AES encryption and decryption apparatus and method
By gradually generating and replacing round keys, the high resource consumption problem of traditional AES encryption and decryption devices is solved, and a resource-optimized AES encryption and decryption process is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- GUANGZHOU ON BRIGHT ELECTRONICS
- Filing Date
- 2023-04-19
- Publication Date
- 2026-05-29
AI Technical Summary
Traditional AES encryption and decryption devices require a large amount of storage and retrieval of round keys during hardware implementation, consuming a significant amount of resources.
The method of generating and replacing round keys in stages is adopted. The key expansion module and the reverse key expansion module generate and replace the round keys during the encryption and decryption processes, respectively, thus avoiding the need to store multiple round keys at the same time.
This effectively reduces the resources required for storing and retrieving round keys, optimizing the resource utilization of hardware devices.
Smart Images
Figure CN116684067B_ABST
Abstract
Description
Technical Field
[0001] This application generally relates to data encryption and decryption, and more specifically to an Advanced Encryption Standard (AES) encryption and decryption apparatus and method. Background Technology
[0002] AES is an Advanced Encryption Standard (AES) in cryptography, a block cipher standard adopted by the U.S. federal government. After years of promotion and development, the AES AES standard was published by the National Institute of Standards and Technology (NIST) on November 26, 2001, in Federal Information Processing Standards Publication 197, and became an effective standard on May 26, 2002. AES was used to replace the previous Data Encryption Standard (DES) and is characterized by its complex keys and high difficulty in cracking. AES is currently one of the most popular algorithms for symmetric-key encryption.
[0003] When using AES for encryption and decryption, multiple round keys are generated based on a seed key (e.g., a 128-bit or 256-bit seed key) using a key expansion algorithm. Traditional AES encryption and decryption devices need to store multiple 128-bit or 256-bit round keys so that these round keys can be read for encryption and decryption operations in subsequent processes.
[0004] In the hardware implementation process, storing and retrieving a large number of round keys places high demands on the hardware devices, and may consume more resources than implementing the encryption and decryption algorithms themselves. Summary of the Invention
[0005] In view of the above-mentioned problems, this application provides a new AES encryption and decryption device and method, which can reduce the resources occupied by storing and reading round keys while effectively implementing the AES encryption and decryption process.
[0006] According to one aspect of this application, an AES encryption device is provided for performing multi-round encryption on plaintext information to be encrypted. The AES encryption device includes a key expansion module and an encryption module. For the first round of encryption in the multi-round encryption: the key expansion module is configured to provide an encryption seed key to the encryption module and store the encryption seed key as the encryption round key for the first round; the encryption module is configured to perform the first round of encryption on the plaintext information based on the encryption seed key. For each current round of encryption from the second round to the final round of encryption in the multi-round encryption: the key expansion module is configured to expand the key based on the encryption round key of the previous round to generate the encryption round key for the current round, provide the encryption round key for the current round to the encryption module, and store the encryption round key for the current round to replace the encryption round key of the previous round; the encryption module is configured to perform the current round of encryption on the plaintext information encrypted in the previous round based on the encryption round key for the current round.
[0007] According to another aspect of this application, an AES decryption apparatus is provided for decrypting encrypted information obtained through multiple rounds of encryption in multiple rounds. The AES decryption apparatus includes a reverse key expansion module and a decryption module. For the first round of decryption in the multiple rounds: the reverse key expansion module is configured to provide a decryption seed key to the decryption module and store the decryption seed key as the decryption round key for the first round; the decryption module is configured to perform the first round of decryption on the encrypted information based on the decryption seed key. For each current round of decryption from the second round to the final round in the multiple rounds: the reverse key expansion module is configured to perform reverse key expansion based on the decryption round key of the previous round to generate the decryption round key for the current round, provide the current round decryption round key to the decryption module, and store the current round decryption round key to replace the previous round decryption round key; the decryption module is configured to perform the current round of decryption on the encrypted information decrypted in the previous round based on the current round decryption round key.
