Data processing apparatus based on sha2 algorithm

Abstract

The embodiment of the present application provides a data processing device based on SHA2 algorithm. In the scheme of the embodiment of the present application, the data processing device comprises an arithmetic mask conversion module, an arithmetic addition operation module, a Boolean mask conversion module, an iteration operation module and a Boolean addition operation module. The mask is used for AND and addition operation in the arithmetic mask conversion module, the arithmetic addition operation module, the Boolean mask conversion module, the iteration operation module and the Boolean addition operation module, data protection is realized in the hash operation, the intermediate variable related to the key is prevented from being leaked due to side channel attack, and the input data and the key information are prevented from being leaked in the HMAC calculation process.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data processing device based on the SHA2 algorithm. Background Technology

[0002] Security chips are dedicated chips that integrate cryptographic algorithms to provide encryption and security authentication services for computers. They play a crucial role in the field of information security. With the proliferation of the Internet of Things (IoT) and smart home devices, security chip technology is also attracting significant attention.

[0003] A hash function is a method for creating a digital fingerprint from arbitrary data. It is widely used in information security and is an essential feature of security chips. The Secure Hash Algorithm (SHA) includes SHA-0, SHA-1, SHA-2, and SHA-3 algorithms. Among these, the SHA-2 algorithm is widely used in message authentication codes, digital signature verification, SSL handshakes, and blockchain.

[0004] HMAC (Hash Message Authentication Code) is a key-related hash operation widely used in the SSL protocol. HMAC calculations involve XORing the key with a fixed bit sequence, and the calculation process must be secure. Constructing HMACs using the SHA-2 algorithm is common. However, without data protection during SHA-2 calculations, side-channel attacks can easily recover key-related intermediate variables in the hash operation. This allows attackers to impersonate the source and forge messages without attacking the authentication key, resulting in the leakage of input data and key information during HMAC calculations. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a data processing apparatus based on the SHA2 algorithm to at least partially solve the above-mentioned problems.

[0006] According to a first aspect of the present invention, a data processing apparatus based on the SHA2 algorithm is provided, comprising: an arithmetic mask conversion module, configured to perform arithmetic mask conversion on an initial digest, an initial digest mask, a message, and a message mask to obtain an arithmetic-format digest, a digest mask, a message, and a message mask; an arithmetic addition operation module, configured to perform SHA2-based arithmetic addition on the arithmetic-format digest, digest mask, message, and message mask to obtain an arithmetic update digest, an arithmetic update digest mask, an arithmetic update message, and an arithmetic update message mask; and a Boolean mask conversion module, configured to convert the arithmetic update digest, arithmetic update message, message mask ... The update digest mask, arithmetic update message, and arithmetic update message mask are converted into Boolean masks to obtain Boolean format update digest, update digest mask, update message, and update message mask; an iterative operation module is used to perform SHA2-based iterative operations on the Boolean format update digest, update digest mask, update message, and update message mask to obtain iterated Boolean digest and Boolean digest mask; a Boolean addition operation module is used to perform Boolean addition operations on the iterated Boolean digest, the iterated Boolean digest mask, the initial digest, and the initial digest mask to obtain updated digest and digest mask.

[0007] In another implementation of the present invention, the arithmetic mask conversion module is specifically used to: perform arithmetic mask conversion on the initial digest, initial digest mask, message and message mask with random numbers respectively to obtain an arithmetic format digest, digest mask, message and message mask.

[0008] In another implementation of the present invention, the arithmetic addition module is specifically used for: performing Ch / Maj function operations on the initial digest and the initial digest mask to obtain Ch data, Ch mask, Maj data, and Maj data mask; and performing arithmetic addition operations on the arithmetic format digest, digest mask, message, and message mask, and the Ch data, Ch mask, Maj data, and Maj data mask to obtain an arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask.

[0009] In another implementation of the present invention, the arithmetic addition module is specifically used to: perform XOR operations on the initial digest and the initial digest mask with random numbers respectively to obtain XOR data; and perform arithmetic mask conversion on the XOR data to obtain Ch data, Ch mask, Maj data and Maj data mask.

[0010] In another implementation of the present invention, the arithmetic addition module is specifically used for: obtaining SHA2-based operation parameters; processing the initial digest and initial digest mask to obtain a first digest, a first digest mask, a second digest, and a second digest mask; processing the message and message mask to obtain a first message, a first message mask, a second message, and a second message mask; and performing a compression concatenation operation on the first digest, the first digest mask, the second digest, the second digest mask, the first message, the first message mask, the second message, the second message, the second message mask, the SHA2-based operation parameters, and the Ch data, the Ch mask, the Maj data, and the Maj data mask to obtain an arithmetic update digest, an arithmetic update digest mask, an arithmetic update message, and an arithmetic update message mask.

[0011] In another implementation of the present invention, the arithmetic addition module is specifically used for: processing the SHA2-based operation parameters to obtain a first parameter, a second parameter, a third parameter, a fourth parameter, a fifth parameter, and a first parameter mask, a second parameter mask, a third parameter mask, a fourth parameter mask, and a fifth parameter mask; performing a compression concatenation operation on the first digest, the first message, the first parameter, and the Ch data to obtain first temporary data; performing a compression concatenation operation on the first digest mask, the first message mask, the first parameter mask, and the Ch data mask to obtain a first temporary data mask; performing arithmetic addition on the first message and the second parameter to obtain second temporary data; and performing arithmetic addition on the first message mask and the second parameter mask to obtain a second temporary data mask. A first arithmetic update digest is obtained by performing a compression concatenation operation on the first temporary data, the third parameter, the Maj data, and the fifth parameter; a first arithmetic update digest mask is obtained by performing a compression concatenation operation on the first temporary data mask, the third parameter mask, and the Maj data mask; a second arithmetic update digest mask is obtained by performing a compression concatenation operation on the first temporary data, the second digest, and the fifth parameter mask; a second arithmetic update digest mask is obtained by performing a compression concatenation operation on the first temporary data mask and the second digest mask; a third arithmetic update digest mask is obtained by performing a compression concatenation operation on the fourth parameter mask, the second temporary data mask, and the second message mask; and a third arithmetic update digest mask is obtained by performing a compression concatenation operation on the fourth parameter mask, the second temporary data mask, and the second message mask.

