Construction method and device of block cipher round function, electronic equipment and storage medium

Abstract

The application discloses a construction method and device of a block cipher round function, electronic equipment and a storage medium, wherein the method comprises the following steps: performing bit-by-bit exclusive or whitening of a key generation round function initial state on a plaintext block; replacing 32 S-box units of the round function one by one by using an S-box with multiple bits; performing bit grouping on the replaced round function, performing exclusive or on the bit grouping with a multi-bit constant, and performing position permutation on 32 positions of the round function as an S-box unit, so that there is no 9-round impossible differential based on the iteration of the round function, and there is also no 9-round effective differential route; multiplying each column of an intermediate state matrix of the round function by a preset matrix from the left to perform column mixing, and performing bit-by-bit exclusive or on the round function after the column mixing and a round key; and obtaining a final state of the round function after multiple iterations. Thus, the problems of high resource occupation in the hardware efficient implementation of the existing block cipher algorithm and low software implementation efficiency are solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to a construction method and device of a round function of a block cipher, an electronic device and a storage medium. BACKGROUND

[0002] Block cipher is the most important type of symmetric cipher algorithm, which is widely used in network communication. Substitution-permutation network (SPN) structure is a widely used block cipher structure, and important cipher algorithm standards such as AES and PRESENT in the world adopt this structure. The SPN structure is implemented through multiple iterations of a round function, and the round function is the key to the design. The round function includes a confusion layer and a diffusion layer. The confusion layer is composed of nonlinear operations such as S-box, modulo addition operation, and AND operation. The diffusion layer is composed of reversible linear operations. The S-box is nonlinear, and is the most commonly used confusion technique. According to the input and output length of the S-box, 8 bits and 4 bits are the most commonly used two kinds. The algorithm adopts an 8-bit S-box, which has a large hardware occupation area and a high software implementation efficiency. The algorithm adopts a 4-bit S-box, which has a small hardware occupation area. In addition, parallel query of the 4-bit S-box can be realized by a SIMD instruction, so that the algorithm has a high software implementation efficiency on a modern PC.

[0003] The construction of the round function is the most important link in the design of the block cipher. The most common round function construction method combines S-box and linear layer, which is convenient for evaluating the security strength of the algorithm, provides strong security, and is also the key component affecting the encryption and decryption speed of the algorithm.

[0004] Modern block cipher algorithms mostly follow the design guidelines of multiple rounds of iteration of round functions, and SPN is one of the most commonly used structures. The international standard AES algorithm adopts this structure, but the hardware implementation resource occupation of the AES algorithm based on an 8-bit S-box is relatively high. Based on this structure, a series of lightweight algorithms are proposed, such as Midori, Skinny and the like. The design of this kind of algorithm is relatively similar to the structure of the AES algorithm. According to the block length, 16 units are divided, and arranged in a 4*4 matrix. The block length of 64 bits is divided into 16 4-bit units, and the block length of 128 bits is divided into 16 byte units. The nonlinear layer adopts a 4-bit or 8-bit S-box, which is determined by the unit size. The linear layer includes unit position permutation and simple operations such as MDS code. Based on the 128-bit block cipher, a 4-bit S-box is used as the nonlinear layer. This kind of algorithm usually has a relatively complex linear operation, such as uBlock, FESH and the like, thereby causing the overall hardware resource occupation of the algorithm to be relatively high.

[0005] For a block cipher algorithm with a block length of 128 bits, a 4-bit S-box is used, and the 128-bit state can be divided into 32 4-bit units. How to design the linear layer based on 32 4-bit units can meet good diffusion while consuming very little resource. In this regard, Orthros adopts a 4-bit S-box and a 32-bit 4-bit unit design, but introduces a 128-bit bit permutation in the design. Although this can produce strong diffusion, it brings difficulties to the security proof of the algorithm, and also brings problems to the software implementation of the algorithm, resulting in very low software implementation efficiency. SUMMARY

[0006] The present application provides a construction method, device, electronic equipment and storage medium of a block cipher round function, to solve the problems of high resource occupation in hardware efficient implementation and low software implementation efficiency of existing block cipher algorithms.

