High speed circuit for encryption and decryption combining aes and sm4

Abstract

The disclosed embodiments relate to a cryptographic accelerator circuit comprising: a first affine transformation circuit to generate a first data block from an input data block; an SM4 S-box circuit configured to perform a first byte S-box operation according to an SM4 cipher and using an SM4 S-box table, the SM4 S-box operation being applied to the first transformed data block to obtain a substitution data block; and a second affine transformation circuit to generate a second data block from the substitution data block, wherein the first affine transformation circuit and the second affine transformation circuit are configured to perform a multiplication of the substitution data block with a respective matrix and an addition of a respective translation vector, and wherein the first affine transformation circuit and the second affine transformation circuit are configured such that the second transformed data block is equal to an input data block processed by a second S-box operation using an S-box table according to another symmetric cipher.

Description

Background Technology

[0001] Encryption algorithms (also known as "ciphers") are used to encrypt and decrypt data. Modern encryption algorithms perform computations on very large numbers (which are used as the cryptographic key) to maintain the integrity, confidentiality, and authenticity of messages. Messages can be in the form of single bits or blocks of bits. Ciphers can use symmetric keys (where the same key is used to encrypt and decrypt messages) or asymmetric keys (where different keys are used for encryption and decryption). Ciphers using symmetric keys include, in particular, AES (Advanced Encryption Standard) and SM4 (the Chinese national standard for WAPI in Wireless LANs). AES is widely supported on many platforms across multiple features and AES-accelerated hardware.

[0002] Most modern symmetric cryptosystems, such as AES and SM4, are typically designed as a series of rounds, each consisting of a series of linear operations, followed by a reversible nonlinear transformation implemented by a lookup table also known as a "substitution box" (S-box), possibly followed by additional linear operations. The S-box transformation is typically applied to every 8-bit block of the input. However, AES and SM4 cryptosystems involve different numbers of rounds, different S-boxes, and rotation, scaling, and mixing operations that require separate hardware implementations or firmware code.

[0003] Cryptography can be implemented using hardware, software, or a combination of both. A hardware implementation to accelerate the computation required for AES is proposed. Efficient and unified hardware implementations for AES and SM4 cryptography are needed. Attached Figure Description

[0004] In the accompanying drawings, each identical or nearly identical component illustrated in the various drawings is indicated by the same reference numerals. For clarity, not every component is labeled in every drawing. In the accompanying drawings:

[0005] Figure 1 This is a block diagram illustrating the S-box circuitry of a unified cryptography hardware accelerator according to some embodiments;

[0006] Figure 2 This is a block diagram of a unified hardware accelerator that performs AES and SM4 encryption and decryption according to some embodiments;

[0007] Figure 3 This is a block diagram of the hardware processing pipeline for performing AES and SM4 encryption and decryption according to some embodiments;

[0008] Figures 4 to 7 It is a block diagram of the various stages of the hardware processing pipeline according to some embodiments;

[0009] Figure 8This is a block diagram of the hardware processing pipeline for performing AES and SM4 encryption and decryption according to other embodiments;

[0010] Figure 9 yes Figure 8 A block diagram of some embodiments of a stage of the hardware processing pipeline;

[0011] Figure 10 This is a block diagram illustrating one embodiment of a processing system including a unified hardware accelerator that performs AES and SM4 encryption and decryption;

[0012] Figure 11 This is a block diagram illustrating one embodiment of a processing system for generating representations of circuit components. Detailed Implementation

[0013] Previous solutions for implementing block ciphers such as AES and SM4 involved implementing them using software / microcode or designing dedicated hardware accelerators for each individual block cipher. Such software / microcode implementations typically fail to meet desired performance requirements. Meanwhile, including dedicated hardware accelerators for each block cipher in the circuit increases product cost in terms of silicon area and leakage power, and also necessitates significant design and verification efforts. In one aspect, this disclosure proposes a unified hardware accelerator to allow hardware acceleration of AES and SM4 ciphers with minimal impact on performance.

[0014] AES and SM4 ciphers are similar in several ways. For example, both ciphers utilize a symmetric secret key to perform operations on Galois fields of the same length GF(2). 8 Encryption and decryption of data represented by (i.e., finite fields) differ only in the definition of their respective polynomials. Furthermore, both cryptosystems operate on 16-byte (128-bit) blocks of data and perform multiple rounds (10 to 14 rounds for AES and 32 rounds for SM4), each round including byte substitution and permutation operations to transform the input data during encryption or decryption. Byte substitution performs "obfuscation" by obfuscating the relationship between the key value and the encrypted or decrypted information, while permutation performs "diffusion" by shuffling, swapping, and mixing the bits of the key value and the encrypted or decrypted input data. Decryption is similar to encryption, and AES decryption involves reversing the operations used for encryption.

[0015] Byte substitution operations are typically implemented using a lookup table called an "S-box". The AES cipher uses two 256-byte S-boxes for encryption and decryption, respectively. The SM4 cipher uses a single S-box for either encryption or decryption, and generates a 32-bit round key from the encryption key using a key scheduling algorithm that extends the encryption key.

[0016] The disclosed embodiments describe a unified hardware accelerator for AES and SM4 cryptography. The disclosed embodiments utilize a common S-box table to save area and reduce cost. It is anticipated that the disclosed unified AES / SM4 encryption / decryption hardware accelerator will provide significant area improvements compared to using separate AES / SM4 implementations.

[0017] Although AES and SM4 ciphers can perform similar byte substitution operations (S-box), they use different Galois domains GF(2). 8 The reduction polynomial. The AES cipher can use GF(2) to reduce the polynomial. 8 Reduced polynomial x 8 +x 4 +x 3 +x+1, while the SM4 cipher can use GF(2 8 Reduced polynomial x 8 +x 7 +x 6 +x 5 +x 4 +x 2 +1. The choice of reducing polynomial distinguishes the logic used for Galois field multiplication and inverse computation, thus requiring separate circuitry for AES and SMS4 hardware implementations. Implementing separate dedicated hardware accelerators for AES and SMS4 is cumbersome and inefficient, and can result in significant area and power overhead.

[0018] The embodiments described herein reduce circuit area by avoiding separate hardware for each of the AES and SM4 ciphers. Instead, the disclosed embodiments use a single unified hardware accelerator to handle AES / SM4 encryption and decryption. AES and SM4 ciphers include common key components that perform S-box operations, which may comprise most area- and performance-critical operations.

