Implementation method and system of low latency block cipher

Abstract

This invention discloses a method and system for implementing the Low Latency Cryptographic Algorithm (LLBC), comprising: obtaining plaintext as data to be encrypted or ciphertext as data to be decrypted; if it is an encryption operation, performing R rounds of encryption operations on the data to be encrypted using a subkey to obtain ciphertext, that is, dividing the data to be encrypted into two equal parts L. i ,R i Each round of encryption operation is as follows: for data L i Execute cyclic displacement, S 1 Box replacement and S 2 Box replacement, then S 1 Box replacement and S 2 The result of the box permutation is used as the two inputs to the function M to obtain the output M, and finally L is updated. i ,R i Get L i+1 R i+1 The process involves iterating through two sets of S-boxes with a gate depth of 3 and an equivalent gate count of less than 20 within a 4-bit S-box; the decryption operation is performed in reverse order of the encryption operation.

Description

An implementation method and system for the low-latency cryptographic algorithm LLBC Technical Field

[0001] This invention belongs to the field of block cipher technology in information security, specifically relating to an implementation method and system for the low-latency cryptographic algorithm LLBC. Background Technology

[0002] Block ciphers, as a mainstream information encryption technology, play an important role in the field of network and information security. To meet the security needs of resource-constrained environments, especially the need for real-time, rapid response across multiple scenarios (terminals) (such as real-time authentication, memory encryption, vehicle networking devices, and new intelligent power grid inspection robots), lightweight, low-latency cryptographic algorithms have emerged.

[0003] Over the past decade, the academic community has developed many well-known low-latency cryptographic algorithms, such as PRINCE, PRINCEv2, MANTIS, QARMA, MIDORI, SPEEDY, SCARF, LLLWBC, and SAND. At CHES 2012, researchers compared the latency properties of several lightweight block ciphers and concluded that, in terms of latency requirements, using cryptographically superior 4-bit or 3-bit S-boxes is generally more advantageous than larger S-boxes. At ASIACRYPT 2012, a low-latency block cipher, PRINCE, was proposed. This algorithm has a 64-bit data block length and a 128-bit key length; the algorithm requires 12 rounds of iteration. PRINCE achieves encryption and decryption similarity through a function α with reflective properties. Subsequently, based on PRINCE, PRINCEv2 was proposed. This cipher ensures greater security by modifying the PRINCE key arrangement and intermediate round functions. The PRINCEv2 design document also provides comparisons with the tunable block ciphers MANTIS and QARMA, and the low-energy block cipher MIDORI. The results show that PRINCE and PRINCEv2 still maintain their low-latency advantage. In fact, the tunable block ciphers MANTIS and QARMA add extra handle inputs, thus increasing their circuit depth; while the MIDORI algorithm was not designed with low latency as a primary goal, although its S-box is carefully designed to provide minimal latency. Recently, Zhang et al. proposed a lightweight low-latency block cipher, LLLWBC, at Inscrypt 2022. LLLWBC is designed based on the generalized Feistel structure, with a 64-bit data block length and a 128-bit key length, and a total of 21 rounds. LLLWBC uses the α function from the PRINCE cipher and cleverly selects the round function and key arrangement to ensure the reflective properties of α, thus enabling efficient hardware implementation of LLLWBC. SAND, proposed by Chen et al. at Deigns, Codes and Cryptography 2022, is a lightweight block cipher based on the Feistel architecture. Its use of bit-slicing parallelism in the round function makes it one of the most efficient block ciphers to implement on both hardware and software platforms. However, because SAND's nonlinear layer uses a relatively simple AND-RX operation, it requires multiple iterations to ensure the security of the entire cipher. For example, SAND-64 and SAND-128 require 48 and 54 iterations respectively, which is very detrimental to the algorithm's latency.

[0004] Recent research has revealed cryptographic algorithms that outperform PRINCE in terms of latency. For example, the SPEEDY cryptographic algorithm was proposed at TCHES2021. This algorithm constructs an ultra-low-latency 6-bit S-box using logic gates OR, AND, and INV / NOT (OAI), resulting in an overall latency lower than PRINCE. Another example is the SCARF cryptographic algorithm, which uses the MISTY structure combined with SPEEDY's OAI gates to design a low-latency 6-bit S-box, achieving an overall latency that is only half that of PRINCE.

[0005] However, a review of existing research reveals that these low-latency cryptography algorithms are almost all designed based on the SPN structure (or generalized Feistel structure), such as PRINCE, MANTIS, and LLLWBC. Therefore, how to design low-latency cryptographic algorithms on the standard Feistel structure is a technical problem that this invention urgently needs to solve. Summary of the Invention

[0006] To address the aforementioned problems in the prior art, this invention provides a method and system for implementing the Low Latency Cryptographic Algorithm (LLBC). The method employs the traditional Feistel structure to implement the LLBC algorithm, combining round operations with the traditional Feistel structure to achieve competitive latency properties. Furthermore, decryption requires no hardware resources. Specifically, by searching for two sets of S-boxes with a gate depth of 3 and an equivalent gate count within 20 in a 4-bit S-box, S1-box and S2-box permutations are performed, which is superior to the 4-bit S-box of the best existing Midori cipher. Round operations are performed based on S1-box and S2-box, implementing a parallel execution strategy, resulting in an even more ultra-low latency cryptographic algorithm provided by this invention.