[0007] The first aspect embodiment of the present application provides a construction method of a block cipher round function, including the following steps: performing bit-by-bit exclusive or of a plaintext block and a key generation round function initial state, performing row-by-row replacement of 32 S-box units of the round function by using a multi-bit S-box; performing bit grouping on the replaced round function, performing exclusive or of a multi-bit constant, and performing position permutation on 32 positions of the round function as an S-box unit, so that there is no 9-round impossible differential based on the iteration of the round function, and there is no 9-round effective differential route; multiplying each column of an intermediate state matrix of the round function by a preset matrix to perform column mixing, and performing bit-by-bit exclusive or of a round key on the column-mixed round function. After multiple iterations, the final state of the round function is obtained.

[0008] Optionally, in an embodiment of the present application, the operation property when the 32 positions of the round function are position-permuted in units of S-boxes includes that each row is permuted, the elements in one column are permuted to different columns, the elements in the same column are permuted to different columns after twice position permutation, and any one S-box after 4 rounds of iteration of the block cipher algorithm will affect the 32 S-box units of the output.

[0009] Optionally, in an embodiment of the present application, the S-boxes with multiple bits include S-boxes with 4 bits or S-boxes with 8 bits; and the number of the S-boxes is 32.

[0010] Optionally, in an embodiment of the present application, the multiple-bit constant is a 32-bit constant.

[0011] The second aspect embodiment of the present application provides a construction device of a round function of a block cipher, which includes: a substitution module, configured to XOR the plaintext block with the key generation round function initial state bit by bit, and substitute the 32 S-box units of the round function with S-boxes with multiple bits one by one; a permutation module, configured to XOR the substituted round function with a multiple-bit constant after bit grouping, and position-permute the 32 positions of the round function in units of S-boxes, so that there is no 9-round impossible differential based on iteration of the round function, and there is also no 9-round effective differential route; and an output module, configured to multiply each column of an intermediate state matrix of the round function with a preset matrix to perform column mixing, and XOR the round function after column mixing with a round key bit by bit, and obtain the final state of the round function after multiple rounds of iteration.

[0012] Optionally, in an embodiment of the present application, the operation property when the 32 positions of the round function are position-permuted in units of S-boxes includes that each row is permuted, the elements in one column are permuted to different columns, the elements in the same column are permuted to different columns after twice position permutation, and any one S-box after 4 rounds of iteration of the block cipher algorithm will affect the 32 S-box units of the output.

[0013] Optionally, in an embodiment of the present application, the S-boxes with multiple bits include S-boxes with 4 bits or S-boxes with 8 bits; and the number of the S-boxes is 32.

[0014] Optionally, in an embodiment of the present application, the multiple-bit constant is a 32-bit constant.

[0015] The third aspect embodiment of the present application provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor executes the program to perform the construction method of the round function of the block cipher as described in the above embodiments.

[0016] The fourth aspect of the application provides a computer readable storage medium, which stores a computer program. The program is executed by a processor to perform the construction method of the round function of the block cipher as described in the above embodiments.

[0017] The construction method, device, electronic equipment and storage medium of the round function of the block cipher provided by the application are based on the SPN structure, 4-bit or 8-bit S-boxes are used, the linear diffusion layer is finely researched, the round function designed and proposed can provide sufficient confusion and diffusion, full diffusion can be realized in 4 rounds, the block cipher algorithm constructed based on the round function is convenient for security proof against differential and linear attacks. The algorithm occupies less hardware resources, uses low-latency S-boxes to obtain low-latency properties, is convenient for SIMD instruction implementation, has high implementation efficiency in software, supports various running platforms, and is flexible.

[0018] Additional aspects and advantages of the application will be in part apparent and in part pointed out hereinafter. BRIEF DESCRIPTION OF DRAWINGS

[0019] The above and / or additional aspects and advantages of the application will become apparent and be readily appreciated from the following description, taken in conjunction with the accompanying drawings, in which:

[0020] Figure 1 A flowchart of the construction method of the round function of the block cipher according to the embodiment of the application is provided.

[0021] Figure 2 An example diagram of the construction device of the round function of the block cipher according to the embodiment of the application is provided.