[0019] Figure 1This diagram illustrates a block diagram of the S-box circuitry for a unified cryptographic hardware accelerator according to some embodiments. The S-box circuitry includes two inputs that receive a data block SBIa from an AES data path and a data block SBI from an SM4 data path, respectively. The S-box circuitry also includes two outputs that provide data blocks SBOa and SBOs to the AES and SM4 data paths, respectively. Input SBIa is connected to an affine transformation circuit AST for transforming the AES data block SBIa from the AES encryption or decryption domain defined by the AES S-box to the SM4 domain defined by the SM4 S-box. The S-box circuitry also includes a multiplexer MX for selecting one or the other of the output of the transformation circuit AST and the input data block SBI. The multiplexer MX is controlled by a signal as for selecting the input data path AES or SM4. The output of the multiplexer MX is connected to the SM4 S-box SMBX. The output of the S-boxSMBX provides an SM4 output data block SBO, which is further processed by the affine transformation circuit SAT to transform the output data block generated by the S-boxSMBX from the SM4 domain to the AES encryption or decryption domain. The output of the transformation circuit SAT provides an AES output data block SBOa.

[0020] The affine transformation circuits AST and SAT receive a signal ed specifying the operation to be performed (encryption or decryption). The affine transformation of the input data to be applied to the circuits AST and SAT is different for encryption and decryption.

[0021] According to some embodiments, the data SBIa, SBIs, SBOa, and SBOs are bytes, and the affine transformation is defined by the following formula:

[0022] s=M·b+c, (1)

[0023] Where s is the output byte of the affine transformation, M is an 8×8 bit matrix, b is the input byte of the affine transformation operation, and c is the constant byte defining the translation vector. The affine transformation performed by the circuit AST is as follows in at least one example:

[0024]

[0025] For encryption, where b i (i = 0…7) are the bits of byte b, and s i (i = 0…7) are the bits of the output byte s, and for decryption:

[0026]

[0027] The affine transformation performed by the circuit SAT is shown in the examples of equations (2) and (3) as follows:

[0028]

[0029] Regarding encryption and decryption:

[0030]

[0031] It can be observed that other matrices M, M1 and constant bytes c, c1 transform data from the AES Galois field to the SM4 Galois field and vice versa.

[0032] Figure 1 The circuitry can be replicated to process each byte of, for example, a 32- or 128-bit data block simultaneously.

[0033] Figure 2 This diagram illustrates a block diagram of a cryptographic hardware accelerator (HWA) according to some embodiments. The HWA includes a combined AES / SM4 round module (CRM) that performs round processing and key expansion (also known as "key scheduling"). In each round, AES cryptography performs 16 S-box operations for data processing and additional S-box operations for key scheduling. SM4 performs 4 S-box operations for data processing and another 4 S-box operations for key scheduling in each round. The round module CRM is configured to perform 16 S-box operations, enabling it to perform two rounds of SM4 cryptography and SM4 key scheduling, as well as one AES round. Figure 2 As shown, the cryptographic accelerator HWA receives input data block DI and key block KI, and outputs data block DO and round key block KO. The cryptographic accelerator HWA also includes multiplexers MX1 and MX2, which select the data to be provided to the round module CRM on the one hand between the input data block DI and key block KI, and on the other hand between the output data block DO and output key block KO.

[0034] The round module CRM and multiplexers MX1 and MX2 are managed by a control circuit CTL. The control circuit CTL receives a first signal *as* for selecting the cipher to be executed (AES or SM4) and a second signal *ed* for selecting encryption or decryption. The control circuit CTL can receive a third signal to specify whether the input key block KI is encoded in 128-bit or 256-bit configuration in the case of AES cipher. The control circuit CTL manages the number of rounds to be executed (i.e., the number of times the round module CRM is activated). For this purpose, the control module CTL provides control signals to the round module CRM and multiplexers MX1 and MX2. Multiplexers MX1 and MX2 are controlled by the control circuit to provide the input data block DI and key KI to the round module CRM in the first round. In subsequent rounds, the output data block DO and key KO are provided to the input of the round module CRM.

[0035] Given the subsequent decryption of SM4 and AES ciphers, the last round key generated when the data block was encrypted is used to decrypt the data block, which can be output by the round module CRM or stored as the last round key KO used for encryption.

[0036] Instead of routing the output rounds of the round module CRM to its input, the round module CRM can be replicated in a hardware pipeline that receives the data block DI to be encrypted or decrypted and the key block KI to be used, and provides the data block DO to be encrypted or decrypted respectively.

[0037] Figure 3 This is a block diagram illustrating the processing pipeline of a unified hardware accelerator HPP according to some embodiments. The hardware accelerator HPP includes round-level CRM0-CRM16, a set of flip-flops or 128-bit registers FF1-9, an XOR operator XG that performs a bitwise XOR operation combining two 128-bit data blocks, and multiplexers MX4 and MX5.

[0038] According to some embodiments, each of round sub-levels CRM1-CRM14 performs one AES processing round and two SM4 processing rounds. Each of round sub-levels CRM15 and CRM16 performs two SM4 processing rounds. The hardware accelerator HPP receives the input data block DI and key block KI, combined by the XOR operator XG. This operation corresponds to the first "addition round key" of the AES cipher. During the first processing cycle, the data block DI and key block KI are also stored in corresponding registers 1 and 2. During the first processing cycle, the output of the operator XG is also stored in register 3. During this first processing cycle, the key block KI is processed by the first round sub-level CRM0 to provide the first round key for the SM4 cipher. Registers 1-3 and the corresponding outputs of round sub-level CRM0 are connected to the second round sub-level CRM1. Round sub-levels CRM1 through CRM13 are cascaded.

[0039] The AES data block output of round-level CRM9 is also connected to the first register 4 in the group of four cascaded registers 4-7. The AES data block output of round-level CRM13, along with the output of register 7, is connected to the corresponding input of multiplexer MX4. The output of multiplexer MX4 is connected to the AES data block input of round-level CRM14. The other outputs of round-level CRM13 are connected to the corresponding inputs of round-level CRM14. The AES data block output of round-level CRM14 is also connected to the first register 8 in the group of two cascaded registers 8 and 9. The SM4 data and key outputs of round-level CRM14 are connected to the corresponding inputs of round-level CRM15, and the SM4 data and key outputs of round-level CRM15 are connected to the corresponding inputs of round-level CRM16. The output of register 9 and the SM4 data output of round-level CRM16 are connected to the corresponding inputs of multiplexer MX5, which provides output data blocks DO to the data output of the hardware accelerator HPP. Multiplexer MX4 is controlled by signal k256 to select the AES key size of 128 or 256 bits. Multiplexer MX5 is controlled by signal as to select the cipher to be executed, either AES or SM4.