[0007] On one hand, the present invention provides a method for implementing the low-latency cryptographic algorithm LLBC, comprising the following steps:

[0008] Step 1: Obtain 128 bits of plaintext as the data to be encrypted or ciphertext as the data to be decrypted;

[0009] Step 2: If it is an encryption operation, use the subkey to perform R rounds of encryption operation on the data to be encrypted to obtain ciphertext; if it is a decryption operation, use the subkey to perform R rounds of decryption operation on the data to be decrypted to obtain plaintext.

[0010] The data to be encrypted is first divided into two parts in descending order of importance. Each round of encryption operation is as follows: [The following is a list of steps related to data encryption.] The results of performing cyclic shift plus S1 box permutation and cyclic shift plus S2 box permutation in parallel are used as the two inputs to the M function to obtain the output M. Then, the output M, the subkey, and the data are used... Perform XOR operation to update and the use of data The subkey and round constant are updated by XOR operation. If the current round i is not the Rth round, then proceed to the next round of encryption operation;

[0011] S1 box and S2 box are two sets of S boxes with a gate depth of 3 and an equivalent gate number of less than 20, which are found by searching 4-bit S boxes.

[0012] The decryption operation is the reverse of the encryption operation, and the order of the subkeys used in the R rounds of decryption is the reverse of the order of the suboperations in the R rounds of encryption.

[0013] The technical solution of this invention constructs two S-boxes by traversing and searching within a 4-bit S-box with a gate depth of 3 and an equivalent gate count of less than 20. The gate depth is used to measure latency; therefore, the latency performance of the two constructed S-boxes is superior to that of existing MIDORI S-boxes. Secondly, as shown in Figure 5, this invention uses two S-boxes for parallel permutation, i.e., two paths are executed in parallel, thus achieving ultra-low latency. Furthermore, compared to existing technologies that typically use only one S-box for nonlinear components, the cryptographic algorithm of this invention uses two parallel 4-bit S-boxes. During security analysis, these two parallel 4-bit S-boxes are bridged together and treated as a single super S-box for analysis, increasing the security of the cryptographic algorithm.

[0014] Alternatively, the replacement tables corresponding to the S1 box replacement and the S2 box replacement are as follows:

[0015]

[0016] In the formula, a 4*4 S-box (hexadecimal) is used. That is, when x is any number from 0 to F, it is replaced with the corresponding S(x) value below according to the table above. S1(x) is the output of the S1 box permutation, and S2(x) is the output of the S2 box permutation.

[0017] Data Data after performing two cyclic displacements , Perform the S1 box replacement and S2 box replacement according to the aforementioned replacement table, specifically as follows:

[0018] Data , Each is divided into sixteen 4-bit groups, which are then merged into a half-byte.

[0019] The permutation result is obtained by querying the permutation table using the half-byte.

[0020] Alternatively, the S1 box replacement and S2 box replacement correspond to an S box door depth of 3, with an equivalent number of doors of 18.5.

[0021] Further optional, data as well as The update formula is as follows:

[0022] M

[0023]

[0024] In the formula, , All are subkeys of the current round i. 64 bits of data; This is the round constant for the current round i.

[0025] Further optionally, the method further includes: searching for two sets of S-boxes with a gate depth of 3 and an equivalent gate count of less than 20 among the 4-bit S-boxes, as follows:

[0026] S1) Find all 4-bit S-boxes that satisfy bijection, and use the Quine-McCluskey algorithm to calculate the product of each output state bit and SOP, negative product and NOT-SOP to obtain their respective depths. From these, select 4-bit S-boxes with a gate depth of 3 and an equivalent gate number of less than 20.

[0027] SOP and NOT-SOP are technical terms in digital circuit logic; they refer to the addition of gate depth filtering conditions to select the required 4-bit S-box.

[0028] S2) Verify whether the S-boxes selected in S1 satisfy the additional cryptographic constraints. If none of them are satisfied, add logical operations and return to S1; if they are satisfied, execute S3. The additional cryptographic constraints refer to security constraints, such as differential uniformity and linear approximation indicators, but are not limited to the examples given.

[0029] S3) The S-boxes selected in S2 are subjected to encryption attribute detection, thereby selecting the S-boxes required by the present invention.

[0030] If multiple S-boxes satisfy the encryption attribute detection, the S-box with the lowest depth and hardware area is given priority. If only one S-box from S2 and S3 meets the requirements, the other S-boxes are selected by prioritizing depth or adding logical operations. The two S-boxes are different; that is, two identical S-boxes are not used.