[0008] According to another aspect of this application, an AES encryption / decryption device is provided, comprising the aforementioned AES encryption device and the aforementioned AES decryption device, wherein a key expansion module is coupled to a reverse key expansion module and is configured to provide the generated final round encryption key to the AES decryption device as a decryption seed key for the AES decryption device.
[0009] According to another aspect of this application, an AES encryption method is provided for performing multiple rounds of encryption on plaintext information to be encrypted to obtain encrypted information. The AES encryption method includes: for the first round of encryption in the multiple rounds of encryption: a key expansion module provides an encryption seed key to an encryption module and stores the encryption seed key as the encryption round key for the first round, and the encryption module performs the first round of encryption on the plaintext information based on the encryption seed key; and for each current round of encryption from the second round to the last round of encryption in the multiple rounds of encryption: a key expansion module performs key expansion based on the encryption round key of the previous round to generate the encryption round key for the current round, provides the encryption round key for the current round to the encryption module, stores the encryption round key for the current round to replace the encryption round key of the previous round, and the encryption module performs the current round of encryption on the plaintext information encrypted in the previous round based on the encryption round key for the current round.
[0010] According to another aspect of this application, an AES decryption method is provided for decrypting encrypted information obtained through multiple rounds of encryption in multiple rounds. The AES decryption method includes: for the first round of decryption in multiple rounds: a reverse key expansion module provides a decryption seed key to a decryption module and stores the decryption seed key as the decryption round key for the first round; the decryption module performs the first round of decryption on the encrypted information based on the decryption seed key; and for each current round of decryption from the second round to the last round of decryption in multiple rounds: a reverse key expansion module performs reverse key expansion based on the decryption round key of the previous round to generate a decryption round key for the current round, provides the current round decryption round key to the decryption module, and stores the current round decryption round key to replace the previous round decryption round key; the decryption module performs the current round of decryption on the encrypted information decrypted in the previous round based on the current round decryption round key. Attached Figure Description
[0011] This application can be better understood from the following description of specific embodiments in conjunction with the accompanying drawings, wherein:
[0012] Figure 1 A schematic block diagram of a conventional AES encryption / decryption device is shown.
[0013] Figure 2 A schematic block diagram of the traditional AES encryption and decryption process is shown;
[0014] Figure 3a A schematic block diagram of an AES encryption device according to an embodiment of this application is shown;
[0015] Figure 3b A schematic block diagram of an AES decryption apparatus according to an embodiment of this application is shown.
[0016] Figure 4 A schematic block diagram of an AES encryption / decryption apparatus according to an embodiment of this application is shown;
[0017] Figure 5 A schematic flowchart illustrating the AES encryption process according to an embodiment of this application is shown; and
[0018] Figure 6 A schematic flowchart of the AES decryption process according to an embodiment of this application is shown. Detailed Implementation
[0019] The features and exemplary embodiments of various aspects of this application will now be described in detail. Numerous specific details are set forth in the following detailed description to provide a comprehensive understanding of this application. However, it will be apparent to those skilled in the art that this application can be implemented without requiring some of these specific details. The following description of embodiments is merely intended to provide a better understanding of this application by illustrating examples. This application is by no means limited to any specific configuration presented below, but covers any modifications, substitutions, and improvements to elements, components, and algorithms without departing from the spirit of this application. Well-known structures and techniques are not shown in the accompanying drawings and the following description in order to avoid unnecessary obfuscation of this application.
[0020] Figure 1 A schematic block diagram of a traditional AES encryption / decryption device is shown. Figure 1 As shown, the AES encryption / decryption device includes a key expansion module, a key storage module, an encryption module, and a decryption module. This AES encryption / decryption device can perform multiple rounds of encryption on plaintext information to obtain encrypted information, and conversely, perform multiple rounds of decryption on the encrypted information to obtain plaintext information.