[0040] Levels CRM1-CRM9 execute the first 9 rounds of AES cipher and the first 18 rounds of SM4 cipher. If AES cipher is selected for 10 rounds, then the key block KI is a 128-bit block (signal as is set to "AES" and signal k256 is set to, for example, 0), and the AES data output of level CRM9 is continuously stored in registers 4-7 and provided to level CRM14 by multiplexer MX4. If SM4 cipher is selected (signal as is set to "SM4"), then levels CRM10-CRM13 execute an additional 8 rounds of SM4 cipher. If AES cipher is selected for 14 rounds, then the key block KI is a 256-bit block (signal as is set to "AES" and signal k256 is set to, for example, 1), and levels CRM10-CRM13 execute an additional 4 rounds of AES cipher, with the AES data output of level CRM13 being provided to level CRM14 via multiplexer MX4. Depending on the values ​​defined by signals as and k256, level CRM14 performs the final (10th or 14th) round of AES cipher or the 28th round of SM4 cipher. The AES output data blocks provided by level CRM14 are stored consecutively in registers 8 and 9, while levels CRM15 and CRM16 perform the final four rounds of SM4 cipher (rounds 29 to 32).

[0041] Figure 4This diagram illustrates a round-level CRMx according to some embodiments. The round-level CRMx can be one of round-level CRM2 to CRM14. The round-level CRMx includes 128-bit inputs for round key blocks RKIs and data blocks DIs to be processed by SM4 cryptography, 256-bit inputs for AES round key blocks RKIa, and 128-bit inputs for data blocks DIa to be processed by AES cryptography.

[0042] The round-level CRMx includes an SM4 round key scheduling circuit, comprising: XOR operators XG1, XG2, XG3, and XG4 performing bit-by-bit XOR operations; multiplexers MX6 and MX7; flip-flops or registers 10 and 12; register 10 storing a 128-bit block; register 12 storing a 32-bit word; two sets of two left rotators, 13-bit LR13 and 23-bit LR23; and two sets of four S-boxes SMB1 and SMB2. The three least significant 32-bit words of the SM4 round key block are XORed together with a 32-bit constant number RCA. The 32-bit word provided by operator XG1 is transmitted via multiplexer MX6 to a set of four S-boxes SBM1, each S-box receiving the corresponding byte extracted from the word. The 32-bit output word generated by the S-box operation is provided as input to one of the two sets of left rotators LR13 and LR23, and as input to the XOR operator XG2, which receives the outputs of the left rotators LR13 and LR23, as well as bits [127:96] of the 128-bit round key block RKI. In parallel, the round key block RKI is arranged such that its bits [95:0] are shifted to positions [127:32], and the bits [31:0] of the arranged round key block are set to the 32-bit word provided by the operator XG2. The rearranged round key block is stored in register 10. Then, the XOR operator XG3 XORs the 32-bit words [95:64], [63:32], and [31:0] of the rearranged round key block with a 32-bit constant number RCB. The constants RCA and RCB depend on the number of rounds currently being executed and the cryptographic operation being performed—encryption or decryption, as selected by the signal ed. A 32-bit word at the output of the arithmetic unit XG3 is provided to the second set of four S-boxes SMB2 via multiplexer MX7. The 32-bit word provided by the S-boxes SMB2 is stored in register 12 and then directly provided to the XOR arithmetic unit XG4 via the second set of two left rotators LR13 and LR23 respectively. Bits [127:96] of the round key block in register 10 are also provided to the input of the arithmetic unit XG4. In parallel, the 128-bit key block in register 10 is arranged such that bits [95:0] are shifted to positions [127:32], and bits [31:0] are set to the 32-bit word provided by the arithmetic unit XG4. The resulting 128-bit word is then provided as a new 128-bit round key block RKO at the output of the round level CRMx in the next SM4 round.

[0043] According to the SM4 specification, the constants RCA and RCB used for encryption in the round-level CRMx should be equal to the 32-bit constant CK used for encryption. 2x and CK 2x+1 Where x is the round-level CRMx number, and

[0044] CK i,j = (4i+j)x 7 (mod 256), CK i,j It is a constant number CK i The j-th byte, where j = 0, 1, 2 and 3, and i = 0, 1, ..., 31.

[0045] For decryption, the constants RCA and RCB used by the round-level CRMx are CK and CK, respectively. 2(17-x)+1 and CK 2(17-x) The round-level CRMx can also be configured to receive round index x and calculate constant values ​​RCA and RCB as functions of signal ed.

[0046] In summary, the processing performed by arithmetic units XG1 and XG2 and S-box group SMB1 corresponds to one round of SM4 key scheduling, while the processing performed by arithmetic units XG3 and XG4 and S-box group SMB2 corresponds to the next round of SM4 key scheduling.