[0031] Further, optionally, the execution process of the M function is as follows:

[0032] a) Use the results of S1 box permutation and S2 box permutation as the two inputs to the M function. , Execute again Then get Circular left shift by b1 bits, i.e. << <b1;

[0033] b) First, and Perform the XOR operation, i.e. Then Perform a circular left shift of b2 bits to obtain << <b2;

[0034] c) First, and Perform the XOR operation, i.e. Then Circular left shift by b1 bits to obtain << <b1;

[0035] d) will and Perform the XOR operation, i.e. Then Perform a circular left shift by b2 bits to obtain << <b2;

[0036] e) will and Perform the XOR operation, i.e. ;

[0037] f) Finally and The output M is obtained by performing an XOR operation, i.e., M = .

[0038] Alternatively, the arrangement and update process for the subkeys in the R-round encryption operation is as follows:

[0039] First, the initial key K is divided into two groups of data. ,Right now Then update based on the update function. ;

[0040] The update function is: , Let i be the round constant for the current round. express The operation is performed twice in the G4 function, which consists of a circular shift and an XOR operation;

[0041] Then, the subkey from The data was loaded from the middle, as follows:

[0042] If the initial key K is 128 bits long

[0043] If the length of the initial key K is 256 bits .

[0044] To minimize hardware cost and latency, the key arrangement of LLBC in this invention is implemented solely through shift and XOR operations. The hardware overhead, such as area and latency, is almost zero due to the use of shift operations. Although the absence of S-boxes and matrices in the key arrangement cannot guarantee complete diffusion, introducing two different key arrangements into each branch of the round function increases the difficulty of key recovery attacks.

[0045] Further optional, The execution process of the G4 function is as follows:

[0046] First, Divide into four equal parts: , , and ;

[0047] Then, Circular left shift Bit after The result of the XOR operation is assigned to ,Right now ;and will Circular left shift -bit after The result of the XOR operation is assigned to ,Right now ; and assignment: , ;

[0048] in, , , and for The result of running the G4 function once.

[0049] The update process for a 256-bit LLBC key version is largely similar to that for a 128-bit key, with only the following differences:

[0050] a) The initial key K is divided into two groups of 128 bits of data. ,Right now Then update based on the update function. ;

[0051] b) Subkey from The data was loaded from the middle, as follows:

[0052]

[0053] Only the minor differences in a) and b) are the same as those in the 128-bit key version.

[0054] Secondly, the present invention also provides a system based on the implementation method of the low-latency cryptographic algorithm LLBC, comprising:

[0055] The acquisition module is used to acquire 128 bits of plaintext as data to be encrypted or ciphertext as data to be decrypted.

[0056] The encryption / decryption module is used to perform R rounds of encryption operations on the data to be encrypted using a subkey to obtain ciphertext if the operation is encryption; and to perform R rounds of decryption operations on the data to be decrypted using a round key to obtain plaintext if the operation is decryption.

[0057] The data to be encrypted is first divided into two parts in descending order of importance. Each round of encryption operation is for the data Perform cyclic shift plus S1 box permutation and cyclic shift plus S2 box permutation in parallel; then use the results of S1 box permutation and S2 box permutation as the two inputs of function M to obtain output M; finally, use output M, subkey and data... Perform XOR operation to update and the use of data The subkey and round constant are updated by XOR operation. If the current round i is not the Rth round, then proceed to the next round of encryption operation;

[0058] S1 box and S2 box are two sets of S boxes with a gate depth of 3 and an equivalent gate number of less than 20, which are found by searching 4-bit S boxes.

[0059] The decryption operation is performed in reverse order of the encryption operation, and the order of the subkeys used in the R rounds of decryption is the reverse of the order of the subkeys used in the R rounds of encryption.

[0060] Thirdly, the present invention also provides an electronic terminal, comprising at least: one or more processors; and a memory storing one or more computer programs; wherein the processor invokes the computer programs to implement:

[0061] The steps of the implementation method of the Low Latency Cryptographic Algorithm LLBC.

[0062] Fourthly, the present invention also provides a computer-readable storage medium storing a computer program, which is invoked by a processor to implement the steps of the method for implementing the low-latency cryptographic algorithm LLBC.

[0063] Beneficial effects

[0064] The low-latency cryptographic algorithm LLBC provided by this invention employs the traditional Feistel structure for low-latency encryption and decryption. To compensate for the latency gap between the Feistel structure and the Substitution-Permutation-Network (SPN), two sets of S-boxes with a gate depth of 3 and an equivalent gate count within 20 are searched within a 4-bit S-box. These S-boxes are then used to perform S1-box permutations and S2-box permutations in each round of operations, achieving a parallel execution strategy. This results in superior performance in both latency and maximum throughput. Regarding security, the cryptographic algorithm uses two parallel 4-bit S-boxes. During security analysis, these two parallel 4-bit S-boxes are bridged together and treated as a super S-box. This means that these two sets of S-boxes will lead to a super S-box with good differential and linear properties, increasing the security of the cryptographic algorithm. Therefore, this design concept provides a new approach for future low-latency cryptography designs based on the Feistel structure. Security analysis shows that LLBC can achieve sufficient security margins against known attacks, such as differential cryptanalysis, linear cryptanalysis, impossible differential cryptanalysis, and zero-correlation cryptanalysis. Attached Figure Description

