Implementation method of improved algorithm SAFE for ROCCA algorithm

Abstract

The present application is directed to the security problem of ROCCA algorithm and the low-efficiency implementation problem of the algorithm in the resource-restricted embedded environment, and provides an implementation method of an improved algorithm SAFE for the ROCCA algorithm in the ARM Cortex series embedded microprocessor environment.The SAFE round function adopts the components of the AES twice iteration, so that the SAFE can be efficiently implemented based on the semi-fixed slice in the resource-restricted embedded device; and in order to improve the security of the algorithm, the SAFE algorithm improves the structure of the ROCCA algorithm, on the one hand, adds two sets of operations of the key XOR initialization and the key XOR generation tag, and on the other hand, makes corresponding modifications to the initialization, the encryption plaintext and the generation tag part of the ROCCA algorithm.Compared with the ROCCA, the SAFE can better resist the key recovery attack, the state recovery attack and the differential attack, and has better security.

Description

Technical Field

[0001] This invention relates to the field of information security, specifically to an implementation method of an improved algorithm, SAFE, for the ROCCA algorithm in the context of ARM Cortex series embedded microprocessors. Background Technology

[0002] With the rapid development of information technology and the widespread adoption of embedded devices, their communication security has become increasingly important. Due to the limitations of storage space and operating speed in embedded devices, fast and easy-to-implement block cipher algorithms, such as the classic Advanced Encryption Standard (AES), are widely researched and applied.

[0003] In recent years, many researchers both domestically and internationally have been studying optimized implementations of the AES block cipher algorithm based on ARM Cortex series embedded microprocessors. In 2018, Benjamin et al., based on the ARM Cortex-A8, achieved data-level parallelism using 16 independent S-boxes of AES with bit slicing. At the 2020 ARM International Conference, Wang et al., using ARM Cortex-M series boards, improved the speed of AES byte substitution by 33% and saved 68% of random bits. In 2021, Alexandre et al. implemented AES-128 on the ARM Cortex-M series using fixed-slice technology, reducing the number of operations required for the AES-128 linear layer by 52%; simultaneously, Alexandre et al. completed a semi-fixed-slice implementation of AES-128 on ARM, which reduced the code size by more than half compared to the fixed-slice implementation, making it more suitable for embedded devices. Semi-fixed-slice AES is an extension of fixed-slice AES. When AES is implemented using fixed-slice technology, firstly, the bits in one round of AES are fixed, which is equivalent to omitting the row shift operation; secondly, in order to ensure the alignment of S-box operation bits, other slices in one round of AES also need to be fixed; finally, the column obfuscation operations of the four consecutive rounds of AES are adjusted. The disadvantage of fixed-slice AES is that it requires four different linear layer implementations, leading to an increase in code size. To solve this problem, row shift is calculated every two rounds, thus requiring only two different column obfuscation implementations, i.e., semi-fixed-slice AES.

[0004] In 2021, Liu et al. [1] proposed an efficient cryptographic algorithm, ROCCA, based on the AES algorithm. ROCCA can be efficiently implemented in high-end devices with abundant hardware and software resources by utilizing the AESNI instruction set in the SIMD instruction set. However, the AESNI instruction set is a special SIMD instruction set with high application costs, and it is difficult to use in resource-constrained embedded devices. This leads to the low efficiency of the ROCCA algorithm in resource-constrained embedded devices. In addition, in 2022, Musashino et al. [2] proposed a complete key recovery attack against ROCCA, indicating that the security of the ROCCA algorithm also has certain defects.

[0005] References:

[0006] [1]Sakamoto K, Liu F, Nakano Y, et al. Rocca: An Efficient AES-basedEncryption Scheme for Beyond 5G[J]. IACR Trans on Symmetric Cryptology, 2021, 2021(2)1-30.

[0007] [2] Hosoyamada A, Inoue A, Ito R, et al. Cryptanalysis of Rocca and feasibility of its security claim [J]. IACR Trans on Symmetric Cryptology, 2022, 2022(1)123-151. Summary of the Invention

[0008] The purpose of this invention is to address the security issues of the ROCCA algorithm and its inefficient implementation in resource-constrained embedded environments. It provides an improved version of the ROCCA algorithm, SAFE, for use with ARM Cortex series embedded microprocessors. SAFE's round function employs a double-iteration AES component, enabling efficient implementation in resource-constrained embedded devices based on semi-fixed slices. Furthermore, to enhance security, SAFE improves the ROCCA algorithm structure by adding two sets of operations: key XOR initialization and key XOR tag generation. It also modifies the initialization, plaintext encryption, and tag generation parts of the ROCCA algorithm. Compared to ROCCA, SAFE offers better resistance to key recovery attacks, state recovery attacks, and differential attacks, thus providing superior security.