[0012] In another implementation of the present invention, the Boolean mask conversion module is specifically used for: performing masking processing on the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask with the random number respectively to obtain temporary values ​​of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask; performing iterative calculations on the temporary values ​​of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask respectively to obtain carry generation values ​​and carry propagation values ​​of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask respectively; and performing Boolean mask conversion on the carry generation values ​​and carry propagation values ​​of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask respectively to obtain Boolean format update digest, update digest mask, update message, and update message mask.

[0013] In another implementation of the present invention, the Boolean mask conversion module is specifically used for: performing arithmetic mask conversion on the Boolean update digest, Boolean update digest mask, Boolean update message, and Boolean update message mask to obtain the iteratively calculated arithmetic digest, arithmetic digest mask, arithmetic message, and arithmetic message mask; performing SHA2-based arithmetic addition on the iteratively calculated arithmetic digest, arithmetic digest mask, arithmetic message, and arithmetic message mask to obtain the iteratively calculated arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask; and performing Boolean mask conversion on the iteratively calculated arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask to obtain the Boolean update digest, Boolean update digest mask, Boolean update message, and Boolean update message mask for the next round of iterative calculation.

[0014] In another implementation of the present invention, the iterative operation module is specifically used for: performing an XOR operation on the iterated Boolean digest and the iterated Boolean digest mask to obtain iterated data in non-masked format; performing carry calculation on the iterated Boolean digest, the iterated Boolean digest mask, and the iterated data in non-masked format to obtain a carry number; and performing a Boolean addition operation on the initial digest, the initial digest mask, the iterated data in non-masked format, and the carry number to obtain an updated digest and digest mask.

[0015] According to a second aspect of the present invention, a data processing method based on the SHA2 algorithm is provided, comprising: performing an arithmetic masking operation on an initial digest, an initial digest mask, a message, and a message mask to obtain an arithmetic-format digest, a digest mask, a message, and a message mask; performing a SHA2-based arithmetic addition operation on the arithmetic-format digest, digest mask, message, and message mask to obtain an arithmetic update digest, an arithmetic update digest mask, an arithmetic update message, and an arithmetic update message mask; performing a Boolean masking operation on the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask to obtain a Boolean-format update digest, update digest mask, update message, and update message mask; performing a SHA2-based iterative operation on the Boolean-format update digest, update digest mask, update message, and update message mask to obtain an iterated Boolean digest and a Boolean digest mask; and performing a Boolean addition operation on the iterated Boolean digest, the iterated Boolean digest mask, the initial digest, and the initial digest mask to obtain an updated digest and a digest mask.

[0016] According to a third aspect of the present invention, a data processing circuit based on the SHA2 algorithm is provided, comprising: a Boolean mask to arithmetic mask conversion unit, a compressor unit, a Ch and Maj function calculation unit, an arithmetic mask to Boolean mask conversion unit, an algorithm control unit, and a storage unit.

[0017] In another implementation of the present invention, the SHA2 algorithm includes: SHA-224 algorithm, SHA-256 algorithm, SHA-384 algorithm, and SHA-512 algorithm, wherein the SHA-384 algorithm and SHA-512 algorithm reuse the circuit structure used by the SHA-224 algorithm and SHA-256 algorithm.

[0018] In another implementation of the present invention, the highest clock frequency of the circuit synthesized for the SHA2-based arithmetic addition operation is 150MHz.

[0019] According to a fourth aspect of the present invention, an electronic device is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; the memory is used to store at least one executable instruction, which causes the processor to perform an operation corresponding to the method described in the second aspect.

[0020] According to a fifth aspect of the present invention, a computer storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method described in the second aspect.

[0021] In the embodiments of this invention, the data processing apparatus includes: an arithmetic mask conversion module, an arithmetic addition operation module, a Boolean mask conversion module, an iterative operation module, and a Boolean addition operation module. By employing masks for AND and addition operations in the arithmetic mask conversion module, the arithmetic addition operation module, the Boolean mask conversion module, the iterative operation module, and the Boolean addition operation module, data protection is achieved in the hash operation, preventing the leakage of key-related intermediate variables due to side-channel attacks and avoiding the leakage of input data and key information during HMAC calculation. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0023] Figure 1 This is a schematic block diagram of a data processing apparatus based on the SHA2 algorithm according to an embodiment of the present invention.

[0024] Figure 2A , 2B 2C and 2D are schematic diagrams of data processing based on the SHA2 algorithm according to an embodiment of the present invention.

[0025] Figure 3 This is a schematic block diagram of a data processing apparatus based on the SHA2 algorithm according to another embodiment of the present invention.

[0026] Figure 4 This is a schematic block diagram of a data processing method based on the SHA2 algorithm according to an embodiment of the present invention.

[0027] Figure 5 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0028] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be clearly and thoroughly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art should fall within the protection scope of the present invention.

[0029] It should be understood that the terms "first," "second," and "third," etc., in the claims, specification, and drawings of this disclosure are used to distinguish different objects, not to describe a specific order. The terms "comprising" and "including" as used in the specification and claims of this disclosure indicate the presence of the described features, integrals, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or collections thereof.

[0030] It should also be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this disclosure. As used in this disclosure and claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this disclosure and claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations.

[0031] The SHA-2 algorithm in this invention includes message preprocessing and hash operation. SHA-2 includes four algorithms: SHA-224, SHA-256, SHA-384, and SHA-512. SHA-224 and SHA-256 are used to process messages with a length less than 2 bytes. 64 The message is processed in 512-bit groups, with a total of 64 rounds of computation. SHA-256 yields a 256-bit message digest, and SHA-224 truncates the high 224 bits of the 256-bit digest as the output digest. SHA-384 and SHA-512 are used to process messages shorter than 2 bytes. 128 The message consists of 1024 bits per group, and the computation is performed in 80 rounds. SHA-512 calculates a 512-bit message digest, and SHA-384 truncates the high 384 bits of the 512-bit digest as the output digest.

[0032] Taking SHA-256 as an example, after message padding is completed, message expansion is performed on each 512-bit message block:

[0033]

[0034] in,

[0035]

[0036]

[0037] Use the message digest from the previous group as the 8 initial digests for this group:

[0038]

[0039]

[0040] Then perform 64 rounds of iterative calculations: For t = 0 to 63:

[0041] {

[0042]

[0043]

[0044] h=g, g=f, f=e, e=d+T1,

[0045] d=c, c=b, b=a, a=T1+T2,

[0046] }

[0047] in,

[0048]

[0049]

[0050] Finally, calculate the message summary for this group:

[0051]

[0052]

[0053]

[0054]

[0055]

[0056]

[0057]

[0058]

[0059] All addition operations are modulo 32 addition.