[0065] Figure 1 is a round function structure diagram of a low-latency cryptographic algorithm LLBC provided by the present invention;

[0066] Figure 2 is a diagram of the M-function structure of a low-latency cryptographic algorithm LLBC provided by the present invention;

[0067] Figure 3 is a key arrangement structure diagram of a low-latency cryptographic algorithm LLBC provided by the present invention;

[0068] Figure 4 is a diagram of the G4 function structure of a low-latency cryptographic algorithm LLBC provided by the present invention;

[0069] Figure 5 is a two-round critical path structure diagram of the low-latency cryptographic algorithm LLBC provided by the present invention. Detailed Implementation

[0070] The present invention will be further described below with reference to embodiments.

[0071] When applied to encryption operations, the present invention provides an implementation method for the low-latency cryptographic algorithm LLBC, comprising the following steps:

[0072] 1) Obtain 128 bits of plaintext as the data to be encrypted, P. Specifically, the data to be encrypted... Divide the bits into two groups of 64, from the most significant bit (left) to the least significant bit (right), and denot them as follows: The length of the data P to be encrypted is 128 bits, and the length of the initial key is 128 / 256 bits.

[0073] 2) Data Perform a cyclic shift, specifically:

[0074] Data The new data is obtained by left-shifting b1 and b2 bits respectively. , Assuming =1011, b1=2, then The result after left shifting by b1 bits is =1101;

[0075] The values ​​of b1 and b2 in this embodiment are shown in the table below:

[0076] Table 1 Cyclic shift parameters

[0077]

[0078] 3) The data obtained in step 2) , The S1 box and S2 box permutations are performed respectively; specifically, in this invention, the S-box replacement is a non-linear replacement based on half-bytes, which replaces the 64-bit state and Each group is divided into sixteen 4-bit groups (x) in sequence. i , x i+1 , x i+2 , x i+3 Then, the four 1-bit bytes are combined into a half-byte s. i =(x i || x i+1 || x i+2 || x i+3 Then use that half-byte to query. and The corresponding S-box uses a 4x4 S-box (hexadecimal), meaning 4 bits in and 4 bits out. Based on the permutation tables corresponding to the S1 and S2 box permutations, the new values ​​are used to replace the original values, resulting in a 64-bit output state Y, where Y = SubCell( , For example, if the input to box S is 0 in hexadecimal, the corresponding output to box S1 will be 4 in hexadecimal.

[0079] 4) The results of completing the S1 box permutation and the S2 box permutation are used as the two inputs to the M function, where, =S1(x), =S2(x). The M function performs the following steps (where the parameter selections for b1 and b2 are the same as in Table 1).

[0080] a) Execution , will get Circular left shift by b1 bits, i.e. << <b1;

[0081] b) In step a), and Perform the XOR operation, i.e. Then Perform a circular left shift of b2 bits to obtain << <b2;

[0082] c) In step a), With step b) Perform the XOR operation, i.e. Then Circular left shift by b1 bits to obtain << <b1;

[0083] d) In step b), With step c) Perform the XOR operation, that is Then Perform a circular left shift of b2 bits to obtain << <b2;

[0084] e) In step c), With step d) Perform the XOR operation, i.e. ;

[0085] f) Finally, in step d), and Performing an XOR operation yields the 64-bit output M= after the M function operation is completed. .

[0086] 5) Combine the 64-bit output M obtained in step 4) with the subkey corresponding to the current round. The lower 64 bits and the right branch 64 bits entering the current round After performing the XOR operation, the result is assigned to ,Right now M At this point, the subkey of the current round i is used. The lower 64 bits As In other feasible embodiments, selecting 64 bits from the subkey can also meet the technical requirements of this invention.

[0087] 6) In step 1), and Subkey corresponding to each round The high 64 bits, round constant The result of the XOR operation is assigned to ,Right now In this embodiment, the subkey of the current round i is used. High 64 bits As .as well as The parameters are generated based on the initial round constant RC0 and the current number of rounds executed by cyclic shift. = <<< The values ​​of the initial wheel constant RC0 are shown in Table 2 below:

[0088] Table 2 Initial Constants Table

[0089]

[0090] The above operation is round constant addition (RC), which breaks the symmetry of the key arrangement algorithm by XORing the constant. The initial value constant RC0 is a constant number, and different algorithm versions use different initial values ​​of constants.

[0091] Having completed steps 5) and 6), one round of the round function calculation has been finished. To continue executing the remaining rounds, simply... and Replace step 1) and Then, by iterating through the remaining steps 2) to 6), the final 128-bit ciphertext C can be obtained.

[0092] The subkeys involved in each round of encryption are calculated according to the following arrangement and update process (taking 128 bits as an example):

[0093] First, the initial key K, which is 128 bits long, is divided into two groups of 64 bits each. ,Right now Then update based on the update function. ;

[0094] In this embodiment, the initialization state of the initial key K can be represented by a linear feedback shift register (LFSR), and the update function of the LFSR is:

[0095] , Let i be the round constant for the current round. express The operation is performed twice in the G4 function, which consists of a circular shift and an XOR operation.

