[0071] in Indicates the status bit of NFSR2. Indicates the status bit of NFSR1;

[0072] Set the output function to z(t), z t is the key stream bit output at time t.

[0073] Further, refer to Figure 1 , the algorithm is initialized in step (3), the specific method is as follows:

[0074] (3.1) Read the 128-bit initial key K = k0, k1, ..., k 127 and 100-bit initialization vector IV = iv0, iv1, ..., iv 99 ;

[0075] (3.2) The 128-bit initial key is loaded into two NFSRs, the lower bit is loaded into NFSR2, and the higher bit is loaded into NFSR1. The last 4 bits of NFSR1 are filled with 1110;

[0076]

[0077]

[0078] in, represents the j-th bit of NFSR2 at time t=0; Represents the i-th bit of NFSR1 at time t=0.

[0079] (3.3) Set iteration variable t = 0;

[0080] (3.4) The output bits of the output function are XORed with the outputs of the two NFSR update functions to participate in the update of the feedback shift register. The specific steps are as follows:

[0081] (3.4.1) Take the output function Variables in function expressions, i.e. 7 bits of NFSR2 Calculated The value of

[0082] (3.4.2) Take the output function Variables in function expressions, i.e. 8 bits of NFSR2 Calculated The value of

[0083] (3.4.3) Take the output function Variables in function expressions, i.e. 28 bits of NFSR2 Calculated The value of

[0084] (3.4.4) Take the output function Variables in function expressions, i.e. 6 bits of NFSR2 and 4 bits of NFSR1 Calculated The value of

[0085] (3.4.5) XOR the values ​​obtained from steps (3.4.1) to (3.4.4) to get the output z t ;

[0086] (3.4.6) Substitute the updated value of NFSR1 with the output bit z obtained in (6.4.5) t XOR and update NFSR1, where

[0087] (3.4.7) If t < 256, the key in the non-volatile state - initialization vector selection bit d t Take the tth mod 100th bit in IV; if t ≥ 256, take the last 5 bits of NFSR1 The value composed is used as the index cn of k, taking the last 7 bits of NFSR2 The value mod 100 is used as the index cm of iv; take iv cm With kcn XOR the key in the non-volatile state - initialization vector selection bit d t ;

[0088] (3.4.8) Take the first bit of NFSR1 Output bit z t , the key obtained in step (3.4.7) - initial vector selection bit d t XOR with the output value of the NFSR2 update function to update NFSR2, where

[0089]

[0090] (3.4.9) If t≠384, t=t+1, go to (3.4.1); if t=384, end the iteration;

[0091] (3.5) The 128-bit key is XORed with the internal state bit by bit, and the last 4 bits are assigned a value of 1, that is:

[0092]

[0093]

[0094] (3.6) 132 rounds of iterations are performed to obtain the necessary diffusion of the right position of NFSR1. The specific steps are as follows:

[0095] (3.6.1) Update NFSR1, where:

[0096] (3.6.2) Take the last 5 bits of NFSR1 The value composed is used as the index cn of k, taking the last 7 bits of NFSR2 The value mod 100 is used as the index cm of iv; cm With k cn XOR key-initial vector selection bit d t ;

[0097] (3.6.3) Take the first bit of NFSR1 and d obtained in step (3.6.2) t XOR with the output value of the update function of NFSR2, and update NFSR2, where

[0098] (3.6.4) If t≠516, t=t+1, go to (3.6.1); if t=516, go to step (3.6.5);

[0099] (3.6.5) End the iteration and complete the initialization.

[0100] Further, refer to Figure 2 , the key stream is generated in step (4), and the specific method is as follows:

[0101] (4.1) Assume that the plaintext is m and its length is p;

[0102] (4.2) t = 516;

[0103] (4.3) Update NFSR1, where

[0104] (4.4) Take the last 5 bits of NFSR1 The value composed is used as the index cn of k, taking the last 7 bits of NFSR2 The value mod 100 is used as the index cm of iv; take iv cm With k cn XOR key-initial vector selection bit d t ;

[0105] (4.5) Take the first bit of NFSR1 The key obtained in step (4.4) - initial vector selection bit d t , initial key bit k t mod 128 XOR with the output value of the update function of NFSR2, and update NFSR2, where

[0106] (4.6) Take the output function Variables in function expressions, i.e. 7 bits of NFSR2 Calculated The value of