[0060] After calculating all N sets of messages, the final summary is obtained:

[0061]

[0062] Figure 1This is a schematic block diagram of a data processing apparatus based on the SHA2 algorithm according to another embodiment of the present invention. The solutions of this embodiment can be applied to electronic devices, including but not limited to: terminal devices with communication functions or electronic devices with data processing capabilities.

[0063] The data processing device based on the SHA2 algorithm in this embodiment can be used for side-channel secure SHA2 hardware implementation, including:

[0064] The arithmetic mask conversion module is used to perform arithmetic mask conversion on the initial digest, initial digest mask, message, and message mask to obtain the digest, digest mask, message, and message mask in arithmetic format.

[0065] It should be noted that the arithmetic masking conversion here refers to converting data with Boolean masks, such as initial digest, initial digest mask, message and message mask, into arithmetic format data, such as arithmetic format digest, digest mask, message and message mask, so that the real data is not leaked during the calculation process.

[0066] The arithmetic addition module is used to perform SHA2-based arithmetic addition on the digest, digest mask, message and message mask of the arithmetic format to obtain the arithmetic update digest, arithmetic update digest mask, arithmetic update message and arithmetic update message mask;

[0067] The Boolean mask conversion module is used to convert the arithmetic update digest, arithmetic update digest mask, arithmetic update message and arithmetic update message mask into Boolean masks to obtain update digest, update digest mask, update message and update message mask in Boolean format.

[0068] It should be noted that the Boolean mask conversion here refers to converting the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask into Boolean format update digest, update digest mask, update message, and update message mask, which facilitates iterative operations based on SHA2.

[0069] Since Boolean operations, such as circular shift, XOR, and NOT, are no longer applicable to arithmetic data, it is necessary to convert the arithmetic data to Boolean data before performing the operations. Preferably, multiple parallel Boolean mask conversions can be performed; for example, for 32-bit arithmetic data, the conversion requires 6 clock cycles to complete.

[0070] The iterative operation module is used to perform SHA2-based iterative operations on the Boolean format update digest, update digest mask, update message, and update message mask to obtain the iterated Boolean digest and Boolean digest mask.

[0071] The Boolean addition module is used to perform Boolean addition operations on the iterated Boolean digest, the iterated Boolean digest mask, the initial digest, and the initial digest mask to obtain the updated digest and digest mask.

[0072] In the embodiments of this invention, the data processing apparatus includes: an arithmetic mask conversion module, an arithmetic addition operation module, a Boolean mask conversion module, an iterative operation module, and a Boolean addition operation module. By employing masks for AND and addition operations in the arithmetic mask conversion module, the arithmetic addition operation module, the Boolean mask conversion module, the iterative operation module, and the Boolean addition operation module, data protection is achieved in the hash operation, preventing the leakage of key-related intermediate variables due to side-channel attacks and avoiding the leakage of input data and key information during HMAC calculation.

[0073] In one possible implementation, the arithmetic mask conversion module is specifically used to: perform arithmetic mask conversion on the initial digest, initial digest mask, message and message mask with random numbers respectively to obtain an arithmetic format digest, digest mask, message and message mask.

[0074] It should be noted that, as Figure 2A As shown, in this invention, the arithmetic masking conversion uses a masking scheme to protect the true power consumption information of the intermediate value, thereby achieving side-channel security. The original data (e.g., the initial digest and the initial digest mask) is divided into two equal-length data parts, a and am: a = A ⊕ rnd, am = rnd, where rnd is a random number. Specifically, SHA-224 and SHA-256 have a single digest and message length of 32 bits, while SHA-384 and SHA-512 have a single digest and message length of 64 bits.

[0075] Specifically, given the original data (a, a_m) and a random number γ of the same length...

[0076] 1) Calculate on the first beat of the clock

[0077]

[0078]

[0079] Store the result in a temporary register.

[0080] 2) Calculate the arithmetic mask a_m of a at the second beat of the clock. Ari :

[0081]

[0082] This yields the arithmetic format data pair (a, a_m) Ari ).

[0083] It should be noted that the implementation of this scheme requires calculations such as XOR, AND, NOT, addition, shift, and cyclic shift. Among them, nonlinear calculations include AND and addition. Boolean format data needs to be XORed with random numbers to eliminate the correlation between the data and the real data before the data is processed.

[0084] In one possible implementation, the arithmetic addition module is specifically used to: perform Ch / Maj function operations on the initial digest and the initial digest mask to obtain Ch data, Ch mask, Maj data, and Maj data mask; and perform arithmetic addition operations on the arithmetic format digest, digest mask, message, and message mask, and the Ch data, Ch mask, Maj data, and Maj data mask to obtain an arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask.

[0085] In one possible implementation, the arithmetic addition module is specifically used to: perform an XOR operation on the initial digest and the initial digest mask with a random number to obtain XOR data; and perform an arithmetic mask conversion on the XOR data to obtain Ch data, Ch mask, Maj data, and Maj data mask.

[0086] It should be noted that the Ch data, Ch mask, Maj data, and Maj data mask obtained through the Ch / Maj function are in arithmetic format. Taking the calculation and conversion of Ch data and Ch mask as an example, the entire process requires two clock cycles: Where e, f, g are a set of Boolean format data, namely a digest and a digest mask, for example, (e, e_m), (f, f_m), (g, g_m). γ and τ are two random numbers with the same bit width as e, f, g.

[0087] Step 1: On the first clock tick, perform an XOR operation to calculate the resulting components, mask them with random numbers, and then store the data in a temporary register.

[0088]

[0089]

[0090]

[0091]

[0092] The above calculation method ensures that the data and the data mask are not calculated simultaneously, and prevents data leakage by adding random numbers.

[0093] The second step involves performing an arithmetic mask conversion on the second clock tick, converting the Boolean data to arithmetic format data:

[0094]

[0095] The arithmetic data pair (Ch, Ch_m) is obtained. The implementation method for Maj data and its mask is similar to that of Ch; both can store the data in a temporary register after using a random number mask, thus sharing the temporary register and reducing hardware resource consumption. Preferably, the operation of the Ch / Maj function can be controlled by the algorithm control module.

[0096] In one possible implementation, the arithmetic addition module is specifically used for: obtaining SHA2-based operation parameters; processing the initial digest and initial digest mask to obtain a first digest, a first digest mask, a second digest, and a second digest mask; processing the message and message mask to obtain a first message, a first message mask, a second message, and a second message mask; and performing a compression concatenation operation on the first digest, the first digest mask, the second digest, the second digest mask, the first message, the first message mask, the second message, the second message mask, the SHA2-based operation parameters, and the Ch data, Ch mask, Maj data, and Maj data mask to obtain an arithmetic update digest, an arithmetic update digest mask, an arithmetic update message, and an arithmetic update message mask.