[0047] The round-level CRMx also includes the SM4 round processing circuit, which includes XOR operators XG5, XG6, XG7, XG8, multiplexers MX8 and MX9, flip-flops or registers 14 and 15 (register 15 stores a 128-bit block, while register 14 stores a 32-bit word), two sets of four left-rotated bits: 2-bit LR2, 10-bit LR10, 18-bit LR18, and 24-bit LR24, and two sets of four S-boxes SMB3 and SMB4. Operator XG5 XORs the 32-bit word [95:64], [63:32], [31:0] of the 128-bit data block DI received by the round-level CRMx with the 32-bit word [63:32] of the SM4 round key RKI. The 32-bit word provided by operator XG5 is transmitted to the input of S-box group SMB3 via multiplexer MX8. A 32-bit word provided by S-box group SMB3 is transmitted to the input of the first shifter in left shifter groups LR2, LR10, LR18, and LR24, and to an input of arithmetic unit XG6. The output of the first left shifter group is connected to the corresponding input of arithmetic unit XG6, which also receives a 32-bit word [127:96] of the 128-bit input data block DI. In parallel, the 128-bit input data block DI is arranged such that its bits [95:0] are shifted to positions [127:32], and bits [31:0] are set to the 32-bit word provided by arithmetic unit XG6. The rearranged data block is then stored in register 15, and arithmetic unit XG7 XORs the 32-bit words [95:64], [63:32], and [31:0] of the rearranged data block with the 32-bit word [31:0] of the SM4 round key RKI. The 32-bit word at the output of the arithmetic unit XG7 is provided to the S-box group SMB4 via the multiplexer MX9. The 32-bit word provided by the S-box group SMB4 is stored in register 14 and then directly and separately provided to the arithmetic unit XG8 via the second set of left rotators LR2, LR10, LR18, and LR24. Bits [127:96] in register 15 are also provided to the input of the arithmetic unit XG8. In parallel, the 128-bit word in register 15 is arranged such that bits [95:0] are shifted to positions [127:32], and bits [31:0] are set to the 32-bit word provided by the arithmetic unit XG8. The resulting 128-bit data block DO is provided to the output of the round-level CRMx in the next SM4 round. The multiplexers MX6-MX9 are controlled by the signal as, which selects either the AES or SM4 cipher, and the signal ed specifies the cipher operation to be performed (encryption or decryption).

[0048] In summary, the processing performed by arithmetic units XG5 and XG6 and S-box group SMB3 corresponds to one round of the SM4 cipher, while the processing performed by arithmetic units XG7 and XG8 and S-box group SMB4 corresponds to the next round of the SM4 cipher.

[0049] The round-level CRMx also includes AES round encryption processing circuitry, which includes affine transformation circuits ASTe and SATe, circuits SHR and MXC that perform AES shift row and mix column operations, and an XOR operator XG9 that performs AES round key addition operations (see NIST.FIPS.197). Furthermore, the AES round encryption processing circuitry shares multiplexers MX6-MX9, S-box groups SMB1-SMB4, and registers 12 and 14 with the SM4 round key scheduling circuitry and the SM4 round processing circuitry.

[0050] The 128-bit data block DIA, received from the input of the round-level CRMx and to be encrypted using AES cryptography, is transformed by the affine transformation circuit ASTe. The circuit ASTe is configured to apply the affine transformation M·b+c (e.g., according to equation (2)) to each byte of the input data block DIA. Then, 32-bit words of the 128-bit data block provided by the circuit ASTe are transmitted and dispatched to the S-box groups SMB1-SMB4 via multiplexers MX6-MX9. The 32-bit words provided by the S-box groups SMB1-SMB4 are stored in registers 11-14 respectively and then provided to the affine transformation circuit SATe in the form of 128-bit data blocks. The circuit SATe is configured to apply the affine transformation M1·b+c1 (e.g., according to equation (4)) to each byte of the received data block. The transformed 128-bit data blocks provided by the circuit SATe are then processed continuously by the circuits SHR and MXC. In parallel, the round-level CRMx receives a 128- or 256-bit AES round key block RK1a, which is expanded by the AES round key scheduling circuit RKS. RKS outputs a 256-bit AES round key block RKOa, which will also be used to derive the next round key in the next round. The lower 128 bits of the 128-bit data block provided by circuit MXC and the round key block RKOa are combined by arithmetic unit XG9. Arithmetic unit XG9 outputs a 128-bit data block DOa, which is provided to the output of the round-level CRMx. Circuit RKS receives the signal ed and is configured to perform either the round key expansion for encryption or the inverse round key expansion for decryption, selected by signal ed. Circuit RKS also receives the signal k256 and is further configured to perform different key expansion and inverse key expansion processes depending on the size of the AES key block KI (128-bit or 256-bit).

[0051] The round-level CRMx also includes AES round decryption processing circuitry, which includes IMXC and ISHR circuitry for performing inverse row shifting and inverse column mixing operations of AES cryptography, as well as affine transformation circuitry ASTd and SATd. Furthermore, the AES round decryption processing circuitry shares multiplexers MX6-MX9, S-box groups SMB1-SMB4, and registers 11-14 with the SM4 round key scheduling circuitry, the SM4 round processing circuitry, and the AES round encryption circuitry.

[0052] The 128-bit data block DIA, received at the input of the round-level CRMx and to be decrypted, is first processed sequentially by circuits IMXC and ISHR, and then transformed by affine transformation circuit ASTd. Circuit ASTd is configured to apply affine transformation M·b+c (e.g., according to equation (3)) to each byte of the 128-bit data block provided by circuit ISHR. Then, 32-bit words of the 128-bit data block provided by circuit ASTd are transmitted and dispatched to S-box groups SMB1-SMB4 via multiplexers MX6-MX9. The 32-bit words provided by S-box groups SMB1-SMB4 are stored in registers 11-14 respectively, and then provided to affine transformation circuit SATd in the form of 128-bit data blocks. Circuit SATd is configured to apply affine transformation M1·b+c1 (e.g., according to equation (5)) to each byte of the received data block. The 128-bit data block provided by circuit SATd and the 128-bit round key RKa provided by circuit RKS are combined by arithmetic unit XG9, which outputs a 128-bit data block DO. A multiplexer MX13 can be provided at the input of arithmetic unit XG9 to select either the output of circuit MXC or circuit SATd based on the signal ed for encryption or decryption.

[0053] Therefore, the round-level CRMx comprises 16 S-boxes (or four groups of four S-boxes), enabling it to perform two rounds of SM4 cipher and SM4 key scheduling or one round of AES cipher, with the cipher applied simultaneously to four 32-bit words of the 128-bit input data block DIs or DIA. Due to the presence of registers 10-15, and because any input-to-output path passes through registers 10-15, the round-level CRMx produces output data in one clock cycle. Consequently, the hardware processing pipeline HDD encrypts or decrypts 128-bit data blocks for SM4 and AES ciphers in 17 clock cycles (one cycle in level CRM0 or registers 1-3 and 16 cycles in round-level CRM1-CRM16). Furthermore, the hardware processing pipeline HDD can begin data block encryption or decryption at each clock cycle.

[0054] According to one embodiment, signals as, ed, and k256 are stored in each round, so that the cryptographic process (SM4 / AES, key size 128 / 256 bits, encryption / decryption) that begins at each clock cycle can also be changed at each clock cycle.