[0022] Figure 3 A structural schematic diagram of the electronic equipment provided by the embodiment of the application is provided. DETAILED DESCRIPTION

[0023] The embodiments of the application are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar notations represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by referring to the accompanying drawings are exemplary and are intended to explain the application, and cannot be understood as a limitation of the application.

[0024] Figure 1 A flowchart of the construction method of the round function of the block cipher according to the embodiment of the application is provided.

[0025] As shown in Figure 1 the construction method of the round function of the block cipher includes the following steps:

[0026] In step S101, the plaintext block is bit-wise XORed with the whitening key to generate the initial state of the round function, and the round function is replaced by a multi-bit S-box.

[0027] The multi-bit S-box includes a 4-bit S-box or an 8-bit S-box.

[0028] As a specific embodiment, taking a 4-bit S-box as an example, the round function of the present application adopts a substitution-permutation network (SPN) structure as the overall structure of the algorithm. The SPN structure is implemented through multiple iterations of the round function, and the round function adopts a 128-bit block length. During encryption, the plaintext block is first bit-wise XORed with the whitening key RK0.

[0029] The 128-bit block can be represented as 32 4-bit units, and the following matrix is used:

[0030]

[0031] The round function includes: S-box substitution (SubByte), byte permutation (PosPerm), column mixing (MixColumn), and round key addition operation, where RK1, RK2, …, RK N are generated by a key scheduling algorithm. Finally, the output is the ciphertext C. The pseudo code of the encryption algorithm is as follows:

[0032] X0=P⊕RK0

[0033] for i=0to N-1

[0034] {

[0035] / / r=i+1th round (r=1,2,…,N)

[0036] Y i =SubByte(X i )

[0037] Z i =AddConst(Y i )

[0038] U i =PosPerm(Z i )

[0039] W i =MixColumn(U i )

[0040] X i+1 =W i ⊕RK i+1

[0041] }

[0042] C=X N

[0043] First, S-box substitution is performed. A 32 4-bit S-box is queried. The S-box has high security strength, is a permutation, satisfies balance, has optimal differential probability, has optimal linear bias probability, has an algebraic degree of 3, and each 1-bit output expression is nonlinear. The S-box can be selected according to requirements, such as a small S-box or a small delay S-box. The substitution table of the selected S-box is shown in Table 1:

[0044] Table 1 S-box substitution table

[0045] Input 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Output 11 8 10 0 15 14 2 1 9 12 13 4 3 6 5 7

[0046] In step S102, the substituted round function is subjected to bit grouping, XORing with a multi-bit constant, and position permutation of the round function in units of S-boxes, so that there is no 9-round impossible differential based on the iteration of the round function, and there is also no 9-round effective differential route.

[0047] The round function of the above embodiment is designed based on a 128-bit grouping and a 4-bit S-box. If the S-box is expanded to 8 bits, the grouping length is 32*8=256, and the phenomena of 9-round impossible differential and 9-round differential do not exist at the same time after 4 rounds of full diffusion, which can also be satisfied, which is equivalent to expanding the round function.

[0048] As a specific implementation, the present application uses a 32-bit optimal constant XORing manner, XORing 32-bit constants c={c0, c1, c2, c3, c4, c5, c6, c7} in the first two columns of the round function, and is based on a 6-bit LFSR structure and a feedback polynomial (a0, a1, a2, a3, a4, a5) -> (a5 ^ a4 ^ 1, a0, a1, a2, a3, a4). The corresponding round constants of (c0, c1) are shown in Table 2:

[0049] Table 2 Constant plus first two byte values

[0050] Round 0 1 2 3 4 5 6 7 8 9 10 Constant 0x80 0xc0 0xe0 0xf0 0xf8 0x7c 0xbc 0xdc 0xec 0xf4 0x78 Round 11 12 13 14 15 16 17 18 19 20 21 Constant 0x3c 0x9c 0xcc 0xe4 0x70 0xb8 0x5c 0xac 0xd4 x68 0x34 Round 22 23 24 25 26 27 28 29 30 31 Constant 0x18 0xc 0x84 0x40 0xa0 0xd0 0xe8 0x74 0x38 0x1c

[0051] When the key length is 128 bits, (c2, c3, c4, c5) = 0x5a5a, and when the key length is 256 bits, (c2, c3, c4, c5) = 0xa3a3. It is used to distinguish different key length corresponding algorithm version.