[0021] In this AES encryption and decryption device, the key expansion module is configured to generate the round keys Key[N] required for each round of encryption and decryption based on the seed key Key[0] through the key expansion algorithm. The key storage module is configured to store these round keys. The encryption module is configured to read the round keys in the key storage module in the forward direction and perform multiple rounds of encryption on the plaintext information based on these round keys to generate encrypted information. The decryption module is configured to read the round keys in the key storage module in the reverse direction and perform multiple rounds of decryption on the encrypted information based on these round keys to obtain the original plaintext information.
[0022] The following example uses a 128-bit seed key Key[0] and refers to... Figure 1 and Figure 2 A detailed description of the traditional AES encryption and decryption process.
[0023] First, the key expansion module expands the seed key Key[0] using a key expansion algorithm to generate 11 round keys Key[0] to Key
[10] . The key expansion algorithm may include, for example, the following three steps (a), (b) and (c).
[0024] (a) Divide the 128-bit seed key Key[0] into four 32-bit subkeys W0, W1, W2, and W3, where W0 is the high 32 bits of Key[0] and W3 is the low 32 bits of Key[0].
[0025] (b) Using the formula below, calculate the subkeys W4, W5, W6...W43 representing the round keys Key[1] to Key
[10] in sequence using W0, W1, W2, and W3, where each round key Key[N] is composed of four subkeys Wi.
[0026]
[0027] In this formula, ω i This indicates that the subkey Wi, SubWord, and Rotword are fixed functions in the AES protocol, Rcon is a constant array in the AES protocol, and N... k This represents the seed key length in 32-bit words, and ∧ indicates a bitwise XOR operation. Since the seed key in this example is 128 bits, N... k It is set to 4.
[0028] (c) Using the generated subkeys W4, W5, W6...W43, combine them to generate round keys Key[1] to Key
[10] , as shown in the following formula, where W4*i is the high 32 bits of Key[i] and W4*i+3 is the low 32 bits of Key[i].
[0029] Key[i]={ω 4*i ω 4*i+1 ω 4*i+2 ω 4*i+3 i = 1, 2...10
[0030] Then, all round keys (including seed keys) Key[0] to Key
[10] generated by the key expansion module are stored in a fixed storage space (i.e., the key storage module).
[0031] Next, as Figure 2As shown, the encryption module and decryption module can perform 11 rounds of encryption and decryption based on the round keys of each round. Specifically, the encryption module reads the required round key Key[N] from the key storage module for each round, and performs encryption for the current round based on the round key, until 11 rounds of encryption are completed, after which encrypted information is generated and output. Among them, the encryption module uses Key[0] for the first round of encryption and Key
[10] for the last round of encryption. Conversely, the decryption module reads the required round key Key[N] from the key storage module for each round, and performs decryption for the current round based on the round key, until 11 rounds of decryption are completed, after which plaintext information is generated and output. Among them, the decryption module uses Key
[10] for the first round of decryption and Key[0] for the last round of decryption.
[0032] As can be seen from the above description, traditional AES encryption and decryption devices and processes require a large amount of storage space to store multiple round keys needed for multiple rounds of encryption. At the same time, storing these round keys will consume a lot of resources and place high demands on hardware devices.
[0033] According to embodiments of this application, a novel AES encryption and decryption device is proposed, which can achieve similar multi-round AES encryption and decryption, while avoiding the simultaneous storage of multiple round keys.
[0034] Figure 3a and Figure 3b Schematic block diagrams of an AES encryption device and an AES decryption device according to embodiments of this application are shown respectively. Figure 3a As shown, according to one embodiment of this application, an AES encryption device can be used to perform multi-round encryption on plaintext information to be encrypted. The AES encryption device may include a key expansion module and an encryption module. It should be noted that in this embodiment, the key expansion module also generates round keys Key[N] required for each round of encryption based on the seed key Key[0] using a key expansion algorithm. However, these round keys are generated sequentially by round and do not need to be stored simultaneously. Therefore, the AES encryption device according to this embodiment does not require a dedicated key storage module to store a large amount of round key data. The following is a combination of... Figure 5 The exemplary encryption process shown illustrates the operation of the AES encryption device according to embodiments of this application.