[0055] Round-based CRM ( Figure 2 This can be implemented via a round level derived from the round level CRMx, and also includes a derived path activated by the round number signal. When the round number is set to 1, this derived path bypasses the circuit IMXC; when the round number signal is set to 10 or 14, this derived path bypasses the circuit MXC, and provides round number-related values ​​for constant data RCA and RCB. According to some embodiments, the round level CRMx includes a multiplexer that bypasses the circuit IMXC based on a signal indicating whether the first AES round is currently being executed. The multiplexer MX13 may also include another input connected to the output of the circuit SHR to bypass the circuit MXC based on a signal Irnd indicating whether the last AES round (round 10 or 14) is currently being executed.

[0056] Figure 5 The round-level CRM1 (e.g.) is shown Figure 3 An example is shown. The round-level CRM1 differs from the round-level CRMx in that it does not include the IMXC circuit and has a modified SM4 round key scheduling circuit. The SM4 round key scheduling circuit of the round-level CRM1 includes arithmetic units XG1, XG2, XG3, XG4, two sets of left rotators LR13, LR23, register 16, and a multiplexer MX10 controlled by the signal ed, with register 10 removed. The output of S-box group SMB1 is directly supplied to the inputs of arithmetic unit XG4 and the second set of left rotators LR13, LR23. The outputs of arithmetic unit XG4 are concatenated to form bits [31:0] of a 64-bit word, where the outputs of arithmetic unit XG2 present a 32-bit word. Multiplexer MX10 is connected to select bits [127:64] of the round key RKI for decryption or encryption, a 32-bit word provided by XOR operator XG4, and a 64-bit word formed by the 32-bit word provided by XOR operator XG2. Bit positions [63:0] of register 16 receive the output of multiplexer MX10, and bit positions [127:64] of register 16 receive bits [63:0] of the round key RKI. Register 16 provides the output round key RKO. When signal ed selects decryption, the output round key RKO is equal to the input round key RKI, where words [63:0] and [127:64] are swapped to recover the original decryption key swapped by level CRM0.

[0057] Round-based CRM14 ( Figure 3This can be achieved through a round-level CRMx, which is modified by removing the circuit MXC or by using a three-input multiplexer MX13 to bypass the circuit MXC at the last AES round (i.e., when the signal Irnd is set).

[0058] Figure 6 The diagram illustrates a block diagram of a round-level CRMMy according to some embodiments. The round-level CRMMy can be one of round-level CRM15 or CRM16 that only performs SM4 encryption or decryption processing. The round-level CRMMy is derived from the round-level CRMx, thereby removing the AES round-level encryption and decryption processing circuitry and the AES round-level key scheduling circuitry RKS. Since the S-box groups SMB1-SMB4 are not shared between AES and SM4 ciphers, multiplexers MX6-MX9 can also be removed. According to other embodiments, the round-level CRMMy can be implemented by the round-level CRMx, where the control signal as is forced to select a value for the SM4 cipher, where inputs RK1a and DIA are not connected, and outputs RK1a and DOA are not connected.

[0059] Since SM4 key scheduling is not required for the last SM4 round, the SM4 round-sub-CRM16 can be implemented by removing the SM4 round-sub-CRM16 from the round-sub-CRMy.

[0060] Figure 7 This diagram illustrates a block diagram of a round-level CRM0 according to some embodiments. Round-level CRM0 is derived from round-level CRM1, such that it includes only the SM4 round key scheduling circuitry of round-level CRM1. Round-level CRM0 also includes an XOR operator XG10 and a multiplexer MX11 controlled by the signal ed. Operator XG10 is placed in the circuit to receive the input round key RKI and a 128-bit data block FK, thereby masking the round key with the data block FK. The output of operator XG10 is connected to the inputs of operators XG1, XG2, XG3, and XG4. Bits [127:64] and [63:0] of the input round key RKI are provided to multiplexers MX10 and MX11, respectively. Multiplexer MX11 receives bits [63:0] of the output of operator XG10 at another input. The output of multiplexer MX11 is stored at bit positions [127:64] in register 16, while the output of multiplexer MX10 is stored at bit positions [63:0] in register 16. Data block FK is a system parameter of the SM4 cipher set to 0xA3B1BAC656AA3350677D9197B27022DC. When the signal ed selects decryption, the output round key RKO corresponds to the input key RKI exchanged between words [63:0] and [127:64].

[0061] Figure 8 This is a block diagram illustrating another embodiment of the hardware pipeline HPP, HPP1. The hardware pipeline HPP1 differs from the main hardware pipeline HPP in that it includes an additional processing pipeline that receives a second 128-bit data block (e.g., DI[255:128]), and includes round stages CXR1-CRX16, an XOR operator XG20, multiplexers MX24 and MX25, and registers 21 and 23-29. The additional processing pipeline has the same structure as the processing pipeline of the main hardware pipeline HPP. The additional processing pipeline receives the second 128-bit data block, for example, DI[255:128], while the main processing pipeline receives a 128-bit data block DI[127:0].

[0062] Each round sub-level CRX1-CRX14 performs one AES processing round and two SM4 processing rounds. Each round sub-level in CRX15 and CRX16 performs two SM4 processing rounds. Round sub-levels CRX1-CRX16 differ from round sub-levels CRM1-CRM16 in that they do not perform round key scheduling, but instead receive the corresponding round keys from the corresponding round sub-levels CRM1-CRM16. The additional processing pipeline receives the input data block DI[255:128] and key block KI, combined by the XOR operator XG20. This operation corresponds to the first "addition round key" of the AES cipher. During the first processing cycle, the data block DI[255:128] is also stored in register 21. During the first processing cycle, the output of the operator XG is also stored in register 23. The corresponding outputs of registers 21 and 23 are connected to round sub-level CRX1. Round sub-levels CRX1 through CRX13 are cascaded. The AES data block output of round-level CRX9 is also connected to register 24, the first register in the group of four cascaded registers 24-27. The AES data block output of round-level CRX13, along with the output of register 27, is connected to the corresponding input of multiplexer MX24. The output of multiplexer MX24 is connected to the AES data block input of round-level CRX14. The other outputs of round-level CRX13 are connected to the corresponding inputs of round-level CRX14. The AES data block output of round-level CRX14 is also connected to register 28, the first register in the group of two cascaded registers 28 and 29. The SM4 data output of round-level CRX14 is connected to the corresponding input of round-level CRX15, and the SM4 data output of round-level CRX15 is connected to the corresponding input of round-level CRX16. The output of register 29 and the SM4 data output of round-follower CRX16 are connected to the corresponding inputs of multiplexer MX25, which provides output data blocks DO [255:128] to the data output of hardware accelerator HPP1. Multiplexer MX24 is controlled by signal k256 to select the size of the AES key (128 or 256 bits). Multiplexer MX25 is controlled by signal as to select the cipher to be executed, either AES or SM4.