[0009] The technical solution to achieve the objective of this invention is:

[0010] An implementation method for an improved algorithm, SAFE, for the ROCCA algorithm includes the following steps:

[0011] (1) SAFE Algorithm Round Function Design

[0012] The SAFE algorithm's round function structure is similar to the ROCCA algorithm, employing an eight-input, eight-output structure comprised of P-permutations and nonlinear components. To improve algorithm security, a P-permutation with better diffusion perturbation than the ROCCA algorithm was selected through search and testing. To reduce implementation overhead and facilitate implementation using semi-fixed slices in ARM Cortex series embedded microprocessors, the four AES components in the single-round iteration of the ROCCA algorithm's nonlinear component were replaced with four AES components in a two-round iteration (AES...). 2 Once the component is completed, the number of iterations in the round function is reduced during initialization and other operations.

[0013] (2) Overall structure design of SAFE algorithm

[0014] To improve the security of the algorithm, the SAFE algorithm improved the structure of the ROCCA algorithm by adding two sets of operations: key XOR initialization and key XOR tag generation. This makes the SAFE algorithm structure include six parts: initialization, key XOR initialization, processing associated data, encrypting plaintext, key XOR tag generation, and tag generation.

[0015] On the other hand, the SAFE algorithm modifies the initialization, plaintext encryption, and tag generation parts of the ROCCA algorithm. Specifically, in the initialization part, based on the designed round function structure and differential analysis evaluation, the number of ROCCA round function iterations is reduced from 20 rounds to 9 rounds during initialization. In the plaintext encryption part, the simple XOR operation between plaintext and state bits is changed to a non-linear operation NL between plaintext and state bits, and two different 128-bit plaintext blocks are used as input parameters of the round function R to further update the state, so that the plaintext blocks can be better obfuscated to prevent attackers from easily recovering the internal state of the cryptographic algorithm using plaintext blocks. Compared with ROCCA, SAFE is better resistant to key recovery attacks. In the tag generation part, also based on the designed round function structure and differential analysis evaluation, the number of round function iterations is reduced from 20 rounds of ROCCA to 9 rounds.

[0016] (3) Implementation method of SAFE algorithm for ARM Cortex series embedded microprocessors

[0017] After configuring the environment for the Keil uVision5 runtime tool and the XCOM serial port debugging tool, the input and output variables and implementation modules are determined according to the SAFE algorithm structure. SAFE is then integrated and implemented on the STM32F4 development board using semi-fixed slice AES technology.

[0018] The beneficial effects of this invention are:

[0019] (1) In view of the security and efficiency problems of the ROCCA algorithm, this invention designs an improved ROCCA algorithm SAFE for the resource-constrained ARM environment based on the semi-fixed slice AES technology. This algorithm is superior to the ROCCA algorithm in terms of security, implementation cost and implementation performance.

[0020] (2) The SAFE algorithm of this invention has better resistance to differential attacks. When SAFE is initialized, under the single key setting, the lower bound of the number of active S-boxes in the first round measured by the MILP solver is 2 more than the lower bound of the number of active S-boxes in the third round of the ROCCA algorithm. The second round is the same as the fifth round of the ROCCA algorithm. The third round is 8 more than the seventh round of the ROCCA algorithm. The fourth round is 9 more than the ninth round of the ROCCA algorithm. The fifth round is 25 more than the eleventh round of the ROCCA algorithm. The lower bound of the active S-boxes in the 20th round of ROCCA is greater than 186, while the lower bound of the active S-boxes in the 9th round of SAFE is greater than 219. Therefore, compared with the 20 rounds of ROCCA, even if the SAFE round function is set to 9 rounds, it can still resist differential attacks very well, and its security against differential attacks is higher than that of the ROCCA algorithm.