[0107] (4.7) Take the output function Variables in function expressions, i.e. 8 bits of NFSR2 Calculated The value of

[0108] (4.8) Take the output function Variables in function expressions, i.e. 28 bits of NFSR2 Calculated The value of

[0109] (4.9) Take the output function Variables in function expressions, i.e. 6 bits of NFSR2 and 4 bits of NFSR1 Calculated The value of

[0110] (4.10) XOR the values ​​obtained in steps (4.6) to (4.9) to obtain the output bit z t ;

[0111] (4.11) t = t + 1, p = p - 1, if p ≠ 0, go to step (4.3); if p = 0, go to step (4.12);

[0112] (4.12) The iteration ends and the key stream generation is completed.

[0113] Furthermore, the algorithm encryption and decryption in step (5) is specifically performed as follows:

[0114] (5.1) Regarding the encryption implementation of the algorithm, the specific process is as follows;

[0115] (5.1.1) Input plaintext m;

[0116] (5.1.2) XOR the plaintext m with the key stream z bit by bit, where z is the key stream composed of key bits generated over a period of time, to obtain the ciphertext c, that is, each bit in the ciphertext is operated as c i is the ith bit of the ciphertext, m i is the i-th bit of the plaintext, z i is the i-th bit of the key stream, where 0≤i≤p, and p is the length of the plaintext;

[0117] (5.2) Regarding the decryption implementation of the algorithm, the specific process is as follows;

[0118] (5.2.1) Input ciphertext c;

[0119] (5.2.2) XOR the ciphertext c with the key stream z bit by bit to obtain the plaintext m, that is, the operation of each bit in the ciphertext is

[0120] The method of the present invention adopts the FP(1) mode, and the initial vector and the key are both involved in the operation in the initialization process and the key stream generation process, so that the initial vector and the key can be confused and diffused more fully, making it difficult to recover the key from the initial state, achieving provable security against TMDTO attacks, while the internal state is less than twice the key.

Claims

1. A method for implementing a lightweight stream cipher algorithm based on non-volatile memory, characterized in that: The steps include: (1) Constructing a lightweight stream cipher algorithm Select two NFSR components, NFSR1 and NFSR2, design a non-volatile memory, and construct a lightweight stream cipher algorithm; The construction method is as follows: NFSR1 and NFSR2 are connected in series, and the internal state bits of the two NFSRs are selected as the input of the nonlinear output function; a non-volatile memory is used to store the initial vector and the key prefix, and a selection function is used to select the participating non-volatile state bits, which are used for the initialization of the algorithm and the key stream generation process respectively; During the algorithm initialization process, the output of the output function participates in the update of the internal state; In the key stream generation phase, the output of the output function is the key bit and does not participate in the update; NFSR1 selection, using the 32-bit NFSRA of ACHTERBAHN-128 / 80 from the eSTREAM Phase 2 candidate algorithm 11 As NFSR1; The selection of NFSR2,The 100-bit NFSR2 is selected, which comes from the modification of the 128-bit NFSR in the Grain-128AEAD algorithm. The update function of the 100-bit register is constructed by modifying the taps; The update function of NFSR2 consists of linear and nonlinear terms, each tap appears only once, the nonlinearity is 549656723456, and the elasticity is 4, and the algebraic degree is 4; The non-volatile memory is 132 bits, and its state consists of a 100-bit initial vector and the first 32 bits of a 128-bit initial key. In the 132-bit memory, the initial vector occupies the high-order 100 bits, the initial key occupies the low-order 32 bits, and the value stored in the non-volatile memory remains unchanged during the entire process. Set a selection function to select one non-volatile state bit each time to participate in the internal state update, so that the initial vector and key confusion diffusion are more sufficient; (2) Algorithm structure output function design The output function of the algorithm structure is a nonlinear function, which consists of a linear function, a quadratic function and two trigonometric functions; (3) Algorithm initialization In the initialization phase, the key is loaded into two NFSRs, and the bits in the non-volatile memory are selected to participate in the iteration according to the selection function. One output bit participates in the update of the two NFSR state bits. After 384 rounds of iteration, the initial key is XORed into the two NFSR states again, and 132 rounds of iteration are performed again to better diffuse and confuse the state bits. At this time, the output bit no longer participates in the update of the state; (4) Generate key stream After the algorithm is initialized, the output of the algorithm is the key bit. Each round of iteration generates a 1-bit key, and the output bits of multiple iterations constitute the key stream; (5) Algorithm encryption and decryption When encrypting data, a key stream is generated based on the size of the plaintext, and is XORed with the plaintext bit by bit to generate ciphertext; when decrypting, the key stream is XORed with the ciphertext bit by bit to restore the plaintext.

