SM4 fast software implementation method based on AES-NI instruction set
By establishing an isomorphic relationship between the SM4 and AES algorithms and optimizing the SM4 algorithm using the AES-NI and AVX2 instruction sets, an efficient software implementation of SM4 was achieved, solving the problem of the SM4 algorithm's lagging performance and improving implementation efficiency.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIHANG UNIV
- Filing Date
- 2023-01-09
- Publication Date
- 2026-05-29
Smart Images
Figure CN116566587B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the interdisciplinary field of computer software engineering and security technology, and specifically relates to a fast software implementation method for SM4 based on the AES-NI instruction set, which can improve the implementation efficiency of the SM4 algorithm. Background Technology
[0002] With the improvement of processor performance, most CPU architectures now offer hardware-accelerated extended instruction sets. To further improve software implementation speed, many scholars both domestically and internationally have begun to explore applying SIMD instruction sets, such as the AVX2 instruction set, to the rapid software implementation of cryptographic algorithms. Among SIMD instruction sets, the AES-NI instruction set is Intel's solution for implementing the AES algorithm, significantly improving the implementation efficiency of the AES algorithm from a hardware design perspective.
[0003] The SM4 algorithm, as my country's first independently designed commercial symmetric cryptographic algorithm, has been widely used in various fields. However, due to the introduction of instruction sets for the AES algorithm, SM4's performance lags significantly behind AES implementations. Both the AES and SM4 algorithms use the irreducible polynomial GF(2^3) for their S-boxes. 8 By finding isomorphic relationships between finite fields, the S-box of SM4 can be mapped to the S-box of AES. The SM4 algorithm can be implemented using the AES-NI instruction set, which can improve the implementation efficiency of the SM4 algorithm. Summary of the Invention
[0004] This invention proposes a novel method for rapid software implementation of the SM4 algorithm based on the AVX2 instruction set and the AES-NI extended instruction set. One aspect of the invention involves improving the implementation efficiency of the SM4 algorithm by finding the isomorphic relationship between the finite fields of the S-boxes of the SM4 algorithm and the S-boxes of the AES algorithm, thereby utilizing the AES-NI instruction set.
[0005] Overall, such as Figure 4 As shown, this is accomplished using the following steps: including the following steps:
[0006] Step 1: Solving the isomorphic mapping matrix: Map the finite fields of the S-box in the SM4 algorithm and the S-box in the AES algorithm to the same composite field to obtain the isomorphic mapping matrix between the finite fields;
[0007] Step 2: Solving the S-box expression: Based on the mapping matrix, the algebraic expression of the S-box in the SM4 algorithm is given;
[0008] Step 3: Implement the S-box using the AES-NI instruction set: Implement the S-box in the SM4 algorithm using the AES-NI instruction set;
[0009] Step 4: Implement the SM4 algorithm: Arrange the data to achieve parallel encryption and decryption of 8 sets of data;
[0010] Step 5: Matrix operation optimization: Use the shuffle instruction in the AVX2 instruction set to implement matrix operations in the round function.
[0011] Specifically, in order to more easily find the mapping matrix, this invention maps two finite fields onto the same composite field for the search, and the overall process is as follows: Figure 1 As shown, the following will be a detailed introduction. Figure 1 The transformation process in [the context of the project]. Mapping a finite field to the same composite field does not necessarily require directly obtaining the mapping matrix; instead, it can be achieved by [finding...]. Figure 1 The T1 and T2 mapping matrices and their corresponding inverse matrices are shown. The required isomorphic mapping matrix can then be calculated, i.e.
[0012]
[0013]
[0014] Based on the above formula, in order to further use the AES-NI instructions, it is necessary to find the substitution relationship between the algebraic expression of the S-box in the SM4 algorithm and the algebraic expression of the S-box in the AES algorithm.
[0015] The algebraic expression for the S-box in the SM4 algorithm is:
[0016] S SM4 (x)=A SM4 ·I SM4 (A SM4 ·x+C SM4 )+C SM4
[0017] The algebraic expression of the S-box in the AES algorithm is:
[0018] S AES (x)=A AES ·I AES (x)+C AES
[0019] Where A SM4 A AES Representing a vector matrix, C SM4 and C AES I represents a column vector. SM4 (x) and I AES (x) represents the inverse of x. In order to find the isomorphic relationship between different S-boxes, this invention transforms the algebraic expressions of the SM4 algorithm and the AES algorithm, and gives the relationship between the algebraic expressions.