[0097] It should be noted that the compression cascade operation here can be performed using compressors. Each compressor reduces the number of addition operands by one, and using multiple compressors effectively reduces the critical path of the addition carry chain. Specifically, as shown... Figure 2B As shown, compression cascading can be performed using a 3:2 compressor, similar to a carry-retaining adder, which reduces the number of addends that are directly added and lowers the latency of the addition chain path.

[0098] In one possible implementation, the arithmetic addition module is specifically used for: processing the SHA2-based operation parameters to obtain a first parameter, a second parameter, a third parameter, a fourth parameter, a fifth parameter, and a first parameter mask, a second parameter mask, a third parameter mask, a fourth parameter mask, and a fifth parameter mask; performing a compression concatenation operation on the first digest, the first message, the first parameter, and the Ch data to obtain first temporary data; performing a compression concatenation operation on the first digest mask, the first message mask, the first parameter mask, and the Ch data mask to obtain a first temporary data mask; performing arithmetic addition on the first message and the second parameter to obtain second temporary data; and performing arithmetic addition on the first message mask and the second parameter mask to obtain a second temporary data mask. A first arithmetic update digest is obtained by performing a compression concatenation operation on the first temporary data, the third parameter, the Maj data, and the fifth parameter; a first arithmetic update digest mask is obtained by performing a compression concatenation operation on the first temporary data mask, the third parameter mask, and the Maj data mask; a second arithmetic update digest mask is obtained by performing a compression concatenation operation on the first temporary data, the second digest, and the fifth parameter mask; a second arithmetic update digest mask is obtained by performing a compression concatenation operation on the first temporary data mask and the second digest mask; a third arithmetic update digest mask is obtained by performing a compression concatenation operation on the fourth parameter mask, the second temporary data mask, and the second message mask; and a third arithmetic update digest mask is obtained by performing a compression concatenation operation on the fourth parameter mask, the second temporary data mask, and the second message mask.

[0099] Specifically, the first two clock cycles perform arithmetic mask transformations on a portion of the intermediate data, namely the first digest (digest 7), the first message (message), the first parameter (δ0), the second parameter (∑1), and Ch. The remaining data is calculated in the next two clock cycles. This reduces the hardware overhead of arithmetic mask transformation. Since the operations of δ0 and ∑1 are linear, the data and data mask need to be calculated separately. The Ch function operation includes bitwise AND operation to convert the data into an arithmetic mask, adding the converted data and the data mask separately, and storing the result in a temporary register.

[0100] First temporary data tmp0 = digest_h + message0 + ∑1 + Ch

[0101] First temporary data mask tmp0_m = digest_h_m + message0_m + ∑1_m + Ch_m

[0102] Second temporary data tmp1 = message0 + δ0

[0103] Second temporary data mask tmp1_m = message0_m + δ0_m

[0104] For tmp0 and tmp0_m, two compressors can be cascaded to reduce the four addends to two, thereby reducing the delay of the high-bit-width addition link and shortening the critical path length of the circuit.

[0105] The next two clock cycles are used to perform additional data calculations and transformations, namely the second digest (digest 3), the second message (message 9), the third parameter (δ1), the fourth parameter (∑0), the Maj data, and the Maj data mask. Similarly, the calculations of δ1 and ∑0 are linear.

[0106] First arithmetic update summary digest0_new = tmp0 + ∑0 + Maj + Kt (fifth parameter)

[0107] First arithmetic update digest mask digest0_m_new=tmp0_m+∑0_m+Maj_m

[0108] Second arithmetic update summary digest4_new = tmp0 + digest_d + K t (Fifth parameter mask)

[0109] Second arithmetic update digest mask digest4_m_new = tmp0_m + digest_d_m

[0110] Third arithmetic update summary message15_new = δ1 + tmp1 + message9

[0111] The third arithmetic update digest mask is message15_m_new = δ1 + tmp1_m + message9_m

[0112] Preferably, each of digest0_new, digest0_m_new, digest4_new, message15_new, and message15_m_new can be cascaded using a compressor.

[0113] In one possible implementation, the Boolean mask conversion module is specifically used to: perform masking processing on the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask with the random number respectively, to obtain temporary values ​​of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask; perform iterative calculations on the temporary values ​​of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask respectively, to obtain carry generation values ​​and carry propagation values ​​of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask respectively; and perform Boolean mask conversion on the carry generation values ​​and carry propagation values ​​of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask respectively, to obtain Boolean format update digest, update digest mask, update message, and update message mask.

[0114] It should be noted that Boolean mask conversion involves giving two k-bit wide addends A and B. The carry C (carry number) is calculated using intermediate signals (temporary values) such as G (carry generation value) and P (carry propagation value), ultimately yielding the sum of A and B.

[0115] Assuming the data width is k, the number of iterations required for carry is:

[0116]

[0117] The initial values ​​of P0 and G0 are:

[0118]

[0119] G0 = A & B

[0120] for i = 1 to n:

[0121] {

[0122] P i =P i-1 &(P i-1 <<2 i-1 )

[0123]

[0124] }

[0125] get:

[0126] C = 2G n

[0127]

[0128] During Boolean masking, the arithmetic update digest, arithmetic update digest mask, arithmetic update message mask, and arithmetic update message mask are first masked again using random numbers to prevent leakage of the actual carry information during the conversion process. The shifting in the algorithm is a linear computation, implemented using a combinational logic shifter. Specifically, for arithmetic format data pairs (a, a_m... Ari ) and two random numbers γ and τ of the same length as the data:

[0129] Step 1: On the first clock cycle, mask the arithmetic format data pair again with a random number and store the temporary value in a temporary register.

[0130]

[0131]

[0132] The second step is to calculate intermediate signals such as G (carry generation) and P (carry propagation).

[0133]

[0134]

[0135] The masks P0_m and G0_m for P0 and G0 are:

[0136] P0_m=γ

[0137] G0_m=τ

[0138] Step 3: Iterative calculation of P i and G i .

[0139] Nonlinear AND computation is achieved using the XOR random number reshare method, denoted as P. i The four parts are P i 0 P i 1 P i 2 P i 3 Stored into registers respectively:

[0140]

[0141]

[0142]

[0143]

[0144] Get P i and its Boolean mask P i_m:

[0145]

[0146]

[0147] Then iterate n times (n is the number of iterations required to carry over) to obtain P. n-1 and P n-1 _m.