[0096] Then, the subkey from The data was loaded from the middle, as follows:

[0097] .

[0098] in, The 64 bits in the array can be represented as a 4*16 array, as shown below:

[0099]

[0100] The G4 function is mainly composed of circular shift and XOR operations. The execution process of the G4 function is as follows:

[0101] First, Divide into four equal parts: , , and ;

[0102] Then, Circular left shift Bit after The result of the XOR operation is assigned to ,Right now ;and will Circular left shift -bit after The result of the XOR operation is assigned to ,Right now ; and assignment: , ;

[0103] in, , , and for The result of running the G4 function once. This invention. The G4 function runs twice; the second time, it executes the code from the first time. , , and Substituting into the above process, as , , , .

[0104] In this embodiment, the G4 function described above can be represented by the following formula:

[0105] ;

[0106] in, and They were set to 3 and 1 respectively.

[0107] The update process for a 256-bit LLBC key version is largely similar to that for a 128-bit key, with only the following differences:

[0108] The initial key K is divided into two groups of 128 bits of data. ,Right now Then update based on the update function. ;

[0109] Subkey from The data was loaded from the middle, as follows:

[0110]

[0111] It should be noted that in other feasible embodiments, and , and The settings, while satisfying computational feasibility, can be adaptively adjusted according to computational needs.

[0112] Regarding the S1 and S2 boxes selected in this embodiment, a strategy of parallel execution is achieved by traversing and searching 4-bit S-boxes to find two sets of S-boxes with a gate depth of 3 and an area within the equivalent number of gates of 20. In this embodiment, the final search yields S1 box permutations and S2 box permutations corresponding to S-box gate depths of 3 and an equivalent number of gates of 18.5. The corresponding permutation table is as follows:

[0113] Table 3

[0114]

[0115] The S1 box and S2 box described in the embodiments of the present invention are the best examples of the present invention. In other feasible embodiments, the S box can be selected according to the following idea, as follows:

[0116] S1) Find all 4-bit S-boxes that satisfy bijection, and use the Quine-McCluskey algorithm to calculate the product of each output state bit and SOP, negative product and NOT-SOP to obtain their respective depths. From these, select 4-bit S-boxes with a gate depth of 3 and an equivalent gate number of less than 20.

[0117] S2) Verify whether the S-boxes selected in S1 satisfy the additional cryptographic constraints. If none of them are satisfied, add logical operations and return to S1; if they are satisfied, execute S3. The additional cryptographic constraints refer to security constraints, such as differential uniformity and linear approximation indicators, but are not limited to the examples given.

[0118] S3) The S-boxes selected in S2 are subjected to encryption attribute detection, thereby selecting the S-boxes required by the present invention.

[0119] Choosing the appropriate S-box for a given application remains a crucial task. Cryptographic design must balance ideal cryptographic properties with performance and cost considerations, such as critical path length and equivalent gate count. The critical path of a circuit refers to the longest sequential operation from input to output, as it determines the circuit's latency.

[0120] For example, this invention initially considers only S-boxes whose output state bits can be represented as the sum of at most three products, each with a weight of at most 3, or as the negative sum of at most three products. If no matching S-box is found, this invention gradually increases the complexity of the allowed expressions. By allowing a wide range of NAND and NOR gates, this invention achieves a more compact upper bound on depth.

[0121] Definition 1. (Depth): Depth is defined as the sum of the sequential path delays of basic logical operations, namely AND, OR, NAND, NOR, XOR, XNOR, and NOT. This invention assigns depth weights of 2, 1.5, 1, and 0.5 equivalent gates to XOR, AND / OR, NAND / NOR, and NOT searches, respectively. (In a size of 2...) 44.3 A search was performed on the set of all 4-bit S-boxes, sorted by depth, and their compliance with the inventive requirements was checked. This embodiment found the 4-bit S-boxes listed in the table above, whose depth and equivalent gate size were the lowest and smallest in our search.

[0122] Because LLBC is designed using the standard Feistel architecture, its decryption process is the same as its encryption process. The difference is that the order of the subkeys used in the encryption process is reversed. Therefore, based on the above encryption process, the subkey used in the first round of decryption in this invention is the same subkey used in the last round of encryption, and the remaining steps are executed in reverse order of steps 1) to 7).

[0123] To verify the effectiveness of the low-latency cryptographic algorithm LLBC provided by the present invention, the S-box provided in the present invention was tested. The comparison results of the two sets of S-boxes provided in the LLBC of the present invention are shown in Table 4:

[0124] Table 4 Comparison of S-box properties of LLBC with other algorithms

[0125]

[0126] Table 5 compares the hardware resources of the S-box of LLBC with those of other algorithms.