[0020] Let T denote the isomorphism mapping matrix, and x be a GF. SM4 (2 8 The element on ) then
[0021] I SM4 (x)=T·I AES (T -1 ·x)
[0022] Transforming the algebraic expression of the S-box in the AES algorithm yields...
[0023]
[0024] The algebraic expression of the S-box in the SM4 algorithm is obtained by transformation.
[0025]
[0026] We can obtain the result by substitution using the mapping matrix.
[0027] S SM4 (x)=A SM4 ·T·I AES (T -1 ·A SM4 ·x+T -1 ·C SM4 )+C SM4
[0028] Substituting the algebraic expression for the S-box in the AES algorithm yields...
[0029]
[0030] Simplification yields
[0031] S SM4 (x)=ATA·S AES (TA·x+TC)+ATAC
[0032] in, TA = T -1 ·A SM4 TC = T -1 ·C SM4 , This invention provides specific parameters for matrices and vectors, namely...
[0033]
[0034]
[0035]
[0036] Solve the S-box of the SM4 algorithm using the given S-box expression. The round function of the SM4 algorithm is as follows: Figure 2 As shown. The `aesenclast` instruction executes the final round of the AES algorithm. Since the final round of the AES algorithm does not involve column obfuscation, using this instruction simplifies the implementation of the SM4 algorithm. To counteract the row shift and round key XOR operations in the instruction, a reverse row shift operation is performed in the implementation, and the data 0x00..00 (a total of 256 0 bits) is passed as the round key. In the implementation, matrix operations are performed using the `shuffle` instruction in the SIMD instruction set. Since only the lower four bits of the index of this instruction are valid, the byte data needs to be divided into high four bits and low four bits in the implementation. Matrix operations are then performed with the first four and last four columns of the matrix, and the outputs are XORed to obtain a complete affine transformation.
[0037] The key advantages of this invention are:
[0038] This invention implements a fast software implementation method for SM4 based on the AES-NI instruction set. By finding the isomorphic relationship between the finite fields of the S-box of the AES algorithm and the S-box of the SM4 algorithm, the implementation efficiency of the SM4 algorithm is improved by making full use of AES-NI and its extended instructions. The implementation speed reached 3723Mbps on the AMD R75800H platform, which provides a reference for the fast software implementation of other symmetric cryptographic algorithms. Attached Figure Description
[0039] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with examples of the invention to explain it, but do not constitute a limitation thereof. In the drawings:
[0040] Figure 1 This illustrates the isomorphic mapping relationship between the finite field of the S-box in the AES algorithm and the finite field of the S-box in the SM4 algorithm of this invention.
[0041] Figure 2 The implementation process of the round function of the SM4 algorithm is shown;
[0042] Figure 3 The process of encrypting 8 sets of plaintext in parallel is shown;
[0043] Figure 4 This is the overall flowchart of the present invention. Detailed Implementation
[0044] The specific implementation of the method is described below. The content described herein is for illustration and explanation only and is not intended to limit the invention.
[0045] This invention proposes a novel method for rapid software implementation of SM4 based on the AVX2 and AES-NI instruction sets. Generally, it includes the following steps: Figure 4 As shown:
[0046] Step 1: Solving the isomorphic mapping matrix: Map the finite fields of the S-box in the SM4 algorithm and the S-box in the AES algorithm to the same composite field to obtain the isomorphic mapping matrix between the finite fields;
[0047] Step 2: Solving the S-box expression: Based on the mapping matrix, the algebraic expression of the S-box in the SM4 algorithm is given;
[0048] Step 3: Implement the S-box using the AES-NI instruction set: Implement the S-box in the SM4 algorithm using the AES-NI instruction set;
[0049] Step 4: Implement the SM4 algorithm: Arrange the data to achieve parallel encryption and decryption of 8 sets of data;
[0050] The key part of the invention is that by finding the isomorphic relationship between the finite fields of the S-box of the SM4 algorithm and the S-box of the AES algorithm, the implementation efficiency of the SM4 algorithm is improved by utilizing the AES-NI instruction set.
[0051] In step 1, to more easily find the mapping matrix, this invention maps two finite fields onto the same composite field for the search. The overall process is as follows: Figure 1 As shown, the following will be a detailed introduction. Figure 1 The transformation process in [the context of the project]. Mapping a finite field to the same composite field does not necessarily require directly obtaining the mapping matrix; instead, it can be achieved by [finding...]. Figure 1 The T1 and T2 mapping matrices and their corresponding inverse matrices are shown. The required isomorphic mapping matrix can then be calculated, i.e.