[0148] Similarly, let G be the denoted G. i The four parts are G i 0 G i 1 G i 2 G i 3 Stored into registers respectively:

[0149]

[0150]

[0151]

[0152]

[0153] Get G i and its Boolean mask G i _m:

[0154]

[0155]

[0156] Then iterate n times (n is related to the data bit width) to obtain G. n and G n _m.

[0157] The Boolean conversion value (A, A_m) is obtained using carry calculation:

[0158]

[0159]

[0160] The conversion takes a total of n+1 clock cycles.

[0161] In one possible implementation, the Boolean mask conversion module is specifically used to: perform arithmetic mask conversion on the Boolean update digest, Boolean update digest mask, Boolean update message, and Boolean update message mask to obtain the iteratively calculated arithmetic digest, arithmetic digest mask, arithmetic message, and arithmetic message mask; perform SHA2-based arithmetic addition on the iteratively calculated arithmetic digest, arithmetic update digest mask, arithmetic message, and arithmetic message mask to obtain the iteratively calculated arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask; and perform Boolean mask conversion on the iteratively calculated arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask to obtain the Boolean update digest, Boolean update digest mask, Boolean update message, and Boolean update message mask for the next round of iterative calculation.

[0162] In one possible implementation, the iterative operation module is specifically used to: perform an XOR operation on the iterated Boolean digest and the iterated Boolean digest mask to obtain iterated data in non-masked format; perform carry calculation on the iterated Boolean digest, the iterated Boolean digest mask, and the iterated data in non-masked format to obtain a carry number; and perform a Boolean addition operation on the initial digest, the initial digest mask, the iterated data in non-masked format, and the carry number to obtain an updated digest and digest mask.

[0163] It should be noted that, as Figure 2C As shown, after the SHA2-based iterative operation is completed, the iterated Boolean digest and Boolean digest mask are obtained. At this time, the iterated Boolean digest and Boolean digest mask no longer contain the actual value information of the initial message and digest. The mask digest can be directly XORed to restore the iterative data in non-mask format.

[0164] Specifically, for the initial digest and initial digest mask (a, b), the iterative data c in non-masked format, the carry, the carry mask is rng, and the maximum data bit width is 64 bits. This invention uses 32-bit random numbers concatenated to form a 64-bit random number, meaning the high 32 bits and low 32 bits have the same value.

[0165]

[0166] digest_update: c

[0167] For carry, bit n has:

[0168]

[0169] Where carry[0] is 0, a n-1 b n-1 cn-1 This represents bit(n-1) with respect to a, b, and c.

[0170]

[0171] The combinational logic used to calculate carry is quite long and may leak the true value of a^b. Therefore, a carry mask with random numbers is introduced, and the calculation is performed in stages. Intermediate values ​​such as b&c and a&c are used to ensure that no glitch leaks the actual data during calculation. Registers are used to segment long carry chains, calculating the maximum 64-bit carry in 4 clock cycles, reducing circuit latency.

[0172] like Figure 2D As shown in the timing diagram, digest_up_en is digest_update, which corresponds to the valid flag 'c' in the timing diagram. Validity indicates the start of the calculation, and the carry calculation process is as follows:

[0173] Step 1: On the first clock cycle, store the current 32-bit random number rng in a register and expand it to 64 bits to serve as a carry mask; Step 2: On the second clock cycle, calculate... In the third clock cycle, calculate b&c and carry[16:1]; in the fourth clock cycle, store carry

[16] in a temporary register and calculate carry[32:17]; in the fifth clock cycle, store carry

[32] in a temporary register and calculate carry[48:33]; in the sixth clock cycle, use carry

[48] to calculate carry[63:49]. The carry calculation is now complete, and the carry mask is the rng stored in the first step. Alternatively, steps three through six can be combined in the third clock cycle to calculate carry[63:1].

[0174] Preferably, such as Figure 3 As shown, it also includes a storage module and a bus module, specifically used for: updating and storing the Boolean-formatted update digest, update digest mask, update message and update message mask, updated digest and digest mask, and exchanging data through the bus module. It should be noted that the storage module and bus module can also be used to update and store the initial digest, initial digest mask, message and message mask, and exchange data through the bus module.

[0175] Preferably, such as Figure 3 As shown, it also includes an algorithm control module, which is specifically used to: implement data processing of Boolean format data of different lengths, not limited to 32 / 64 bits.

[0176] Figure 4An exemplary flow diagram of a data processing method based on the SHA2 algorithm according to an embodiment of the present invention is shown. This data processing method based on the SHA2 algorithm of the present embodiment can be used for side-channel secure SHA-2 hardware implementation, including:

[0177] S410: Perform arithmetic masking on the initial digest, initial digest mask, message, and message mask to obtain the digest, digest mask, message, and message mask in arithmetic format.

[0178] S420: Perform SHA2-based arithmetic addition on the digest, digest mask, message, and message mask of the arithmetic format to obtain an arithmetic update digest, an arithmetic update digest mask, an arithmetic update message, and an arithmetic update message mask.

[0179] S430: Perform Boolean mask conversion on the arithmetic update digest, arithmetic update digest mask, arithmetic update message and arithmetic update message mask to obtain Boolean format update digest, update digest mask, update message and update message mask.

[0180] S440: Perform SHA2-based iterative operations on the Boolean-formatted update digest, update digest mask, update message, and update message mask to obtain the iterated Boolean digest and Boolean digest mask.

[0181] S450: Perform a Boolean addition operation on the iterated Boolean digest, the iterated Boolean digest mask, the initial digest, and the initial digest mask to obtain the updated digest and digest mask.

[0182] Preferably, the update digest, update digest mask, update message, and update message mask in Boolean format can be stored in the storage module and updated iteratively. Furthermore, to reduce computational complexity, data computation, register updates, and iterative operations can be controlled through an algorithm control module, and the data can be stored.

[0183] Preferably, the updated digest and digest mask can be updated in the storage module and the data can be exchanged through the bus module.

[0184] Preferably, data processing of Boolean format data of different lengths can be achieved through the algorithm control module, not limited to 32 / 64 bits.

[0185] In one possible implementation, the step of performing arithmetic mask transformation on the initial digest, initial digest mask, message, and message mask to obtain an arithmetic format digest, digest mask, message, and message mask includes: performing arithmetic mask transformation on the initial digest, initial digest mask, message, and message mask with a random number respectively to obtain an arithmetic format digest, digest mask, message, and message mask.