[0035] exist Figure 5 In the example encryption process shown, assuming that the seed key Key[0] is a 128-bit key, the encryption module needs to perform 11 rounds of encryption on the plaintext information to be encrypted, that is, from the first round (N=0) to the 11th round (N=10).
[0036] like Figure 5 As shown, for the first round of encryption (N=0) in a multi-round encryption (e.g., 11 rounds of encryption): the key expansion module can provide the encryption seed key to the encryption module and store the encryption seed key as the encryption round key for the first round. The encryption module can then perform the first round of encryption on the plaintext information based on the encryption seed key. Then, for each current round of encryption in the multi-round encryption from the second round (N=1) to the last round (N=10): the key expansion module can expand the key based on the encryption round key of the previous round to generate the encryption round key for the current round. This current round encryption round key is provided to the encryption module and stored to replace the encryption round key of the previous round. The encryption module can then perform the current round of encryption on the plaintext information encrypted in the previous round based on the current round encryption round key. After the encryption module has performed a total of 11 rounds of encryption, the encryption process ends, and the encryption module can output the obtained encrypted information.
[0037] In the above encryption process, the key expansion module can use the key expansion algorithm described above for the traditional AES encryption and decryption process to expand the key and generate the encryption round key for each round. Of course, the key expansion algorithm described above is only an exemplary key expansion algorithm, and those skilled in the art can use any other suitable key expansion algorithm to generate the round key for each round. This application does not impose any specific limitations in this regard.
[0038] Furthermore, in the above encryption process, it is not necessary to generate and store all round keys based on the seed key. Instead, before each round of encryption, the key expansion module generates the current round key based on the previous round key using a key expansion algorithm, and stores the current round key to replace the previous round key. This avoids occupying too much storage space due to storing multiple round keys at the same time.
[0039] Corresponding to the AES encryption device and AES encryption process described above, Figure 3b An AES decryption apparatus according to an embodiment of this application is shown, and Figure 6 The AES decryption process according to an embodiment of this application is illustrated. The following will be combined with... Figure 3b and Figure 6 This application describes an AES decryption apparatus and an AES decryption process according to embodiments thereof.
[0040] like Figure 3bAs shown, an AES decryption apparatus according to an embodiment of this application is used to decrypt encrypted information obtained through multiple rounds of encryption. The AES decryption apparatus includes a reverse key expansion module and a decryption module. It should be noted that, unlike traditional AES encryption and decryption apparatuses, the AES decryption apparatus according to this application may include a reverse key expansion module, used to perform reverse key expansion based on the encryption round key (also referred to herein as the decryption seed key) generated by the key expansion module through a reverse key expansion algorithm to generate decryption round keys for each round. The reverse key expansion algorithm used by this reverse key expansion module can correspond to the key expansion algorithm described above. The reverse key expansion algorithm will still be described below using a 128-bit seed key as an example.
[0041] The above references Figure 3a and Figure 5 In the described AES encryption device and encryption process, the key expansion module generates encryption round keys for each round based on the seed key Key[0], until the encryption round key Key
[10] for the last round is generated. This encryption round key Key
[10] can be used as the decryption seed key for the reverse key expansion module, enabling the reverse key expansion module to generate decryption round keys for each round based on this decryption seed key using a reverse key expansion algorithm. The reverse key expansion algorithm here can correspond to the key expansion algorithm described above. Specifically, the reverse key expansion algorithm can include, for example, the following three steps (a), (b), and (c).
[0042] (a) Divide the 128-bit decryption seed key Key
[10] into four 32-bit subkeys W40, W41, W42 and W43, where W40 is the high 32 bits of Key
[10] and W43 is the low 32 bits of Key
[10] .
[0043] (b) According to the following formula, the subkeys W39, W38, W37……W3, W2, W1, W0 representing the round keys Key[9] to Key[0] can be calculated sequentially using W40, W41, W42, W43, where each round key Key[N] is composed of four subkeys Wi.