2. The method for implementing a lightweight stream cipher algorithm according to claim 1, characterized in that: The specific method of constructing a lightweight stream cipher algorithm in step (1) is: Set a 128-bit initial key and a 100-bit initial vector; load the 128-bit initial key into two NFSR components, load the low bit of the initial key into NFSR2, and the high bit into NFSR1, and fill the last 4 bits of NFSR1 with 1110; load the 100-bit initial vector and the low 32 bits of the initial key into a 132-bit non-volatile memory, wherein the low bit of the memory is the low 32 bits of the initial key, and the high bit is the 100-bit initial vector; during the initialization process, the bits output by the output function participate in the state update of the two NFSRs, and the bits of the two NFSRs respectively control the selection of bits in the non-volatile components and participate in the state update; after 384 iterations, the initial key is XORed into the internal states of the two NFSRs again, and iterates again for 132 rounds, during which the output bits no longer participate in the state update of the two NFSRs, and then the generation of the key stream begins; During the key stream generation process, the algorithm outputs a 1-bit key in each iteration.

3. The method for implementing a lightweight stream cipher algorithm according to claim 1, characterized in that: The selection of NFSR1 in the lightweight stream cipher algorithm constructed in step (1) is specifically as follows: The 32-bit NFSR1 is Indicates that Indicates the i-th state bit of NFSR1 at time t; the update function corresponding to NFSR1 is: In order to conveniently represent the status update results in the initialization phase and the key stream generation phase, Represents the value produced by the update function of NFSR1 at time t.

4. The method for implementing a lightweight stream cipher algorithm according to claim 1, characterized in that: The selection of NFSR2 in the lightweight stream cipher algorithm constructed in step (1) is specifically as follows: The status of the 100-bit NFSR2 is Indicates that represents the i-th state bit of NFSR2 at time t, and the corresponding update function of NFSR2 is: Among them, the first-order term is a linear term, and the second-order and higher terms are nonlinear terms; is the 0th bit of NFSR1 at time t; d t is the non-volatile state bit selected at time t; for convenience, the state update results are represented in the initialization phase and the key stream generation phase as follows: Represents the value produced by the update function of NFSR2 at time t.

5. The method for implementing a lightweight stream cipher algorithm according to claim 1, characterized in that: The non-volatile memory design in the lightweight stream cipher algorithm constructed in step (1) is specifically: The non-volatile memory 128-bit initial key is K=k0,k1,…,k 127 Indicates that the 100-bit initialization vector is IV = iv0, iv1, ..., iv 99 express; For this 132-bit nonvolatile internal state, in clock cycle t, the key-initialization vector selects bit d t Calculated as: Where cn is the index subscript of the initial key in the non-volatile memory, That is, cn is determined by the five bits of NFSR1, and the decimal number represented by the five bits is the index of the key prefix, where represents the i-th state bit of NFSR1 at time t; cm is the index subscript of the initial vector in the non-volatile memory, That is, cm is determined by the 7 bits of NFSR2, and the decimal number represented by the 7 bits is the index of the initial vector, where Indicates the i-th state bit of NFSR2 at time t.