[0186] In one possible implementation, performing SHA2-based arithmetic addition on the arithmetic format digest, digest mask, message, and message mask to obtain an arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask includes: performing a Ch / Maj function operation on the initial digest and the initial digest mask to obtain Ch data, Ch mask, Maj data, and Maj data mask; and performing arithmetic addition on the arithmetic format digest, digest mask, message, and message mask and the Ch data, Ch mask, Maj data, and Maj data mask to obtain an arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask.

[0187] In one possible implementation, the step of performing the Ch / Maj function operation on the initial digest and the initial digest mask to obtain Ch data, Ch mask, Maj data, and Maj data mask includes: performing an XOR operation on the initial digest and the initial digest mask with a random number to obtain XOR data; and performing an arithmetic mask transformation on the XOR data to obtain Ch data, Ch mask, Maj data, and Maj data mask.

[0188] In one possible implementation, the step of performing arithmetic addition on the digest, digest mask, message, and message mask of the arithmetic format, and the Ch data, Ch mask, Maj data, and Maj data mask to obtain an arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask includes: obtaining SHA2-based operation parameters; processing the initial digest and initial digest mask to obtain a first digest, a first digest mask, a second digest, and a second digest mask; processing the message and message mask to obtain a first message, a first message mask, a second message, and a second message mask; and performing a compression concatenation operation on the first digest, the first digest mask, the second digest, the second digest mask, the first message, the first message mask, the second message, the second message mask, the SHA2-based operation parameters, and the Ch data, Ch mask, Maj data, and Maj data mask to obtain an arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask.

[0189] In one possible implementation, the step of performing a compression concatenation operation on the first digest, the first digest mask, the second digest, the second digest mask, the first message, the first message mask, the second message, the second message mask, the SHA2-based operation parameters, and the Ch data, Ch mask, Maj data, and Maj data mask to obtain an arithmetic update digest, an arithmetic update digest mask, an arithmetic update message, and an arithmetic update message mask includes: processing the SHA2-based operation parameters to obtain a first parameter, a second parameter, a third parameter, a fourth parameter, a fifth parameter, and a first parameter mask, a second parameter mask, a third parameter mask, a fourth parameter mask, and a fifth parameter mask; performing a compression concatenation operation on the first digest, the first message, the first parameter, and the Ch data to obtain first temporary data; performing a compression concatenation operation on the first digest mask, the first message mask, the first parameter mask, and the Ch data mask to obtain a first temporary data mask; and ... The process involves: performing arithmetic addition on the first message and the second parameter to obtain second temporary data; performing arithmetic addition on the first message mask and the second parameter mask to obtain a second temporary data mask; performing compression concatenation on the first temporary data, the third parameter, the Maj data, and the fifth parameter to obtain a first arithmetic update digest; performing compression concatenation on the first temporary data mask, the third parameter mask, and the Maj data mask to obtain a first arithmetic update digest mask; performing compression concatenation on the first temporary data, the second digest, and the fifth parameter mask to obtain a second arithmetic update digest; performing compression concatenation on the first temporary data mask and the second digest mask to obtain a second arithmetic update digest mask; performing compression concatenation on the fourth parameter, the second temporary data, and the second message to obtain a third arithmetic update digest mask; and performing compression concatenation on the fourth parameter mask, the second temporary data mask, and the second message mask to obtain a third arithmetic update digest mask.

[0190] In one possible implementation, the step of performing a Boolean mask conversion on the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask to obtain Boolean format update digest, update digest mask, update message, and update message mask includes: performing masking processing on the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask with the random number respectively to obtain temporary values ​​for the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask; Iteratively calculate the temporary values ​​of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask to obtain the carry generation value and carry propagation value of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask. Perform Boolean mask conversion on the carry generation value and carry propagation value of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask to obtain the update digest, update digest mask, update message, and update message mask in Boolean format.

[0191] In one possible implementation, the SHA2-based iterative operation includes: performing an arithmetic mask transformation on the Boolean update digest, Boolean update digest mask, Boolean update message, and Boolean update message mask to obtain the iteratively calculated arithmetic digest, arithmetic digest mask, arithmetic message, and arithmetic message mask; performing SHA2-based arithmetic addition on the iteratively calculated arithmetic digest, arithmetic digest mask, arithmetic message, and arithmetic message mask to obtain the iteratively calculated arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask; and performing a Boolean mask transformation on the iteratively calculated arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask to obtain the Boolean update digest, Boolean update digest mask, Boolean update message, and Boolean update message mask for the next round of iterative operation.

[0192] In one possible implementation, performing a Boolean addition operation on the iterated Boolean digest, the iterated Boolean digest mask, the initial digest, and the initial digest mask to obtain an updated digest and digest mask includes: performing an XOR operation on the iterated Boolean digest and the iterated Boolean digest mask to obtain iterated data in non-masked format; performing a carry calculation on the iterated Boolean digest, the iterated Boolean digest mask, and the iterated data in non-masked format to obtain a carry number; and performing a Boolean addition operation on the initial digest, the initial digest mask, the iterated data in non-masked format, and the carry number to obtain an updated digest and digest mask.

[0193] The data processing circuit based on the SHA2 algorithm in this embodiment includes: a Boolean mask to arithmetic mask conversion unit, a compressor unit, a Ch and Maj function calculation unit, an arithmetic mask to Boolean mask conversion unit, an algorithm control unit, and a storage unit.

[0194] Preferably, since the calculation methods of the Ch and Maj functions are the same, the intermediate function calculations such as Ch and Maj in SHA2 can be implemented through the Ch and Maj function calculation units, thus reusing the Ch and Maj function calculation units, thereby optimizing the hardware area of ​​the data processing circuit and saving a lot of logic resource overhead.

[0195] It should be noted that implementing the SHA-2 algorithm through a data processing circuit based on the SHA-2 algorithm can not only achieve the advantage of high security, but also improve the operation speed and increase the computational efficiency.

[0196] In one possible implementation, the SHA2 algorithm includes: SHA-224 algorithm, SHA-256 algorithm, SHA-384 algorithm, and SHA-512 algorithm, wherein the SHA-384 algorithm and SHA-512 algorithm reuse the circuit structure used by the SHA-224 algorithm and SHA-256 algorithm.