[0021] (3) To address the security issue of the ROCCA algorithm being attacked by full-round key recovery, the SAFE algorithm of this invention can effectively resist key recovery attacks by using a key feedforward solution and introducing NL operation in the encrypted plaintext part. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of the overall structure of the improved algorithm SAFE of this invention;

[0023] Figure 2 This is a diagram of the structure of the SAFE round function R in the improved algorithm of this invention;

[0024] Figure 3 This is a diagram of the encryption structure of the improved SAFE algorithm of this invention;

[0025] Figure 4 This is a diagram of the decryption structure of the improved SAFE algorithm of this invention;

[0026] Figure 5 This is a comparison chart of encryption speeds between SAFE and ROCCA on the STM32F4 development board. Detailed Implementation

[0027] The present invention will be further described below with reference to the accompanying drawings and embodiments, but this is not intended to limit the scope of the invention.

[0028] Example

[0029] An implementation method for an improved algorithm, SAFE, for the ROCCA algorithm includes the following steps:

[0030] (1) SAFE Algorithm Round Function Design

[0031] The SAFE round function structure is the same as the ROCCA algorithm, using an eight-input eight-output structure, consisting of P-permutations and nonlinear components.

[0032] (2) Overall structure design of SAFE algorithm

[0033] Reference Figure 1 The SAFE algorithm structure consists of six parts: initialization, key XOR initialization, processing associated data, encrypting plaintext, key XOR generating tags, and generating tags.

[0034] (3) Implementation method of SAFE algorithm for ARM Cortex series embedded microprocessors

[0035] After configuring the environment for the Keil uVision5 runtime tool and the XCOM serial port debugging tool, the input and output variables and implementation modules are determined according to the SAFE algorithm structure. SAFE is then integrated and implemented on the STM32F4 development board using semi-fixed slice AES technology.

[0036] Furthermore, in the embodiment, the SAFE algorithm round function design in step (1) refers to... Figure 2 The specific steps are as follows:

[0037] (1.1) The SAFE round function has 8 128-bit states as input and output. First, the input states are shuffled by a P permutation. Then, the output state is obtained by operating on the P-permutated states through a nonlinear unit. The nonlinear unit consists of 4 XOR units and 4 AES two-round iterations (AES... 2 ) Components;

[0038] (1.2) To improve the security of the SAFE algorithm, a new P-permutation with better diffusion confusion than the ROCCA round function structure was selected. The new P-permutation was obtained through the following exhaustive search method:

[0039] (1.2.1) Randomly shuffle eight 128-bit input states and search for new P permutations;

[0040] (1.2.2) Test the strict avalanche effect of the new P substitution. If the strict avalanche effect of the new P substitution is better, go to (1.2.3); otherwise go to (1.2.1) and continue the exhaustive search.

[0041] (1.2.3) Test the lower bound of the number of active S-boxes of the round function under the new P permutation using the MILP solver. If the lower bound of the number of active S-boxes of the round function under the new P permutation is greater than the lower bound of the number of active S-boxes of the ROCCA round function, then select this new P permutation as the P permutation of SAFE and go to (1.2.4) to end the search. Otherwise, go to (1.2.1) to continue exhaustively searching for the new P permutation.

[0042] (1.2.4) End the search;

[0043] (1.3) Since the semi-fixed slice AES is an extension of the fixed slice AES, its purpose is to reduce the amount of code implemented in restricted embedded devices; in order to reduce the implementation overhead of the SAFE algorithm in embedded devices, so as to facilitate its implementation in ARM Cortex series embedded microprocessors using semi-fixed slices, based on the implementation idea of ​​semi-fixed slice AES, the four AES components in the nonlinear component of the ROCCA algorithm in one round of iteration are replaced with four AES components in two rounds of iteration (AES). 2 The component is completed, and the iteration number of the round function is reduced in operations such as initialization based on the round function structure and difference analysis.

[0044] (1.4) Based on the new P-permutation and transformation nonlinear components, the SAFE round function structure is specifically described as follows:

[0045] The round function R moves from input to output using R(S,x0,x1)→S new In brief, S represents the state of the SAFE algorithm, which consists of 8 parts, S = (S 0, S1, ..., S7), each part is 128 bits in size; x0, x1 are 128-bit constant values; in AES... 2 (X,Y) represents the second round of AES iteration, i.e., AES 2 (X,Y) = AES(AES(X,Y),Y), where X and Y are 128-bit variable values. MC, SR, and SB are the column obfuscation, row shift, and S-box operations in the AES algorithm, respectively.