[0127]

[0128] The method provided in the embodiments of the present invention was tested, and the LLBC-128-128 algorithm data provided by the present invention is shown below:

[0129] Plaintext: 00000000-00000000-00000000-00000000

[0130] Key: 00000000-00000000-00000000-00000000

[0131] Ciphertext: E63F72C7- 5ACCBBAF- FE5BCB34- B742D0B7

[0132] Plaintext: FFFFFFFF-FFFFFFFF-FFFFFFFF-FFFFFFFF

[0133] Key: FFFFFFFF-FFFFFFFF-FFFFFFFF-FFFFFFFF

[0134] Ciphertext: 30C6FA23- A6248AB7- 8FD54250- 35957BB2

[0135] Plaintext: 01234567-89ABCDEF-FEDCBA89-76543210

[0136] Key: 01234567-89ABCDEF-FEDCBA89-76543210

[0137] Ciphertext: 6C842BCE- 41C7E351- 4068A3FB- 8BB42936

[0138] Plaintext: 01234567-89ABCDEF-FEDCBA89-76543210

[0139] Key: FFFFFFFF-FFFFFFFF-FFFFFFFF-FFFFFFFF

[0140] Ciphertext: 0A9B164C- FF42415C- 43701C8B- DB53104B

[0141] The LLBC algorithm provided in this invention is implemented in Synopsys Design Compiler version A-2007.12-SP1 and uses the NanGate open cell library and the UMCL18G212T3 standard cell library, which are based on the NanGate 45 nm logic process and the UMC L180 0.18μm 1P6M logic process. In the compiler, we will maintain its hierarchical structure and use a 100kHz clock frequency, thus enabling fair comparison with other publicly published block ciphers.

[0142] The LLBC algorithm provided by this invention is listed in Table 6, showing a comparison of the results of its full expansion implementation under the 0.18 process library.

[0143] Table 6 Comparison of LLBC-128-128 and LLBC-128-256 based on the 0.18 process library

[0144]

[0145] Example 2:

[0146] This embodiment provides a system based on the implementation method of the Low Latency Cryptography (LLBC) algorithm, including: an acquisition module and an encryption / decryption module.

[0147] The acquisition module is used to acquire 128 bits of plaintext as data to be encrypted or ciphertext as data to be decrypted; the encryption / decryption operation module is used to perform R rounds of encryption operation on the data to be encrypted using a subkey to obtain ciphertext if it is an encryption operation, and to perform R rounds of decryption operation on the data to be decrypted using a round key to obtain plaintext if it is a decryption operation.

[0148] Each round of encryption operation is performed on the data. Perform cyclic shift plus S1 box permutation and cyclic shift plus S2 box permutation in parallel; then use the results of S1 box permutation and S2 box permutation as the two inputs of function M to obtain output M; finally, use output M, subkey and data... Perform XOR operation to update and the use of data The subkey and round constant are updated by XOR operation. If the current round i is not the Rth round, then proceed to the next round of encryption operation; the decryption operation is performed in reverse order of the encryption operation, and the order of the subkeys used in the Rth round of decryption operation is the reverse of the order of the subkeys used in the Rth round of encryption operation.

[0149] In this embodiment, the encryption / decryption module includes: a cyclic shift module, an S-box permutation module, an M-function execution module, an encryption / decryption data update module, and a subkey update module.

[0150] The cyclic shift module is used to perform cyclic shifts in each round of operation; the S-box permutation module is used to perform S1-box permutations and S2-box permutations; the M-function execution module is used to execute the M-function; the encryption / decryption data update module is used to update the encryption / decryption data in each round of operation; and the subkey update module is used to update the subkey in each round of operation.

[0151] It should be understood that the implementation process of each module can be referred to the content described in the aforementioned method. The above division of functional modules is only a logical functional division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. At the same time, the above-mentioned integrated units can be implemented in the form of hardware or software functional units.

[0152] Example 3:

[0153] This embodiment provides an electronic terminal, comprising at least: one or more processors; and a memory storing one or more computer programs; wherein the processor calls the computer programs to implement the steps of the implementation method of the Low Latency Cryptographic Algorithm (LLBC). When applied to encryption, the specific execution is as follows:

[0154] 1) Obtain 128 bits of plaintext as the data to be encrypted, P.

[0155] 2) Data Perform a cyclic shift, specifically: for the data The new data is obtained by cyclically shifting b1 and b2 bits to the left respectively. , .

[0156] 3) The data obtained in step 2) , Perform S1 box replacement and S2 box replacement operations on them separately.

[0157] Among them, processes 2 and 3 are performed on data. The parallel execution is shown in Figure 5.

[0158] 4) The results of the S1 box permutation and S2 box permutation are used as the two inputs of the M function to obtain the output M.

[0159] 5) Combine the 64-bit output M obtained in step 4) with... Subkey corresponding to each round The lower 64 bits and the right branch 64 bits entering the current round After performing the XOR operation, the result is assigned to .

[0160] 6) In step 1), and Subkey corresponding to each round The high 64 bits, round constant The result of the XOR operation is assigned to .