[0052] The corresponding round constants of (c6, c7) are composed of the decimal part of pi, as shown in Table 3:

[0053] Table 3 Constant plus last two byte values

[0054] Round 0 1 2 3 4 5 6 7 8 9 10 Constant 0xa0 0xac 0x93 0x29 0xac 0x4b 0xc9 0x91 0xc2 0x31 0x32 Round 11 12 13 14 15 16 17 18 19 20 21 Constant 0x19 0xc1 0x93 0xca 0x81 0x44 0x20 0xcb 0x8b 0x49 0xcc Round 22 23 24 25 26 27 28 29 30 31 Constant 0x9b 0xa8 0x82 0xc1 0x04 0xba 0x4a 0x22 0xc9 0x18

[0055] Z = AddConst(Y), where z i = y i ⊕ c i , i = 0, 1, 2, 3. z i = y i , i = 4, 5,..., 31.

[0056] The 32 4-bit unit states obtained after replacing the S-box are position permuted for each row, and the position permutation order of the 32 units is shown in Table 4:

[0057] Table 4 Position transformation of each row

[0058]

[0059]

[0060] U = PosPerm(Z) = {u0, u1,..., u 31}, u i = z p(i) , i = 0, 1,..., 31.

[0061] Optionally, in an embodiment of the present application, the operation properties when the round function is position permuted in S-box units include: each row is permuted, the elements in the same column are permuted to different columns, the elements in the same column are permuted to different columns after two times of position permutation, and any S-box after 4 rounds of the block cipher algorithm iteration will affect the 32 S-box units of the output.

[0062] It can be understood that in the position permutation of 32 positions in S-box units, there are the following operation properties:

[0063] 1) Each row is permuted;

[0064] 2) The elements in the same column are permuted to different columns;

[0065] 3) The elements in the same column are permuted to different columns after two times of position permutation;

[0066] 4) After 4 rounds of the algorithm, 1 active box input can affect the 32 S-box units of the output, that is, 4 rounds produce full diffusion.

[0067] Further, the position permutation of 32 units of the round function in the above embodiment is constructed based on 4 rows of 8 units, which can be further extended, and any 32-bit position permutation can be screened with the same design requirements. In constant addition, the constant can be replaced with parameters combined with a key scheduling algorithm, which can be set according to actual conditions without specific limitation.

[0068] It should be noted that, in this step, if the constant is not increased, that is, the constant addition operation is not performed, or the constant addition does not meet the condition, the embodiments of the present application can perform the constant addition operation in the following step, for example, a constant can be added in the round key RKI to achieve the same effect in this step.

[0069] In step S103, each column of the intermediate state matrix of the round function is multiplied by a preset matrix to perform column mixing, and the round function after column mixing is bitwise XORed with the round key, and after multiple rounds of iteration, the final state of the round function is obtained.

[0070] As a specific embodiment, in the column mixing, a 4x4 matrix M can be used to multiply each column of the intermediate state matrix, and the matrix M is as follows:

[0071]

[0072] wherein the matrix M -1 = M.

[0073] W = {w0, w1, …, w 31} = MixColumn(U), that is:

[0074]

[0075] In the encryption process of the rth round (r = 1, 2, …, N), the state W after column mixing operation is bitwise XORed with the round key RK r , and the output state is obtained.

[0076] According to the construction method of the round function of the block cipher proposed in the embodiments of the present application, a position permutation is proposed, the position permutation adopts a row transformation manner, and a position permutation construction rule is given, 4 rounds are generated to achieve full diffusion, and it is convenient for SIMD, AVX and other instructions to be implemented. The constant addition is placed in the round function, and the constant addition combines 6-bit LFSR with a period of 63, fixed constant and random number, and a small amount of constant is involved in each round, such as 32-bit to avoid weak key, invariant subspace attack, etc., which can be applied to computer communication network, Internet of Things, mobile communication network, etc.