[0046] With S new This indicates the updated state, i.e. The SAFE round function updates the state S to obtain a new state, which mainly includes XOR linear operation or a second call to the AES round function (AES). 2 The two operations, where and It is obtained using XOR linear operations, and and It uses AES 2 Calculated by the function;

[0047] The SAFE round function state update calculation is shown in formula (1):

[0048]

[0049] Furthermore, in the embodiment, the overall structure design of the SAFE algorithm described in step (2) refers to... Figure 1 The specific steps are as follows:

[0050] (2.1) SAFE Algorithm Initialization:

[0051] To enhance SAFE's resistance to differential attacks, the initialization process first uses a round function structure and a MILP solver to test the lower bound of the active S-boxes in the initialization part. This is then compared to the ROCCA algorithm's test results. ROCCA's lower bound for active S-boxes in round 20 is greater than 186, while SAFE's lower bound for active S-boxes in round 9 is greater than 219. Therefore, it is determined that SAFE reduces the number of iteration rounds from 20 to 9 in the initialization part, making it more secure against differential attacks than the ROCCA algorithm. Furthermore, compared to ROCCA, SAFE has 8 fewer AES instructions and 44 fewer XOR instructions in the initialization part, making it more suitable for efficient implementation in embedded devices.

[0052] (2.2) Key XOR initialization:

[0053] Because the 128-bit tag of the ROCCA algorithm is too small and its internal state is easily recovered, the SAFE algorithm prevents attackers from performing further key recovery attacks without knowing the key by adding an XOR operation between certain state bits and the key after the initialization part is completed. That is, based on the new state obtained after the initialization part is updated in (2.1), S2 and S6 are selected, and then the state is further updated by formula (2). and

[0054]

[0055] Wherein, K0 and K1 are the high 128 bits and low 128 bits of the 256-bit key K, respectively;

[0056] (2.3) Processing related data:

[0057] Similar to the ROCCA algorithm, the SAFE algorithm divides the number of iterations into 256-bit units based on the length of the associated data, and obtains the new state through the round function R;

[0058] (2.4) Encrypting plaintext: In the encrypted plaintext section, the following operations are performed to improve SAFE's ability to resist state recovery attacks;

[0059] (2.4.1) To prevent attackers from easily obtaining the complete internal state using the decryption oracle, firstly, AES is used. 2 After processing the associated data, two state bits of the new state are manipulated to perform a nonlinear operation NL with the plaintext M to obtain the ciphertext C. The NL operation NL(t0, t1, res) uses simple logical operations such as OR (^), AND (&), and NOT (~) for nonlinear operation. t0, t1, and res are the state bit, plaintext block, and output ciphertext block, respectively, and res = ((t0^FK)|t1)&(~(t0&t1)^FK2), where FK and FK2 use the 128-bit system parameters from the SM4 algorithm. Finally, the ciphertext C is calculated as follows:

[0060]

[0061] M0, M1, M2 and M3 refer to four 128-bit plaintext blocks, and C0, C1, C2 and C3 refer to four 128-bit ciphertext blocks.

[0062] (2.4.2) Secondly, adopt and The two parameters are passed to the round function. To further update state S, the plaintext block is obfuscated, making it difficult for attackers to recover the internal state. Furthermore, because the round function uses AES... 2 The components are operated, and based on the attack method proposed by Musashino et al. in 2022, the attack data complexity is as high as 2. 128 This means that it is not easy for an attacker to restore the internal state;

[0063] (2.5) Key XOR generation of tags:

[0064] To prevent forgery attacks, before generating the 128-bit tag, a key XOR generation tag part is added to perform XOR operations between certain state bits and the key. This ensures that even if an attacker knows the internal state, they cannot perform a forgery attack without knowing the key. Specifically, based on the new state obtained after updating the encrypted plaintext part in (2.4), state bits S2 and S6 are selected, and then the state positions are calculated and updated using formula (2). and The remaining 6 status bits and Maintain the updated state of the encrypted plaintext portion in (2.4);

[0065] (2.6) Generate tags:

[0066] The same testing method as described in (2.1) determines that the number of iteration rounds is reduced from 20 rounds to 9 rounds to better resist differential attacks; and compared with ROCCA, SAFE has 8 fewer AES instruction operations and 44 fewer XOR instruction operations in the tag generation part, making it more suitable for efficient implementation in embedded devices.