[0052]
[0053]
[0054] Based on the above formula, in order to further use the AES-NI instructions, it is necessary to find the substitution relationship between the algebraic expression of the S-box in the SM4 algorithm and the algebraic expression of the S-box in the AES algorithm.
[0055] The algebraic expression for the S-box in the SM4 algorithm is:
[0056] S SM4 (x)=A SM4 ·I SM4 (A SM4 ·x+C SM4 )+C SM4
[0057] The algebraic expression of the S-box in the AES algorithm is:
[0058] S AES(x)=A AES ·I AES (x)+C AES
[0059] Where A SM4 A AES Representing a vector matrix, C SM4 and C AES I represents a column vector. SM4 (x) and I AES (x) represents the inverse of x. In order to find the isomorphic relationship between different S-boxes, this invention transforms the algebraic expressions of the SM4 algorithm and the AES algorithm, and gives the relationship between the algebraic expressions.
[0060] Let T denote the isomorphism mapping matrix, and x be a GF. SM4 (2 8 The element on ) then
[0061] I SM4 (x)=T·I AES (T -1 ·x)
[0062] Transforming the algebraic expression of the S-box in the AES algorithm yields...
[0063]
[0064] The algebraic expression of the S-box in the SM4 algorithm is obtained by transformation.
[0065]
[0066] We can obtain the result by substitution using the mapping matrix.
[0067] S SM4 (x)=A SM4 ·T·I AES (T -1 ·A SM4 ·x+T -1 ·C SM4 )+C SM4
[0068] Substituting the algebraic expression for the S-box in the AES algorithm yields...
[0069]
[0070] Simplification yields
[0071] S SM4 (x)=ATA·S AES (TA·x+TC)+ATAC
[0072] in, TA = T -1 ·A SM4 TC = T -1 ·C SM4 ,
[0073] Therefore, in step 2, by formula
[0074] S SM4 (x)=ATA·S AES (TA·x+TC)+ATAC
[0075] As can be seen, after finding the isomorphic mapping matrix, for a given element, we can first perform an affine transformation on it, then pass the result of the affine transformation into the S-box of AES, and then perform another affine transformation on the output of the AES S-box. The result is equivalent to the output obtained by passing that element into the S-box of SM4. The specific values of the parameters ATA, TA, TC, and ATAC in the formula are as follows:
[0076]
[0077]
[0078]
[0079] The isomorphic relationship between the S-boxes of AES and SM4 is the core of this patent. After finding the isomorphic relationship between SM4 and AES, the next consideration is how to utilize AESNI to implement a complete SM4 algorithm with good performance. AESNI is a function interface provided by processor manufacturers with low-level hardware support. To implement SM4 using AESNI, the first step is to select as few operation instructions as possible outside the S-box. A complete SM4 algorithm flow, besides the S-box computation, also requires the implementation of other parts. Figure 3 A complete implementation of the SM4 algorithm is presented, which enables parallel encryption of 8 sets of plaintext.
[0080] In step 3, the implementation of the S-box in the SM4 algorithm using the AES-NI instruction set is actually integrated into... Figure 3The implementation process of the round function of the SM4 algorithm is described. The round function implementation is mainly based on the AES-NI instruction set. Among the extended instructions provided by the Intel architecture, there is an `aesenclast` instruction, which can execute the last round of the AES algorithm. Since the last round of the AES algorithm does not involve column obfuscation, using this instruction simplifies the implementation of the SM4 algorithm. To counteract the row shift and round key XOR operations in the instructions, this paper performs a reverse row shift operation and passes the data 0x00..00 (a total of 256 0 bits) as the round key. The implementation process of each round is as follows: Figure 2 As shown. To simplify matrix operations, this invention utilizes the shuffle instruction from the SIMD instruction set. This instruction is a data rearrangement instruction that can rearrange data in a register according to given parameters. Taking the _mm_shuffle_epi8(a,b) instruction as an example, this instruction rearranges bytes, where 'a' is the original data, 'b' is the index value, and each byte in the result is the data at the corresponding index position of 'a'. Since only the lower four bits of each byte in index 'b' of this instruction are valid, the data at positions 0 to 15 of 'a' can be found through this index.