[0197] It should be noted that the implementation of other SHA2 algorithms is similar to that of SHA-256. SHA-384 / SHA-512 both have a 64-bit data width and perform modulo-64 addition. In their implementation, a 64-bit temporary register is used to store temporary values, and the Boolean-to-arithmetic mask conversion unit, compressor unit, Ch and Maj function calculation units, arithmetic-to-Boolean mask conversion unit, algorithm control unit, and storage unit from the SHA-256 circuit structure are reused to reduce area overhead.

[0198] The SHA2 algorithm is implemented using the circuit described in this invention. Logic reuse reduces hardware resource overhead and optimizes critical path delay and area. The circuit can be configured for each SHA2 algorithm according to different requirements, while ensuring side-channel security of the computation process and results.

[0199] In one possible implementation, the highest clock frequency of the circuit synthesized for the SHA2-based arithmetic addition operation is 150MHz.

[0200] It should be noted that the timing of the addition link of digest a and digest e in the critical path of the SHA2 algorithm implementation has been optimized. After synthesis, the highest clock frequency that the circuit can operate at is 150MHz, which improves the applicability and optimizes the critical path of the algorithm, making the circuit operate at a higher clock frequency.

[0201] Reference Figure 5 The diagram shows a schematic of an electronic device according to another embodiment of the present invention. The specific embodiments of the present invention do not limit the specific implementation of the electronic device.

[0202] like Figure 5 As shown, the electronic device may include: a processor 502, a communications interface 504, a memory 506 storing a program 510, and a communications bus 508.

[0203] The processor, communication interface, and memory communicate with each other via a communication bus. The communication interface is used to communicate with other electronic devices or servers. The processor executes programs, specifically the steps described in the method embodiments above. Specifically, the program may include program code, which includes computer operation instructions.

[0204] The processor may be a CPU, an Application Specific Integrated Circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The one or more processors included in a smart device may be of the same type, such as one or more CPUs; or they may be of different types, such as one or more CPUs and one or more ASICs.

[0205] Memory is used to store programs. Memory may include high-speed RAM, and may also include non-volatile memory, such as at least one disk drive.

[0206] Specifically, the program can be used to cause the processor to perform the following operations: performing arithmetic masking on the initial digest, initial digest mask, message, and message mask to obtain an arithmetic-formatted digest, digest mask, message, and message mask; performing SHA2-based arithmetic addition on the arithmetic-formatted digest, digest mask, message, and message mask to obtain an arithmetic-updated digest, arithmetic-updated digest mask, arithmetic-updated message, and arithmetic-updated message mask; performing Boolean masking on the arithmetic-updated digest, arithmetic-updated digest mask, arithmetic-updated message, and arithmetic-updated message mask to obtain a Boolean-formatted updated digest, updated digest mask, updated message, and updated message mask; performing SHA2-based iterative operations on the Boolean-formatted updated digest, updated digest mask, updated message, and updated message mask to obtain an iterated Boolean digest and Boolean digest mask; and performing Boolean addition on the iterated Boolean digest, the iterated Boolean digest mask, the initial digest, and the initial digest mask to obtain an updated digest and digest mask.

[0207] The above embodiments are only used to illustrate the embodiments of the present invention and are not intended to limit the embodiments of the present invention. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of the embodiments of the present invention. Therefore, all equivalent technical solutions also fall within the scope of the embodiments of the present invention, and the patent protection scope of the embodiments of the present invention should be defined by the claims. The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions.

[0208] For ease of description, the above apparatus is described by dividing it into various functional units. Of course, in implementing this invention, the functions of each unit can be implemented in one or more software and / or hardware components.

[0209] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0210] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0211] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0212] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0213] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, a network interface, and memory. Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0214] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0215] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0216] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0217] This invention can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific transactions or implement specific abstract data types. This invention can also be practiced in distributed computing environments where transactions are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0218] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

Claims

1. A data processing device based on the SHA2 algorithm, comprising: The arithmetic mask conversion module is used to perform arithmetic mask conversion on the initial digest, initial digest mask, message, and message mask to obtain the digest, digest mask, message, and message mask in arithmetic format. The arithmetic addition module is used to perform SHA2-based arithmetic addition on the digest, digest mask, message and message mask of the arithmetic format to obtain the arithmetic update digest, arithmetic update digest mask, arithmetic update message and arithmetic update message mask; The Boolean mask conversion module is used to convert the arithmetic update digest, arithmetic update digest mask, arithmetic update message and arithmetic update message mask into Boolean masks to obtain update digest, update digest mask, update message and update message mask in Boolean format. The iterative operation module is used to perform SHA2-based iterative operations on the Boolean format update digest, update digest mask, update message, and update message mask to obtain the iterated Boolean digest and Boolean digest mask. The Boolean addition module is used to perform Boolean addition on the iterated Boolean digest, the iterated Boolean digest mask, the initial digest, and the initial digest mask to obtain the updated digest and digest mask. The Boolean mask conversion module is specifically used for: The arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask are respectively masked with random numbers to obtain temporary values ​​for the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask. The temporary values ​​of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask are calculated iteratively to obtain the carry generation value and carry propagation value of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask, respectively. Boolean mask transformations are performed on the carry generation and carry propagation values ​​of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask, respectively, to obtain the Boolean format update digest, update digest mask, update message, and update message mask.

2. The apparatus according to claim 1, wherein, The arithmetic mask conversion module is specifically used for: The initial digest, initial digest mask, message, and message mask are each converted to a random number using arithmetic masking to obtain the digest, digest mask, message, and message mask in arithmetic format.

3. The apparatus according to claim 2, wherein, The arithmetic addition module is specifically used for: Perform the Ch / Maj function operation on the initial digest and the initial digest mask to obtain Ch data, Ch mask, Maj data, and Maj data mask; An arithmetic addition operation is performed on the digest, digest mask, message and message mask of the arithmetic format and the Ch data, Ch mask, Maj data and Maj data mask to obtain the arithmetic update digest, arithmetic update digest mask, arithmetic update message and arithmetic update message mask.

4. The apparatus according to claim 3, wherein, The arithmetic addition module is specifically used for: The initial digest and the initial digest mask are XORed with random numbers respectively to obtain the XOR data; Perform an arithmetic mask transformation on the XOR data to obtain Ch data, Ch mask, Maj data, and Maj data mask.