[0067] Furthermore, in the embodiment, the SAFE algorithm described in step (3) is implemented for ARM Cortex series embedded microprocessors, referring to... Figure 3 The specific steps are as follows:

[0068] (3.1) Develop in the Keil uVision5 development tool and import the required header files: #include "sys.h", #include "delay.h", #include "usart.h", #include "beep.h" and #include "key.h";

[0069] (3.2) Set the initialization delay to 168 and the serial port initialization baud rate to 115200;

[0070] (3.3) Encrypt the SAFE algorithm once using the following operations;

[0071] (3.3.1) Input a 128-bit random number N and a 256-bit key KEY, where the 256-bit key KEY is divided into a high 128-bit key KEY0 and a low 128-bit key KEY1;

[0072] Set z0 and z1 as follows: z0 = 428a2f98d728ae227137449123, z1 = b5c0fbcfec4d3b2fe9b5dba58189dbbc; initialize the state S of the SAFE algorithm by letting S0 = KEY1, S1 = N, S2 = z1, S3 = z0. S5=0, S6=KEY0, S7=0;

[0073] (3.3.2) Based on S obtained from (3.3.1) and z0 and z1, iterate the round function R(S,z0,z1) for 9 rounds to obtain a new S. new The implementation of the four AES components of the round function R calls the semi-fixed slice AES operation twice.

[0074] (3.3.3) The new S obtained from (3.3.2) new Select from them and pass KEY0 and To obtain a new state bit and The other 6 status bits remain the same as the updated state in (3.3.2);

[0075] (3.3.4) Input 256 bits of associated data AD, where AD is divided into high 128 bits AD0 and low 128 bits AD1;

[0076] (3.3.5) If the input AD is not empty, then S is obtained according to (3.3.3). new And AD0, AD1, for the round function R(S) new The process iterates through AD0 and AD1 for one round to obtain a new state S. new If AD is empty, proceed to (3.3.6);

[0077] (3.3.6) Input plaintext P, the bit length size of P, and state S new Set the length of the ciphertext CT to be the same as the length of the plaintext, and initialize the ciphertext to be empty. Calculate the ciphertext CT using the following operations.

[0078] (3.3.6.1) Calculate the number of iterations d = size / 512. Divide the plaintext P into 512-bit units according to the number of iterations d, and in each iteration, the 512-bit plaintext is further divided into P. i,0 P i,1 P i,2 P i,3 That is, P = P 0,0 ||P 0,1 ||P 0,2 ||P 0,3 ||...P i,0 ||P i,1 ||P i,2 ||CP i,3 |...||P d-1,2 ||P d-1,3 (0≤i≤d-1); Divide the ciphertext C in the same way, then CT=CT 0,0 ||CT 0,1 ||CT 0,2 ||CT 0,3 ||...CT i,0 ||CT i,1 ||CT i,2 ||CT i,3 |...||CTd-1,2 ||CT d-1,3 (0≤i≤d-1);

[0079] (3.3.6.2) In each iteration, CT i,0 The calculation method is based on P i,0 and AES 2 (S1,S7) Perform NL operation, CT i,1 The calculation method is based on P i,1 and Perform NL operation, CT i,2 The calculation method is based on P i,2 and AES 2 (S4,S2) Perform NL operation, CT i,2 The calculation method is based on P i,3 and Perform NL operation;

[0080] (3.3.6.3) According to S new And the input P i,0 P i,1 P i,2 P i,3 Call the round function Obtain the new state S new ;

[0081] (3.3.6.4)d=d-1;

[0082] (3.3.6.5) If d is not 0, go to (3.3.6.2) and continue the iteration; otherwise, end the iteration calculation and go to (3.3.7).