[0063] Stages CRX1-CRX9 execute the first 9 rounds of the AES cipher and the first 18 rounds of the SM4 cipher. If the AES cipher is chosen to execute 10 rounds, then the key block KI is a 128-bit block (signal as is set to "AES" and signal k256 is set to, for example, 0), and the AES data output of stage CRX9 is continuously stored in registers 24-27 and provided to stage CRX14 by multiplexer MX24. If the SM4 cipher is chosen (signal as is set to "SM4"), stages CRX10-CRX13 continuously execute an additional 8 rounds of the SM4 cipher. If the AES cipher is selected to execute 14 rounds, then the key block KI is a 256-bit block (signal as is set to "AES" and signal k256 is set to, for example, 1), and stages CRX10 through CRX13 execute an additional 4 rounds of the AES cipher. The AES data output of stage CRX13 is provided to stage CRX14 via multiplexer MX24. Depending on the values ​​defined by signals as and k256, stage CRX14 executes the final (10th or 14th) round of the AES cipher or the 28th round of the SM4 cipher. The AES output data block provided by stage CRX14 is stored consecutively in registers 28 and 29, while stages CRX15 and CRX16 execute the final 4 rounds of the SM4 cipher (rounds 29 through 32).

[0064] According to some embodiments, the hardware pipeline includes multiple additional processing pipelines comprising round-level CRX1-CRX16 to process multiple 128-bit data blocks simultaneously.

[0065] Figure 9 This is a block diagram illustrating an embodiment of the round-level CXR2-CXR13, CXRx. Round-level CXRx and round-level CRMx ( Figure 4The difference is that it does not include the SM4 and AES round key scheduling circuitry, and therefore it does not include two sets of four S-boxes SMB1, SMB2. Furthermore, circuits SATe and SATd only process 64-bit words. To perform all AES S-box operations, the round-level CXRx includes an AES affine circuit AAF, an AES inverse affine circuit AIA, two sets of four multiplication inverse circuits ASB1, ASB2, a 64-bit register 18, and multiplexers MX14 and MX15 controlled by the signal ed. Circuits AAF and AIA are provided to use the same AES S-box for encryption and decryption. Bits [127:64] of the SM4 input data block DIs and the AES input data block DIa are processed by the same processing circuitry as in the round-level CRMx. Bits [63:0] of the AES input data block DIa are divided into two 32-bit words, which are then transmitted to multiplexers MX14 and MX15 respectively. Bits [63:0] of the data block provided by circuit ISHR are transmitted to circuit AIA, and the 64-bit data block provided by circuit AIA is divided into two 32-bit words, which are transmitted to multiplexers MX14 and MX15 respectively. Words [31:0] provided by multiplexer MX14 are processed by inverse multiplication circuit ASB1, and words [63:31] provided by multiplexer MX15 are processed by inverse multiplication circuit ASB2. Each inverse multiplication circuit in groups ABS1 and ABS2 calculates the Galois field GF(2) in the AES field of the input byte. 8 The inverse multiplication is performed. The words provided by groups ASB1 and ASB2 of the inverse multiplication circuit are stored at bit positions [31:0] and [63:32] in register 18, respectively. The 64-bit word stored in register 18 is provided to circuit AAF and, together with the 64-bit output word of circuit SATd, forms a 128-bit data block provided to multiplexer MX13. The 64-bit word provided by circuit AAF, together with the 64-bit output word of circuit SATe, forms a 128-bit data block provided to circuit SHR.

[0066] Round-level CXR1 can be derived from round-level CXRx by removing circuit IMXC or adding multiplexer MX12, which selects the input data block DIA or the output of circuit IXMC based on signal rnd1 indicating whether the first round is currently running.

[0067] Round level CXR14 can be derived from round level CRMx by removing circuit MXC or adding an entry to multiplexer MX13 to select the output of circuit MXC or circuit SHR based on the signal Irnd indicating whether the last AES round is currently running.

[0068] By removing the SM4 round key scheduling circuit of CRMee, round-level CXR15 and CXR16 can be derived from round-level CRMee.

[0069] Figure 10 This is a block diagram illustrating one embodiment of a processing system PS that may include a hardware accelerator (HWA) or a hardware pipeline (HPP). The processing system PS may include: one or more processors (PRCs) such as a microprocessor or microcontroller; a data and address bus (ADB) coupled to the processors (PRC); a memory (MEM) coupled to the bus (ADB); one or more input / output circuits (IOCs); and one or more hardware accelerator circuits (CPs) that may include the hardware accelerators (HWAs) or the hardware pipeline (HPPs). The memory (MEM) may include: volatile memory, such as RAM-type (“random access memory”) memory containing volatile application data; non-volatile memory, such as EEPROM or flash memory containing non-volatile data and applications; and possibly read-only memory (or ROM memory) which may store the operating system of the processors (PRCs). The operating system may also be stored in non-volatile memory.

[0070] The communication interface circuit IOC may include any suitable type, number, and / or configuration of wired and / or wireless devices for transmitting information from the processing system PS to another processing or storage system (not shown) and / or receiving information from another processing or storage system (not shown). The communication device IOC may receive user input and parameters and store the user input and parameters in the memory M1.

[0071] Processing system PS, or hardware accelerator HWA or hardware pipeline HPP, can be integrated into an integrated circuit or system-on-a-chip (SoC).

[0072] Figure 11 This is a block diagram illustrating one embodiment of a processing system PS1 for processing or generating circuit components that may include a hardware accelerator HWA or a hardware pipeline HPP. The processing system PS1 includes one or more processors PR1, one or more memories M1, and one or more communication devices IO1. The processors PR1, memories M1, and communication devices IO1 communicate using wired and / or wireless connections B1 of any suitable type, number, and / or configuration.