[0081] Since the matrix is known in this invention, the matrix operations in the round function can be pre-calculated beforehand, using the result of multiplying the matrix by numerical values. This result is then used as the original data, with the running data in the algorithm as the index, and the matrix multiplication operation is completed using the shuffle instruction. Because only the lower four bits of the index of this instruction are valid, the byte data needs to be divided into the higher four bits and the lower four bits in the implementation. Simultaneously, matrix multiplication is performed with the first four columns and the last four columns of the matrix. XORing the outputs of each yields a complete affine transformation. In the implementation of this paper, the pre-calculated data is the result of multiplying the first four columns of the matrix by 0000~1111 and the last four columns of the matrix by 0000~1111.
[0082] In step 4, data arrangement is primarily accomplished using the `set` instruction. Taking the `_mm256_set_epi32` instruction as an example, this instruction can store eight 32-bit data bytes in the same register. This patent uses this instruction to store eight sets of plaintext with the same X... i They are stored in the same register and then subjected to round function operations.
[0083] Finally, the algorithm results are reverse-sorted, also using the `set` command. This command is used to sort each ciphertext (X) group. 35 ,X 34 ,X 33 ,X 32 It is stored in a contiguous memory location.
Claims
1. A rapid software implementation method for SM4 based on the AES-NI instruction set, characterized in that, It includes the following steps: Step 1: Solving the isomorphic mapping matrix: Map the finite fields of the S-box in the SM4 algorithm and the S-box in the AES algorithm to the same composite field to obtain the isomorphic mapping matrix between the finite fields; Step 2: Solving the S-box expression: Based on the mapping matrix, the algebraic expression of the S-box in the SM4 algorithm is given; Step 3: Implement the S-box using the AES-NI instruction set: Implement the S-box in the SM4 algorithm using the AES-NI instruction set; Step 4: Implement the SM4 algorithm: Arrange the data to achieve parallel encryption and decryption of 8 sets of data; Step 5: Matrix operation optimization: Use the shuffle instruction in the AVX2 instruction set to implement matrix operations in the round function; The algebraic expression for the S-box in the SM4 algorithm is: The algebraic expression of the S-box in the AES algorithm is: in , Represents a vector matrix. and Represents a column vector. and Indicates to Inverse calculation is performed; in order to find the isomorphic relationship between different S-boxes, this invention transforms the algebraic expressions of the SM4 algorithm and the AES algorithm, and gives the relationship between the algebraic expressions; make Represents an isomorphic mapping matrix. for The elements on, then Transforming the algebraic expression of the S-box in the AES algorithm yields... The algebraic expression of the S-box in the SM4 algorithm is obtained by transformation. We can obtain the result by substitution using the mapping matrix. Substituting the algebraic expression for the S-box in the AES algorithm yields... Simplification yields in, , , , , Therefore, in step 2, by formula It can be seen that after finding the isomorphic mapping matrix, for a certain element, we can first perform an affine transformation on it, and then pass the result of the affine transformation into the S-box of AES. Then, we perform another affine transformation on the output of the S-box of AES. The result is equivalent to the output obtained by passing the element into the S-box of SM4.
2. The method for rapid software implementation of SM4 based on the AES-NI instruction set according to claim 1, characterized in that, In step 1, the finite fields of the S-box in the SM4 algorithm and the AES algorithm are mapped onto the same composite field, and their respective mapping matrices are obtained. and After that, through and Find the mapping matrix between the two finite fields. .
3. The method for rapid software implementation of SM4 based on the AES-NI instruction set according to claim 1, characterized in that, In step 2, based on the isomorphic mapping matrix, a new algebraic expression for the S-box in the SM4 algorithm is given: ;in, This refers to the S-box of SM4. The S-box represents AES. Represents a matrix, with specific parameters as follows: 。 4. The method for rapid software implementation of SM4 based on the AES-NI instruction set according to claim 1, characterized in that, In step 3, based on the S-box expression in SM4: The S-box is implemented using the last round of instructions in the AES-NI instruction set, and the row shifting process in the instructions is canceled out by a reverse row shift operation; whereby... The S-box represents AES. 。 5. The method for rapid software implementation of SM4 based on the AES-NI instruction set according to claim 1, characterized in that... In step 4, the plaintext of the SM4 algorithm can be represented as: Through data arrangement, the identical plaintext in 8 groups is... By placing them in the same YMM register, parallel encryption of 8 sets of plaintext can be achieved.
6. The method for rapid software implementation of SM4 based on the AES-NI instruction set according to claim 1, characterized in that, In step 5, since the matrix in the round function is known, the result of multiplying the matrix and the vector is pre-calculated during implementation, and the matrix operation is completed by the shuffle byte rearrangement instruction.