[0161] Having completed steps 5) and 6), one round of the round function calculation has been finished. To continue executing the remaining rounds, simply... and Replace step 1) and Then, by iterating through the remaining steps 2) to 6), the final 128-bit ciphertext C can be obtained.

[0162] The processor invokes the computer program to determine the subkey for each round according to the following orchestration and update process:

[0163] First, the initial key K is divided into two groups of data. ,Right now Then update based on the update function. ;

[0164] The update function is: , Let i be the round constant for the current round. express The operation is performed twice in the G4 function, which consists of a circular shift and an XOR operation.

[0165] Then, the subkey from The data was loaded from the middle, as follows:

[0166] If the initial key K is 128 bits long

[0167] If the length of the initial key K is 256 bits When applied to decryption, the subkey used in the first round of decryption is the same subkey used in the last round of encryption, and the remaining steps are performed in reverse order of steps 1) to 7).

[0168] Please refer to the explanation of the method above for the specific implementation process of each step.

[0169] The memory may include high-speed RAM, and may also include a non-volatile defibrillator, such as at least one disk storage device.

[0170] If the memory and processor are implemented independently, they can be interconnected via a bus to communicate with each other. This bus can be an industry-standard architecture bus, an external device interconnect bus, or an extended industry-standard architecture bus, etc. The bus can be categorized as an address bus, data bus, control bus, etc.

[0171] Optionally, in a specific implementation, if the memory and processor are integrated on a single chip, the memory and processor can communicate with each other through an internal interface.

[0172] It should be understood that, in the embodiments of the present invention, the processor may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor. The memory may include read-only memory and random access memory, and provides instructions and data to the processor. A portion of the memory may also include non-volatile random access memory. For example, the memory may also store device type information. Embodiment 4:

[0173] This embodiment provides a computer-readable storage medium storing a computer program that is invoked by a processor to implement the steps of the method for implementing the Low Latency Cryptographic Algorithm (LLBC).

[0174] When applied to encryption, the specific execution is as follows:

[0175] 1) Obtain 128 bits of plaintext as the data to be encrypted, P.

[0176] 2) Data Perform a cyclic shift, specifically: for the data The new data is obtained by circularly shifting b1 and b2 bits to the left respectively. , .

[0177] 3) The data obtained in step 2) , Perform S1 box replacement and S2 box replacement operations on them separately.

[0178] Among them, the execution process of steps 2-3 is aimed at the data. The execution is performed in parallel, as shown in Figure 5.

[0179] 4) The results of the S1 box permutation and S2 box permutation are used as the two inputs of the M function to obtain the output M.

[0180] 5) Combine the 64-bit output M obtained in step 4) with... Subkey corresponding to each round The lower 64 bits and the right branch 64 bits entering the current round After performing the XOR operation, the result is assigned to .

[0181] 6) In step 1), and Subkey corresponding to each round The high 64 bits, round constant The result of the XOR operation is assigned to Having completed steps 5) and 6), one round of the round function calculation has been finished. To continue executing the remaining rounds, simply... and Replace step 1) and Then, by iterating through the remaining steps 2) to 6), the final 128-bit ciphertext C can be obtained.

[0182] The processor invokes the computer program to determine the subkey for each round according to the following orchestration and update process:

[0183] First, the initial key K is divided into two groups of data. ,Right now Then update based on the update function. ;

[0184] The update function is: , Let i be the round constant for the current round. express The operation is performed twice in the G4 function, which consists of a circular shift and an XOR operation.

[0185] Then, the subkey from The data was loaded from the middle, as follows:

[0186] If the initial key K is 128 bits long

[0187] If the length of the initial key K is 256 bits .

[0188] When applied to decryption, the subkey used in the first round of decryption is the same subkey used in the last round of encryption, and the remaining steps are executed in reverse order of steps 1) to 7).

[0189] Please refer to the explanation of the method above for the specific implementation process of each step.

[0190] The readable storage medium is a computer-readable storage medium, which can be an internal storage unit of the controller described in any of the foregoing embodiments, such as the controller's hard drive or memory. The readable storage medium can also be an external storage device of the controller, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the controller. Further, the readable storage medium can include both the controller's internal storage unit and external storage devices. The readable storage medium is used to store the computer program and other programs and data required by the controller. The readable storage medium can also be used to temporarily store data that has been output or will be output.

[0191] Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned readable storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0192] It should be emphasized that the examples described in this invention are illustrative rather than limiting. Therefore, this invention is not limited to the examples described in the specific embodiments. Any other embodiments derived by those skilled in the art based on the technical solutions of this invention, without departing from the spirit and scope of this invention, whether modifications or substitutions, are also within the protection scope of this invention.