[0073] Processor PR1 executes instructions of one or more process PRDs stored in memory M1 to process and / or generate a circuit component representation CCC in response to user input UIN and parameters PMS. The process PRD can be any suitable electronic design automation (EDA) tool or part thereof used to design, simulate, analyze, and / or verify electronic circuit systems and / or generate photomasks for electronic circuit systems. The CCC representation includes descriptions such as... Figures 2-6 The data shown includes all or part of the circuits HWA, HPP, CRM, CRM0-CRM16, CRMx, and CRMMy.

[0074] The memory M1 includes any suitable type, number, and / or configuration of non-transitory computer-readable storage medium containing stored procedures PRD, user input UIN, parameters PMS, and circuit components CCC.

[0075] Communication device IO1 may include any suitable type, quantity, and / or configuration of wired and / or wireless devices for transmitting information from processing system PS1 to another processing or storage system (not shown) and / or receiving information from another processing or storage system (not shown). For example, communication device IO1 may transmit circuit component CCC to another system. Communication device IO1 may receive process PRD, user input UIN, parameter PRD, and / or circuit component CCC, and store process PRD, user input UIN, parameter PMS, and / or circuit component CCC in memory M1.

[0076] The illustrations described herein are intended to provide a general understanding of the structure of various embodiments. These illustrations are not intended as a complete description of all elements and features of apparatuses, processors, and systems utilizing the structures or methods described herein. Many other embodiments, or combinations thereof, will be apparent to those skilled in the art upon review of this disclosure in combination with the disclosed embodiments. Other embodiments can be utilized and derived from this disclosure, allowing structural and logical substitutions and changes to be made without departing from the scope of this disclosure.

[0077] For example, Figure 1 The circuitry can be implemented separately to perform S-box operations for the SM4 cipher as well as for another symmetric block cipher using an 8×8 S-box, such as ARIA and Camellia. The affine transformations AST and SAT are then defined as functions of another symmetric block cipher combined with the SM4 cipher.

[0078] Figure 1 The circuit principle can be applied to another combination of symmetric block ciphers to be used in hardware accelerator circuits for implementing SM4 ciphers combined with another symmetric block cipher.

[0079] Furthermore, this disclosure and illustrations should be considered illustrative rather than restrictive, and the appended claims are intended to cover all such modifications, enhancements, and other embodiments falling within the true spirit and scope of this specification. Therefore, the scope of the following claims shall be determined by the broadest permissible interpretation of the claims and their equivalents, and should not be constrained or limited by the foregoing description.

Claims

1. A method for performing cryptographic operations, comprising: The cryptographic accelerator circuit selects whether to bypass the first affine transformation and the second affine transformation to process the first input data block according to the SM4 cipher, and uses the SM4 S-box table to generate a first part of the SM4 encrypted data block and a first SM4 replacement data block, the first SM4 replacement data block being provided to the adjacent SM4 round processing circuit. Based on the selection of not bypassing the first affine transformation, the cryptographic accelerator circuit performs the first affine transformation applied to the first input data block to obtain a first transformed data block, wherein the first affine transformation includes multiplication of the input data block with a first matrix and addition of a first translation vector. Based on the choice not to bypass the first affine transformation, the cryptographic accelerator circuit performs a first byte substitution (S-box) operation according to the SM4 cipher and using the SM4 S-box table. The SM4 S-box operation is applied to the first transformed data block to obtain a replaced data block. as well as Based on the choice not to bypass the first affine transformation, the cryptographic accelerator circuit performs a second affine transformation applied to the replacement data block to obtain a second transformed data block, wherein the second affine transformation includes multiplication of the replacement data block with a second matrix and addition of a second translation vector, and wherein the first matrix and the second matrix, as well as the first translation vector and the second translation vector, are defined such that the second transformed data block is equal to the first input data block processed by a second S-box operation using an S-box table according to another symmetric cipher.

2. The method of claim 1, wherein the second S-box operation is an Advanced Encryption Standard (AES) S-box operation.

3. The method according to claim 1, wherein: The first input data block includes multiple bytes. Performing the first affine transformation on the first input data block includes: applying the first affine transformation in parallel to each byte of the first input data block to generate bytes of the first transformed data block. Performing the SM4 S-box operation on the first transformed data block includes: applying the SM4 S-box operation in parallel to each byte of the first transformed data block using the corresponding SM4 S-box table to generate the bytes of the replacement data block, and Performing the second affine transformation on the replacement data block includes applying the second affine transformation in parallel to each byte of the replacement data block to generate bytes of the second transformed data block.

4. The method of claim 3, wherein the SM4 S-box table used by the cryptographic accelerator circuit to perform the SM4 S-box operation applied to the first transformed data block is an S-box table of two adjacent SM4 round circuits, each round circuit being configured to perform a round according to the SM4 cipher and to perform a round expansion operation of the SM4 round key according to the SM4 round key scheduling procedure.

5. The method of claim 1, wherein the cryptographic operation performed by the cryptographic accelerator circuit includes an encryption operation and a decryption operation, each operation being associated with a corresponding specific first affine transformation and second affine transformation.

6. The method according to claim 1, comprising: Based on the first affine transformation with selected bypass, the cryptographic accelerator circuit applies the first SM4 cryptographic operation to the second input data block to obtain the second part of the SM4 encrypted data block. Based on the selection to bypass the first affine transformation, the first affine transformation is bypassed by the cryptographic accelerator circuit; Based on the first affine transformation with selected bypass, the cryptographic accelerator circuit applies the SM4 S-box operation to the second part of the SM4 encrypted data block to obtain the second SM4 replacement data block; as well as Based on the selection to bypass the first affine transformation, the second affine transformation is bypassed by the cryptographic accelerator circuit, and the second SM4 replacement data block is supplied to the adjacent SM4 round processing circuit.

7. A cryptographic accelerator circuit, comprising: A first affine transformation circuit generates a first transformed data block from a first input data block based on a first selection, and is bypassed to generate a first portion of SM4 encrypted data block based on a second selection, wherein the first affine transformation circuit is configured to perform multiplication of the first input data block with a first matrix and addition of a first translation vector. An SM4 byte replacement (S-box) circuit performs a first S-box operation based on an SM4 cipher and using an SM4 S-box table. The SM4 S-box operation is applied to the first transformed data block to obtain a replaced data block. as well as A second affine transformation circuit, based on the first selection, generates a second transformed data block from the replacement data block, and based on the second selection, is bypassed to provide the first SM4 replacement data block to the adjacent SM4 round processing circuit, wherein the second affine transformation circuit is configured to perform multiplication of the replacement data block with a second matrix and addition of a second translation vector, and wherein the first affine transformation circuit and the second affine transformation circuit are configured such that the second transformed data block is equal to the first input data block processed by a second S-box operation using an S-box table according to another symmetric cipher.