[0077] Secondly, the construction device of the round function of the block cipher according to the embodiments of the present application is described with reference to the accompanying drawings.

[0078] Figure 2 The block diagram of the construction device of the round function of the block cipher according to the embodiments of the present application is shown.

[0079] As shown in Figure 2 , the construction device 10 of the round function of the block cipher includes a substitution module 100, a permutation module 200 and an output module 300.

[0080] The substitution module 100 is configured to perform bit-by-bit exclusive-OR whitening on the plaintext group with the initial state of the round function, and replace the 32 S-box units of the round function with the multi-bit S-box one by one; the permutation module 200 is configured to perform bit grouping on the replaced round function, exclusive-OR the multi-bit constant, and perform position permutation on the 32 positions of the round function in the unit of S-box, so that there is no 9-round impossible differential based on the iteration of the round function, and there is also no 9-round valid differential route; and the output module 300 is configured to perform column mixing by multiplying each column of the intermediate state matrix of the round function with a preset matrix, and exclusive-OR the round key bit by bit after the column mixing, so as to obtain the final state of the round function after multiple iterations.

[0081] Optionally, in the embodiment of the present application, the operation properties when the 32 positions of the round function in the unit of S-box are position permuted include that each row is permuted, the elements in the same column are permuted to different columns, the elements in the same column are permuted to different columns after twice position permutation, and any S-box of the block cipher algorithm after 4 iterations will affect the 32 S-box units of the output.

[0082] Optionally, in the embodiment of the present application, the multi-bit S-box includes a 4-bit S-box or an 8-bit S-box; and the number of S-boxes is 32.

[0083] Optionally, in the embodiment of the present application, the multi-bit constant is a 32-bit constant.

[0084] It should be noted that the foregoing explanation and description of the construction method embodiment of the block cipher round function also apply to the construction device of the block cipher round function of this embodiment, which will not be described here again.

[0085] The construction device of the block cipher round function according to the embodiment of the present application is based on the SPN structure and uses a 4-bit S-box, and the linear diffusion layer is finely researched, the designed round function can provide sufficient confusion and diffusion, full diffusion can be achieved in 4 rounds, and the block cipher algorithm constructed based on the round function is convenient for security proof against differential and linear attacks. The algorithm occupies less hardware resources, uses a low-latency S-box to obtain a low-latency attribute, is convenient for SIMD instruction implementation, has high implementation efficiency in software, supports multiple running platforms, and is flexible.

[0086] Figure 3 A structural schematic diagram of an electronic device provided in the embodiment of the present application is shown. The electronic device can include:

[0087] The memory 301, the processor 302, and the computer program stored in the memory 301 and executable on the processor 302.

[0088] The processor 302 implements the construction method of the round function of the block cipher provided in the above embodiments when executing a program.

[0089] Further, the electronic device further comprises:

[0090] The communication interface 303 is configured to communicate between the memory 301 and the processor 302.

[0091] The memory 301 is configured to store a computer program executable on the processor 302.

[0092] The memory 301 can include a high-speed RAM memory, and can further include a non-volatile memory, for example, at least one disk memory.

[0093] If the memory 301, the processor 302 and the communication interface 303 are implemented independently, the communication interface 303, the memory 301 and the processor 302 can be connected to each other through a bus and complete communication between each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For convenience of representation, Figure 3 Only one thick line is used in the figure, but it does not mean that there is only one bus or only one type of bus.

[0094] Optionally, in a specific implementation, if the memory 301, the processor 302 and the communication interface 303 are integrated on a chip, the memory 301, the processor 302 and the communication interface 303 can complete communication between each other through an internal interface.

[0095] The processor 302 can be a Central Processing Unit (CPU), or an Application Specific Integrated Circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0096] The embodiments further provide a computer readable storage medium, which stores a computer program, and the program is executed by a processor to implement the construction method of the round function of the block cipher as above.