5. The apparatus according to claim 4, wherein, The arithmetic addition module is specifically used for: Obtain the SHA2-based operation parameters; process the initial digest and initial digest mask to obtain the first digest, the first digest mask, the second digest, and the second digest mask; The message and message mask are extended to obtain a first message, a first message mask, a second message, and a second message mask; The first digest, the first digest mask, the second digest, the second digest mask, the first message, the first message mask, the second message, the second message mask, the SHA2-based operation parameters, the Ch data, the Ch mask, the Maj data, and the Maj data mask are compressed and concatenated to obtain an arithmetic update digest, an arithmetic update digest mask, an arithmetic update message, and an arithmetic update message mask.

6. The apparatus according to claim 5, wherein, The arithmetic addition module is specifically used for: Linear calculations are performed on the SHA2-based operation parameters to obtain the first parameter, the second parameter, the third parameter, the fourth parameter, the fifth parameter, and the first parameter mask, the second parameter mask, the third parameter mask, the fourth parameter mask, and the fifth parameter mask; The first digest, the first message, the first parameter, and the Ch data are compressed and concatenated to obtain the first temporary data; the first digest mask, the first message mask, the first parameter mask, and the Ch data mask are compressed and concatenated to obtain the first temporary data mask. Perform arithmetic addition on the first message and the second parameter to obtain the second temporary data; perform arithmetic addition on the first message mask and the second parameter mask to obtain the second temporary data mask; A compression concatenation operation is performed on the first temporary data, the third parameter, the Maj data, and the fifth parameter to obtain a first arithmetic update digest; a compression concatenation operation is performed on the first temporary data mask, the third parameter mask, and the Maj data mask to obtain a first arithmetic update digest mask; A compression concatenation operation is performed on the first temporary data, the second digest, and the fifth parameter mask to obtain a second arithmetic update digest; a compression concatenation operation is performed on the first temporary data mask and the second digest mask to obtain a second arithmetic update digest mask; A compression concatenation operation is performed on the fourth parameter, the second temporary data, and the second message to obtain a third arithmetic update digest; a compression concatenation operation is performed on the fourth parameter mask, the second temporary data mask, and the second message mask to obtain a third arithmetic update digest mask.

7. The apparatus according to claim 1, wherein, The Boolean mask conversion module is specifically used for: The Boolean update digest, Boolean update digest mask, Boolean update message, and Boolean update message mask are transformed by arithmetic mask to obtain the arithmetic digest, arithmetic digest mask, arithmetic message, and arithmetic message mask for iterative computation. Perform SHA2-based arithmetic addition on the arithmetic digest, arithmetic digest mask, arithmetic message, and arithmetic message mask of the iterative calculation to obtain the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask of the iterative calculation. The arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask obtained by the iterative calculation are transformed into Boolean masks to obtain the Boolean update digest, Boolean update digest mask, Boolean update message, and Boolean update message mask used for the next round of iterative calculation.

8. The apparatus according to claim 1, wherein, The iterative operation module is specifically used for: Perform an XOR operation on the iterated Boolean digest and the iterated Boolean digest mask to obtain iterated data in non-mask format; The carry-in is calculated by performing carry-out calculation on the iterated Boolean digest, the iterated Boolean digest mask, and the iterated data in non-mask format; Boolean addition is performed on the initial digest, the initial digest mask, the iterative data in non-mask format, and the carry number to obtain the updated digest and digest mask.

9. A data processing method based on the SHA2 algorithm, comprising: The initial digest, initial digest mask, message, and message mask are converted into arithmetic masks to obtain the digest, digest mask, message, and message mask in arithmetic format. Perform SHA2-based arithmetic addition on the digest, digest mask, message, and message mask of the arithmetic format to obtain the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask; The arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask are converted to Boolean masks to obtain the update digest, update digest mask, update message, and update message mask in Boolean format. Perform SHA2-based iterative operations on the Boolean-formatted update digest, update digest mask, update message, and update message mask to obtain the iterated Boolean digest and Boolean digest mask; Boolean addition is performed on the iterated Boolean digest, the iterated Boolean digest mask, the initial digest, and the initial digest mask to obtain the updated digest and digest mask; The step of performing a Boolean mask conversion on the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask to obtain a Boolean format update digest, update digest mask, update message, and update message mask includes: The arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask are respectively masked with random numbers to obtain temporary values ​​for the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask. The temporary values ​​of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask are calculated iteratively to obtain the carry generation value and carry propagation value of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask, respectively. Boolean mask transformations are performed on the carry generation and carry propagation values ​​of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask, respectively, to obtain the Boolean format update digest, update digest mask, update message, and update message mask.

10. A data processing circuit based on the SHA2 algorithm, comprising: Boolean mask to arithmetic mask conversion unit, compressor unit, Ch and Maj function calculation unit, arithmetic mask to Boolean mask conversion unit, algorithm control unit, and storage unit; The Boolean mask to arithmetic mask conversion unit is used to perform arithmetic mask conversion on the initial digest, initial digest mask, message and message mask to obtain an arithmetic format digest, digest mask, message and message mask; The compressor unit is used to perform SHA2-based arithmetic addition on the digest, digest mask, message and message mask of the arithmetic format to obtain an arithmetic update digest, an arithmetic update digest mask, an arithmetic update message and an arithmetic update message mask. The arithmetic mask to Boolean mask conversion unit is used to perform masking processing on the arithmetic update digest, arithmetic update digest mask, arithmetic update message and arithmetic update message mask with random numbers respectively to obtain temporary values ​​of the arithmetic update digest, arithmetic update digest mask, arithmetic update message and arithmetic update message mask. The temporary values ​​of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask are calculated iteratively to obtain the carry generation value and carry propagation value of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask, respectively. Boolean mask transformations are performed on the carry generation and carry propagation values ​​of the arithmetic update digest, arithmetic update digest mask, arithmetic update message, and arithmetic update message mask, respectively, to obtain the update digest, update digest mask, update message, and update message mask in Boolean format.

11. The circuit according to claim 10, wherein, The SHA2 algorithm includes: SHA-224 algorithm, SHA-256 algorithm, SHA-384 algorithm, and SHA-512 algorithm. The SHA-384 algorithm and SHA-512 algorithm reuse the circuit structure used by the SHA-224 algorithm and SHA-256 algorithm.

12. The circuit according to claim 11, wherein, The highest clock frequency of the circuit used in the SHA2-based arithmetic addition operation is 150MHz after synthesis.

13. An electronic device, comprising: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction that causes the processor to perform the operation corresponding to the method as described in claim 9.

14. A computer storage medium having a computer program stored thereon, which, when executed by a processor, implements the method of claim 9.

Images