[0083] (3.3.7) via CT 0,0 ||CT 0,1 ||CT 0,2 ||CT 0,3 ||...||CT size / 512,2 ||CT size / 512,3 The link yields the complete encrypted CT;

[0084] (3.3.8) The new S obtained from (3.3.6) new Select from them and pass KEY0 and To obtain a new state bit and The other 6 status bits remain the same as the updated state in (3.3.6);

[0085] (3.3.9) According to S newAnd size / 512, for the round function R(S) new The new state S is obtained after 9 iterations (1, size / 512). new ;

[0086] (3.3.10) According to the updated S new ,pass To calculate the 128-bit tag T′;

[0087] (3.3.11) Complete one encryption;

[0088] Reference Figure 4 In this environment, the decryption process is the same as the encryption steps (3.3.1) to (3.3.5) in the three parts of initialization, key XOR initialization, and processing of associated data; in the part of encrypting plaintext, the plaintext parameter P and the ciphertext parameter CT are swapped in steps (3.3.6) to (3.3.7); the part of generating the tag by key XOR is the same as the encryption step (3.3.8); in the final part of generating the tag, firstly according to S... new And size / 512, for the round function R(S) new The new state S is obtained after 9 iterations (1, size / 512). new Then, determine whether the cumulative XOR value of the updated 8 status bits is always equal to the label T′. If it is always equal to the label T′, then the plaintext P is obtained; otherwise, the decryption fails.

[0089] Reference Figure 5 In embedded devices using ARM Cortex series embedded microprocessors, the SAFE algorithm described in this invention reduces many operations based on semi-fixed slicing technology. Compared with the ROCCA algorithm, it reduces hardware implementation costs and improves the speed of data encryption and decryption. The throughput cpb index of the SAFE algorithm was tested. cpb is the number of clock cycles used for encryption, and the smaller the value, the better. The results show that the encryption and decryption speed of the SAFE algorithm is about 2.35 times that of the ROCCA algorithm.