6. The method for implementing a lightweight stream cipher algorithm according to claim 1, characterized in that: The algorithm is initialized in step (3), and the specific method is as follows: (3.1) Read the 128-bit initial key K = k0, k1, ..., k 127 and 100-bit initialization vector IV = iv0, iv1, ..., iv 99 ; (3.2) The 128-bit initial key is loaded into two NFSRs, the lower bit is loaded into NFSR2, and the higher bit is loaded into NFSR1. The last 4 bits of NFSR1 are filled with 1110; in, represents the j-th bit of NFSR2 at time t=0; represents the i-th bit of NFSR1 at time t=0; (3.3) Set iteration variable t = 0; (3.4) The output bits of the output function are XORed with the outputs of the two NFSR update functions to participate in the update of the feedback shift register. The specific steps are as follows: (3.4.1) Take the output function Variables in function expressions, i.e. 7 bits of NFSR2 Calculated The value of (3.4.2) Take the output function Variables in function expressions, i.e. 8 bits of NFSR2 Calculated The value of (3.4.3) Take the output function Variables in function expressions, i.e. 28 bits of NFSR2 Calculated The value of (3.4.4) Take the output function Variables in function expressions, i.e. 6 bits of NFSR2 and 4 bits of NFSR1 Calculated (3.4.5) XOR the values ​​obtained from steps (3.4.1) to (3.4.4) to obtain the output z t ; (3.4.6) Substitute the value of the update function of NFSR1 with the output bit z obtained in (3.4.5) t XOR and update NFSR1, where (3.4.7) If t < 256, the key in the non-volatile state - initialization vector selection bit d t Take the tth mod 100th bit in IV; if t ≥ 256, take the last 5 bits of NFSR1 The value composed is used as the index cn of k, taking the last 7 bits of NFSR2 The value mod 100 is used as the index cm of iv; take iv cm With k cn XOR the key in the non-volatile state - initialization vector selection bit d t ; (3.4.8) Take the first bit of NFSR1 Output bit z t , the key obtained in step (3.4.7) - initial vector selection bit d t XOR with the output value of the NFSR2 update function to update NFSR2, where (3.4.9) If t≠384, t=t+1, go to (6.4.1); if t=384, end the iteration; (3.5) The 128-bit key is XORed with the internal state bit by bit, and the last 4 bits are assigned a value of 1, that is: (3.6) Perform 132 rounds of iterations to obtain the necessary diffusion of the right position of NFSR1. The specific steps are as follows: (3.6.1) Update NFSR1, where (3.6.2) Take the last 5 bits of NFSR1 The value composed is used as the index cn of k, taking the last 7 bits of NFSR2 The value mod 100 is used as the index cm of iv; cm With k cn XOR key-initial vector selection bit d t ; (3.6.3) Take the first bit of NFSR1 and d obtained in step (3.6.2) t XOR with the output value of the update function of NFSR2, and update NFSR2, where (3.6.4) If t≠516, t=t+1, go to (3.6.1); if t=516, go to step (3.6.5); (3.6.5) End the iteration and complete the initialization.

7. The method for implementing a lightweight stream cipher algorithm according to claim 6, characterized in that: The specific method of generating the key stream in step (4) is as follows: (4.1) Assume that the plaintext is m and its length is p; (4.2)t＝516； (4.3) Update NFSR1, where (4.4) Take the last 5 bits of NFSR1 The value composed is used as the index cn of k, taking the last 7 bits of NFSR2 The value mod 100 is used as the index cm of iv; take iv cm With k cn XOR key-initial vector selection bit d t ; (4.5) Take the first bit of NFSR1 The key obtained in step (4.4) - initial vector selection bit d t , initial key bit k tmod128 XOR with the output value of the update function of NFSR2, and update NFSR2, where (4.6) Take the output function Variables in function expressions, i.e. 7 bits of NFSR2 Calculated The value of (4.7) Take the output function Variables in function expressions, i.e. 8 bits of NFSR2 Calculated The value of (4.8) Take the output function Variables in function expressions, i.e. 28 bits of NFSR2 Calculated The value of (4.9) Take the output function Variables in function expressions, i.e. 6 bits of NFSR2 and 4 bits of NFSR1 Calculated The value of (4.10) XOR the values ​​obtained in steps (4.6) to (4.9) to obtain the output bit z t ; (4.11) t = t + 1, p = p - 1, if p ≠ 0, go to step (4.3); if p = 0, go to step (4.12); (4.12) The iteration ends and the key stream generation is completed.

8. The method for implementing a lightweight stream cipher algorithm according to claim 7, characterized in that: The algorithm encryption and decryption in step (5) is as follows: (5.1) Regarding the encryption implementation of the algorithm, the specific process is as follows; (5.1.1) Input plaintext m; (5.1.2) XOR the plaintext m with the key stream z bit by bit, where z is the key stream composed of key bits generated over a period of time, to obtain the ciphertext c, that is, each bit in the ciphertext is operated as c i is the ith bit of the ciphertext, m i is the i-th bit of the plaintext, z i is the i-th bit of the key stream, where 0≤i≤p, and p is the length of the plaintext; (5.2) Regarding the decryption implementation of the algorithm, the specific process is as follows; (5.2.1) Input ciphertext c; (5.2.2) XOR the ciphertext c with the key stream z bit by bit to obtain the plaintext m, that is, the operation of each bit in the ciphertext is

Images