Claims

1. A method for implementing the Low Latency Cryptographic Algorithm (LLBC), characterized in that: The process includes the following steps: Step 1: Obtain 128 bits of plaintext as the data to be encrypted or ciphertext as the data to be decrypted; Step 2: If it is an encryption operation, perform R rounds of encryption operations on the data to be encrypted using the subkey to obtain the ciphertext; if it is a decryption operation, perform R rounds of decryption operations on the data to be decrypted using the subkey to obtain the plaintext; wherein, the data to be encrypted is first divided into two parts in descending order of importance. Each round of encryption operation is as follows: [The following is a list of steps related to data encryption.] After performing cyclic displacement respectively, we obtain 、 And then Perform S1 box replacement and on Perform the S2 box permutation; then use the results of the S1 box permutation and the S2 box permutation as the two inputs to the M function to obtain the output M. Finally, use the output M, the subkey, and the data... Perform XOR operation to update and the use of data The subkey and round constant are updated by XOR operation. If the current round i is not the Rth round, then proceed to the next round of encryption operation; S1 box and S2 box are two sets of S boxes with a gate depth of 3 and an equivalent gate number of less than 20 among the 4-bit S boxes; the decryption operation is the reverse of the encryption operation, and the order of the subkeys used in the Rth round of decryption operation is the reverse of the order of the subkeys used in the Rth round of encryption operation. The subkey used in the first round of decryption is the subkey used in the last round of encryption; the execution process of the M function is as follows: a) Use the results of S1 box permutation and S2 box permutation as the two inputs of the M function. 、 Execute again Then get Circular left shift by b1 bits, i.e. <<<b1; b) First, and Perform the XOR operation, i.e. Then Perform a circular left shift by b2 bits to obtain <<<b2; c) First, and Perform the XOR operation, i.e. Then Circular left shift by b1 bits to obtain <<<b1; d) 将 and Perform the XOR operation, i.e. Then Perform a circular left shift by b2 bits to obtain <<<b2; e) The and Perform the XOR operation, i.e. f) Finally and The output M is obtained by performing an XOR operation, i.e., M = 。 2. The method according to claim 1, characterized in that: The replacement tables for S1 box replacement and S2 box replacement are as follows: In the formula, x is any number from 0 to F in hexadecimal, corresponding to the data before the S-box permutation; S1(x) is the output of the S1-box permutation; and S2(x) is the output of the S2-box permutation. Data after performing two cyclic displacements 、 Perform S1 box permutation and S2 box permutation according to the permutation table, specifically: ... 、 Each bit is divided into sixteen 4-bit groups; then merged into half-byte groups; the half-byte groups are used to query the permutation table to obtain the permutation result.

3. The method according to claim 1 or 2, characterized in that: The S1 box replacement and S2 box replacement correspond to an S box door depth of 3, and an equivalent number of doors of 18.

5.

4. The method according to claim 1, characterized in that: data as well as The update formula is as follows: M ； In the formula, 、 All are subkeys of the current round i. 64 bits of data; This is the round constant for the current round i.

5. The method according to claim 1, characterized in that: The subkey arrangement and update process for the R-round encryption operation is as follows: First, the initial key K is divided into two groups of data. ,Right now Then update based on the update function. The update function is: ， Let i be the round constant for the current round. express The process is executed twice within the G4 function, which consists of circular shifts and XOR operations; then, the subkey... from The key is loaded from the database, specifically as follows: If the initial key K has a length of 128 bits, If the initial key K is 256 bits long, ； The process of the G4 function is as follows: First, ... Divide into four equal parts: ， ， and Then, Circular left shift Bit after The result of the XOR operation is assigned to ,Right now ; and will Circular left shift -bit after The result of the XOR operation is assigned to ,Right now ; and assignment: ， ;in, ， ， and for The result of running the G4 function once.

6. A system based on the method of any one of claims 1-5, characterized in that: include: The acquisition module is used to acquire 128 bits of plaintext as data to be encrypted or ciphertext as data to be decrypted; the encryption / decryption operation module is used to perform R rounds of encryption operations on the data to be encrypted using a subkey to obtain ciphertext if it is an encryption operation; and to perform R rounds of decryption operations on the data to be decrypted using a round key to obtain plaintext if it is a decryption operation. The data to be encrypted is first divided into two parts in descending order of importance. Each round of encryption operation is as follows: [The following is a list of steps related to data encryption.] Perform cyclic shift plus S1 box permutation and cyclic shift plus S2 box permutation in parallel; then use the results of S1 box permutation and S2 box permutation as the two inputs of function M to obtain output M; finally, use output M, subkey and data... Perform XOR operation to update and the use of data The subkey and round constant are updated by XOR operation. If the current round i is not the Rth round, then proceed to the next round of encryption operation; S1 box and S2 box are two sets of S boxes with a gate depth of 3 and an equivalent gate number of less than 20 among the 4-bit S boxes; the decryption operation is the reverse of the encryption operation, and the order of subkeys used in the Rth round of decryption operation is the reverse of the order of suboperations in the Rth round of encryption operation.

7. An electronic terminal, characterized in that: At least including: One or more processors; And a memory storing one or more computer programs; wherein the processor invokes the computer programs to implement the steps of the method for implementing the Low Latency Cryptographic Algorithm LLBC as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that: A computer program is stored, which is invoked by a processor to implement the steps of the method for implementing the Low Latency Cryptographic Algorithm LLBC as described in any one of claims 1-5.

Images