Claims

1. A method for implementing an improved algorithm, SAFE, for the ROCCA algorithm, characterized in that, Includes the following steps: (1) Design of the round function R for the SAFE algorithm The SAFE algorithm's round function R structure is the same as that of the ROCCA algorithm, employing an eight-input, eight-output structure composed of P-permutations and nonlinear components. (2) Overall structure design of SAFE algorithm The SAFE algorithm structure consists of six parts: initialization, key XOR initialization, processing associated data, encrypting plaintext, key XOR generating tags, and generating tags. The SAFE algorithm improves upon the ROCCA algorithm structure by adding two sets of operations: key XOR initialization and key XOR tag generation. Furthermore, the SAFE algorithm modifies the initialization, plaintext encryption, and tag generation parts of the ROCCA algorithm. Specifically, in the initialization part, based on the designed round function structure and differential analysis evaluation, the number of ROCCA round function iterations is reduced from 20 rounds to 9 rounds. In the plaintext encryption part, the simple XOR operation between plaintext and state bits is replaced with a non-linear operation NL between plaintext and state bits, and two different 128-bit plaintext blocks are used as input parameters for the round function R to further update the state. In the tag generation part, also based on the designed round function structure and differential analysis evaluation, the number of round function iterations is reduced from 20 rounds in ROCCA to 9 rounds. (3) Implementation method of SAFE algorithm for ARM Cortex series embedded microprocessors After configuring the environment of the runtime tool Keil uVision5 and the serial port debugging tool XCOM, the input and output variables and implementation modules are determined according to the SAFE algorithm structure. SAFE is then integrated and implemented on the STM32F4 development board using semi-fixed slice AES technology. The design of the round function R for the SAFE algorithm described in step (1) is as follows: (1.1) The round function R of the SAFE algorithm has 8 128-bit states as input and output. First, the input states are shuffled by a P permutation. Then, the output state is obtained by operating on the P-permutated state through a nonlinear component. The nonlinear component consists of 4 XOR components and 4 AES two-round iterative AES. 2 Component composition; (1.2) To improve the security of the SAFE algorithm, a new P-permutation with better diffusion confusion than the ROCCA round function structure was selected. The new P-permutation was obtained through the following exhaustive search method: (1.2.1) Randomly shuffle eight 128-bit input states and search for a new P permutation; (1.2.2) Test the strict avalanche effect of the new P substitution. If the strict avalanche effect of the new P substitution is better, go to (1.2.3); otherwise, go to (1.2.1) and continue the exhaustive search. (1.2.3) Test the lower bound of the number of active S-boxes of the round function under the new P permutation using the MILP solver. If the lower bound of the number of active S-boxes of the round function under the new P permutation is greater than the lower bound of the number of active S-boxes of the ROCCA round function, then select this new P permutation as the P permutation of SAFE and go to (1.2.4) to end the search. Otherwise, go to (1.2.1) to continue exhaustively searching for the new P permutation. (1.2.4) End the search; (1.3) Based on the implementation idea of ​​semi-fixed slice AES, the four AES components in the nonlinear component of the ROCCA algorithm in one round of iteration are replaced with four AES components in two rounds of iteration. 2 The component is completed, and the number of iterations of the round function is reduced in the initialization operation based on the round function structure and difference analysis. (1.4) Based on the new P-permutation and transformation nonlinear components, the specific structure of the SAFE algorithm round function R is described as follows: The round function R moves from input to output using R(S,x0,x1)→S new In brief, let S represent the state of the SAFE algorithm. S consists of 8 parts, and S = (S... 0, S1, ..., S7), each part is 128 bits in size; x0, x1 are 128-bit constant values; in AES... 2 (X,Y) represents the second round of AES iteration, i.e., AES 2 (X,Y)=AES(AES(X,Y),Y), where X and Y are 128-bit variable values, and AES(X,Y)=MC ◦ SR ◦SB(X)⨁Y, where MC, SR and SB are the column obfuscation, row shift and S-box operations in the AES algorithm, respectively; With S new This represents the updated state, i.e., S. new =( , ,... The SAFE algorithm's round function R updates the state S to obtain a new state, mainly involving XOR linear operations or a second call to the AES round function (AES). 2 The two operations, where , and It is obtained using XOR linear operations, and , and It uses AES 2 Calculated by the function; The SAFE algorithm round function R state update calculation is shown in formula (1): (1) ； The overall structure design of the SAFE algorithm described in step (2) is as follows: (2.1) SAFE algorithm initialization: First, based on the round function structure, the lower bound of the active S-box in the initialization part is tested using the MILP solver. Then, the results are compared with the lower bound test of the active S-box in the initialization part of the ROCCA algorithm. The lower bound of the active S-box in the 20th round of ROCCA is greater than 186, while the lower bound of the active S-box in the 9th round of SAFE is greater than 219. It is determined that SAFE reduces the number of iteration round functions from 20 rounds