[0097] In the description of the application, reference to "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" etc. means that a particular feature, structure, material or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the application. The illustrative appearances of the above-mentioned terms in various places in the specification are not necessarily referred to the same embodiment or example. Moreover, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples. Furthermore, in non-contradictory cases, those skilled in the art can combine and combine the features of different embodiments or examples described in the specification and the features of different embodiments or examples.

[0098] In addition, the terms "first", "second" are only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the technical features indicated. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the application, the meaning of "N" is at least two, such as two, three, etc., unless otherwise specifically limited.

[0099] Any process or method descriptions or descriptions of the flow diagrams in the specification can be understood as representing code modules, segments or portions of code which include one or more executable instructions for implementing the specified logic function(s) or process(es) and the preferred embodiments of the application include additional implementations in which the order of execution or the functions are not the same as those illustrated and described. It is therefore intended that the application embraces all such variations and modifications. The application also includes the combinations of the individual features recited in the claims.

[0100] It should be understood that parts of the application can be implemented in hardware, software, firmware or a combination thereof. In the above-described embodiments, the N steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. As in another embodiment, if implemented in hardware, any of the following technologies known in the art or their combinations can be used: discrete logic circuit with logic gate circuit for implementing logic functions on data signals, application specific integrated circuit with suitable combination logic gate circuit, programmable gate array (PGA), field programmable gate array (FPGA) and the like.

[0101] Those skilled in the art of the present technology can understand that all or part of the steps carried out by the above-mentioned embodiment method can be completed by program instructions to the relevant hardware, and the program can be stored in a computer readable storage medium. The program includes one or a combination of steps of the method embodiments when executed.

Claims

1. A method of constructing a round function of a block cipher, characterized in that, The method comprises the following steps: bitwise XORing the plaintext block with the initial state of the round function generated by the whitening key, replacing the 32 S-box units of the round function with the multi-bit S-box one by one; bit grouping the replaced round function and XORing a multi-bit constant, and performing position permutation on the 32 positions of the round function in S-box units, so that there is no 9-round impossible differential and no 9-round valid differential route based on the iteration of the round function; performing column mixing by multiplying each column of the intermediate state matrix of the round function with a preset matrix from the left, and bitwise XORing the round key with the column-mixed round function, and obtaining the final state of the round function after multiple iterations. The operation properties when performing position permutation on the 32 positions of the round function in S-box units include that each row is permuted, the elements in the same column are changed to different columns after each permutation, the elements in the same column are changed to different columns after twice position permutation, and any S-box after 4 rounds of iteration of the block cipher algorithm will affect the 32 S-box units of the output.

2. The method of claim 1, wherein the multi-bit S-box comprises a 4-bit S-box or an 8-bit S-box; the number of S-boxes is 32.

3. The method of claim 1, wherein the multi-bit constant is a 32-bit constant.

4. An apparatus for constructing a round function of a block cipher, characterized by comprising: It comprises: a replacement module for bitwise XORing the plaintext block with the initial state of the round function generated by the whitening key, and replacing the 32 S-box units of the round function with the multi-bit S-box one by one; a permutation module for bit grouping the replaced round function and XORing a multi-bit constant, and performing position permutation on the 32 positions of the round function in S-box units, so that there is no 9-round impossible differential and no 9-round valid differential route based on the iteration of the round function; an output module for performing column mixing by multiplying each column of the intermediate state matrix of the round function with a preset matrix from the left, and bitwise XORing the round key with the column-mixed round function, and obtaining the final state of the round function after multiple iterations. The operation properties when performing position permutation on the 32 positions of the round function in S-box units include that each row is permuted, the elements in the same column are changed to different columns after each permutation, the elements in the same column are changed to different columns after twice position permutation, and any S-box after 4 rounds of iteration of the block cipher algorithm will affect the 32 S-box units of the output.

5. The apparatus of claim 4, wherein the multi-bit S-box comprises a 4-bit S-box or an 8-bit S-box; the number of S-boxes is 32.

6. The apparatus of claim 4, wherein the multi-bit constant is a 32-bit constant.

7. An electronic device, comprising: It comprises: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the program to implement the construction method of the block cipher round function according to any one of claims 1-3.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the construction method of the block cipher round function according to any one of claims 1-3.

Images