8. The cryptographic accelerator circuit of claim 7, wherein the second S-box operation is an Advanced Encryption Standard (AES) S-box operation.

9. The cryptographic accelerator circuit according to claim 7 or 8, wherein: The first input data block includes multiple bytes. The first affine transformation circuit includes a plurality of first-byte affine transformation circuits, each first-byte affine transformation circuit being configured to apply the first affine transformation to a corresponding byte of the first input data block to generate bytes of the first transformed data block. The SM4 S-box circuitry includes multiple SM4 byte S-box circuits, each configured to apply SM4 byte S-box operations to the corresponding bytes of the first transformed data block using a corresponding SM4 byte S-box table to generate the bytes of the replacement data block. The second affine transformation circuit includes a plurality of second-byte affine transformation circuits, each second-byte affine transformation circuit being configured to apply the second affine transformation to the corresponding byte of the replacement data block to generate the bytes of the second transformed data block.

10. The cryptographic accelerator circuit of claim 9, comprising two adjacent SM4 round circuits, each SM4 round circuit being configured to perform a round using a first set of SM4 S-box tables according to an SM4 cipher, and to perform a round expansion of the SM4 round key using a second set of SM4 S-box tables according to an SM4 key scheduling procedure, wherein the first set of S-box tables and the second set of S-box tables of each adjacent SM4 round circuit are used to apply the SM4 S-box operation in parallel to each byte of the first transformed data block.

11. The cryptographic accelerator circuit according to claim 7, configured as follows: Based on the second selection, the first SM4 cryptographic operation is applied to the second input data block to obtain a second part of the SM4 encrypted data block; Based on the second choice, the first affine transformation is bypassed; Based on the second selection, the SM4 S-box operation is applied to the second portion of the SM4 encrypted data block to obtain the second SM4 replacement data block; as well as Based on the second selection, the second affine transformation is bypassed, and the second SM4 replacement data block is supplied to the adjacent SM4 round processing circuit.

12. The cryptographic accelerator circuit of claim 7, comprising a first processing pipeline, the first processing pipeline comprising a plurality of round stages, each round stage being configured to perform two SM4 rounds and two SM4 round key scheduling and one round of the other symmetric cipher in two clock cycles.

13. The cryptographic accelerator circuit of claim 12, wherein the round stage of the first processing pipeline is configured to process corresponding data blocks in parallel according to a selection signal that selects encryption or decryption and selects one of the first selection and the second selection.

14. The cryptographic accelerator circuit of claim 12, comprising a plurality of processing pipelines, each processing pipeline receiving a corresponding input data block to be processed using the same cryptographic key.

15. A computer-readable medium representing a storage circuit assembly, the circuit assembly comprising: A first affine transformation circuit generates a first transformed data block from a first input data block based on a first selection, and is bypassed to generate a first portion of SM4 encrypted data block based on a second selection, wherein the first affine transformation circuit is configured to perform multiplication of the first input data block with a first matrix and addition of a first translation vector. An SM4 replacement box (S-box) circuit performs a first byte replacement (S-box) operation based on an SM4 cipher and using an SM4 S-box table. The SM4 S-box operation is applied to the first transformed data block to obtain a replaced data block. as well as A second affine transformation circuit, based on the first selection, generates a second transformed data block from the replacement data block, and, based on the second selection, is bypassed to provide a first SM4 replacement data block to an adjacent SM4 round processing circuit, wherein the second affine transformation circuit is configured to perform a multiplication of the replacement data block with a second matrix and an addition of a second translation vector, and wherein the first affine transformation circuit and the second affine transformation circuit are configured such that the second transformed data block is equal to the first input data block processed by a second S-box operation using an S-box table according to another symmetric cipher.

16. The computer-readable medium of claim 15, wherein the second S-box operation is an Advanced Encryption Standard (AES) S-box operation.

17. The computer-readable medium of claim 15, wherein: The first input data block includes multiple bytes. The first affine transformation circuit includes a plurality of first-byte affine transformation circuits, each first-byte affine transformation circuit being configured to apply the first affine transformation to a corresponding byte of the first input data block to generate bytes of the first transformed data block. The SM4 S-box circuitry includes multiple SM4 byte S-box circuits, each configured to apply SM4 byte S-box operations to the corresponding bytes of the first transformed data block using a corresponding SM4 byte S-box table to generate the bytes of the replacement data block. The second affine transformation circuit includes a plurality of second-byte affine transformation circuits, each second-byte affine transformation circuit being configured to apply the second affine transformation to the corresponding byte of the replacement data block to generate the bytes of the second transformed data block.

18. The computer-readable medium of claim 17, wherein the circuitry further comprises two adjacent SM4 round circuits, each SM4 round circuit being configured to perform a round using a first set of SM4 S-box tables according to an SM4 cipher, and to perform a round expansion of the SM4 round key using a second set of SM4 S-box tables according to an SM4 key scheduling procedure, the first set of S-box tables and the second set of S-box tables of each adjacent SM4 round circuit being used to apply the SM4 S-box operation in parallel to each byte of the first transformed data block.

19. The computer-readable medium of claim 15, wherein the circuit component is further configured to: Based on the second selection, the first SM4 cryptographic operation is applied to the second input data block to obtain a second part of the SM4 encrypted data block; Based on the second choice, the first affine transformation is bypassed; Based on the second selection, the SM4 S-box operation is applied to the second portion of the SM4 encrypted data block to obtain the second SM4 replacement data block; as well as Based on the second selection, the second affine transformation is bypassed, and the second SM4 replacement data block is supplied to the adjacent SM4 round processing circuit.

20. The computer-readable medium of claim 15, wherein the circuit component includes a first processing pipeline, the first processing pipeline including a plurality of round stages, each round stage being configured to perform two SM4 rounds and two SM4 round key scheduling and one round of the other symmetric cipher in two clock cycles.

Images