to 9 rounds in the initialization part. At the same time, compared with ROCCA, SAFE has 8 fewer AES instruction operations and 44 fewer XOR instruction operations in the initialization part. (2.2) Key XOR initialization: Based on the new state obtained after the initialization part update in (2.1), S2 and S6 are selected, and then the state is further updated using formula (2). and : (2)； Wherein, K0 and K1 are the high 128 bits and low 128 bits of the 256-bit key K, respectively; (2.3) Processing related data: Similar to the ROCCA algorithm, the SAFE algorithm divides the number of iterations into 256-bit units based on the length of the associated data, and obtains the new state through the round function R; (2.4) In the encrypted plaintext part, the following operations are used to improve SAFE's ability to resist state recovery attacks; (2.4.1) First, AES is used. 2 After processing the associated data, two state bits of the new state are manipulated to perform a nonlinear operation NL with the plaintext M to obtain the ciphertext C. The NL operation NL(t0, t1, res) uses simple logical operations such as OR, AND, and NOT to perform nonlinear operations. t0, t1, and res are the state bit, plaintext block, and output ciphertext block, respectively, and res = ((t0^FK) | t1) & (~(t0 & t1) ^ FK2), where FK and FK2 use the 128-bit system parameters in the SM4 algorithm. Finally, the ciphertext C is calculated as follows: (3)； M0, M1, M2 and M3 refer to four 128-bit plaintext blocks, and C0, C1, C2 and C3 refer to four 128-bit ciphertext blocks. (2.4.2) Secondly, M0⊕M1 and M2⊕M3 are used as two parameters to be passed into the round function R(S,M0⊕M1). 1, M2⊕M3) is used to further update state S, where the plaintext block is obfuscated; (2.5) Key XOR generation of tags: Based on the new state obtained after updating the encrypted plaintext part according to (2.4), select state bits S2 and S6, and then calculate and update the state position using formula (2). and The remaining 6 status bits , , , , and Maintain the updated state of the encrypted plaintext portion in (2.4); (2.6) Generate tags; The SAFE algorithm described in step (3) is implemented for ARM Cortex series embedded microprocessors. The specific steps are as follows: (3.1) Develop in the Keil uVision5 development tool and import the required header files: #include "sys.h", #include "delay.h", #include "usart.h", #include "beep.h" and #include "key.h"; (3.2) Set the initialization delay to 168 and the serial port initialization baud rate to 115200; (3.3) Encrypt the SAFE algorithm once using the following operations; (3.3.1) Input a 128-bit random number N and a 256-bit key KEY, where the 256-bit key KEY is divided into a high 128-bit key KEY0 and a low 128-bit key KEY1; set z0 and z1 as z0=428a2f98d728ae227137449123 and z1=b5c0fbcfec4d3b2fe9b5dba58189dbbc respectively; initialize the state S of the SAFE algorithm, let S0= , S1=N, S2=z1, S3=z0, S4=N⊕KEY1, S5=0, S6=KEY0, S7= ; (3.3.2) Based on S obtained from (3.3.1) and z0 and z1, iterate the round function R(S,z0,z1) for 9 rounds to obtain a new S. new The implementation of the four AES components of the round function R calls the semi-fixed slice AES operation twice. (3.3.3) The new S obtained from (3.3.2) new Select from them and ,pass ⊕KEY0 and ⊕KEY1 to obtain the new state bit and The other 6 status bits remain the same as the updated state in (3.3.2); (3.3.4) Input 256 bits of associated data AD, where AD is divided into high 128 bits AD0 and low 128 bits AD1; (3.3.5) If the input AD is not empty, S is obtained according to (3.3.3). new And AD0, AD1, for the round function R( new The process iterates through AD0 and AD1 for one round to obtain a new state S. new If AD is empty, then go to (3.3.6); (3.3.6) Input plaintext P, the bit length size of P, and state S new Set the length of the ciphertext CT to be the same as the length of the plaintext, and initialize the ciphertext to be empty. Calculate the ciphertext CT using the following operations. (3.3.6.1) Calculate the number of iterations d = size / 512. Divide the plaintext P into 512-bit units according to the number of iterations d, and in each iteration, the 512-bit plaintext is further divided into P. i,0 P i,1 P i,2 P i,3 That is, P=P 0,0 ||P 0,1 ||P 0,2 ||P 0,3 ||...P i,0 ||P i,1 ||P i,2 ||CP i,3 |...||P d-1,2 ||P d-1,3 (0≤i≤d-1); Divide the ciphertext C in the same way, then CT=CT 0,0 ||CT 0,1 ||CT 0,2 ||CT 0,3 ||...CT i,0 ||CT i,1 ||CT i,2 ||CT i,3 |...||CT d-1,2 ||CT d-1,3 (0≤i≤d-1); (3.3.6.2) In each iteration, CT i,0 The calculation method is based on P i,0 and AES 2 (S1,S7) Perform NL operation, CT i,1 The calculation method is based on P i,1 and AES 2 (S2⊕S6,S4) Perform NL operation, CT i,2 The calculation method is based on P i,2 and AES 2 (S4,S2) Perform NL operation, CT i,2 The calculation method is based on P i,3 and AES 2 Perform the NL operation on (S6⊕S7,S1); (3.3.6.3) According to S new And the input P i,0 P i,1 P i,2 P i,3 Call the round function R(S) new ,P i,0 ⊕P i,1, P i,2 ⊕P i,3 Obtain the new state S new ; (3.3.6.4) d = d - 1; (3.3.6.5) If d is not 0, go to (3.3.6.2) and continue the iteration; otherwise, end the iteration calculation and go to (3.3.7). (3.3.7) via CT 0,0 ||CT 0,1 ||CT 0,2 ||CT 0,3 ||...||CT size / 512,2 ||CT size / 512,3 The link yields the complete encrypted text. ; (3.3.8) The new S obtained from (3.3.6) new Select from them and ,pass ⊕KEY0 and ⊕KEY1 to obtain the new state bit and The other 6 status bits remain the same as the updated state in (3.3.6); (3.3.9) According to S new And size / 512, for the round function R(S) new The new state S is obtained after 9 iterations (1, size / 512). new ; (3.3.10) According to the updated S new ,pass To calculate the 128-bit tag T′; (3.3.11) Complete one encryption.

Images