[0044]
[0045] In this formula, ω i This indicates that the subkey Wi, SubWord, and Rotword are fixed functions in the AES protocol, Rcon is a constant array in the AES protocol, and N... k This represents the seed key length in 32-bit words, and ∧ indicates a bitwise XOR operation. Since the seed key in this example is 128 bits, N... kIt is set to 4.
[0046] (c) Using the generated subkeys W39, W38, W37……W3, W2, W1, W0, combine them to generate round keys Key[9] to Key[0], as shown in the following formula, where W4*i is the high 32 bits of Key[i] and W4*i+3 is the low 32 bits of Key[i].
[0047] Key[i]={ω 4*i ω 4*i+1 ω 4*i+2 ω 4*i+3}i=9,8...0
[0048] It is important to note that the reverse key expansion algorithm is not limited to the one described above. When the key expansion algorithm used in the encryption process changes, the reverse key expansion algorithm here will also change accordingly.
[0049] The following is combined Figure 6 The exemplary decryption process shown illustrates the operation of the AES decryption apparatus according to embodiments of this application. Figure 6 In the example decryption process shown, it is assumed that the decryption seed key Key
[10] is a 128-bit key. This decryption seed key can be the encryption round key of the last round received by the reverse key expansion module from the key expansion module in the AES encryption device. The decryption module needs to decrypt the encrypted information for 11 rounds, that is, from the first round (N=0) to the 11th round (N=10).
[0050] like Figure 6 As shown, for the first round of decryption in a multi-round decryption (N=0): the reverse key expansion module can provide the decryption seed key to the decryption module and store the decryption seed key as the decryption round key for the first round. The decryption module can then perform the first round of decryption based on the decryption seed key. For each current round of decryption from the second round to the final round in the multi-round decryption: the reverse key expansion module can perform reverse key expansion based on the decryption round key of the previous round to generate the decryption round key for the current round. This current round decryption round key is then provided to the decryption module and stored to replace the decryption round key of the previous round. The decryption module can then perform the current round of decryption based on the current round decryption round key to decrypt the encrypted information after the previous round. After the decryption module has performed a total of 11 rounds of decryption, the decryption process ends, and the decryption module can output the obtained plaintext information.
[0051] Similar to the encryption process according to this application, in the above decryption process, it is not necessary to generate and store all round keys based on the seed key. Instead, before each round of decryption, the reverse key expansion module generates the round key for the current round based on the round key of the previous round using the reverse key expansion algorithm, and stores the round key for the current round to replace the round key of the previous round. This avoids occupying too much storage space due to storing multiple round keys at the same time.
[0052] As described above, the AES encryption device and AES decryption device according to the embodiments of this application can exist as separate devices. However, according to some embodiments of this application, an AES encryption and decryption device can be provided, including an AES encryption device and an AES decryption device coupled to each other. Specifically, the key expansion module in the AES encryption device can be coupled to the reverse key expansion module in the AES decryption device, and the generated encryption round key (e.g., Key
[10] ) of the last round is provided to the AES decryption device as the decryption seed key of the AES decryption device.
[0053] Figure 4 A schematic block diagram of an AES encryption / decryption apparatus according to an embodiment of this application is shown. In this AES encryption / decryption apparatus, the operation of the key expansion module, encryption module, reverse key expansion module, and decryption module is the same as the operation of the corresponding modules in the aforementioned AES encryption and decryption apparatuses, and therefore will not be repeated here.
[0054] By using the AES encryption and decryption apparatus and process according to this application, excessive storage space can be avoided due to the simultaneous storage of round keys for multiple rounds, thereby reducing the resources occupied by storing and reading round keys while effectively implementing the AES encryption and decryption process.
[0055] The foregoing text has mentioned "embodiments," "an embodiment," and "some embodiments." It should be understood that the features mentioned in each embodiment are not necessarily applicable only to that embodiment, but may be used in other embodiments. A feature in one embodiment may be applied to another embodiment, or may be included in another embodiment.
[0056] Furthermore, various operations or steps are described as multiple discrete operations in a manner most conducive to understanding the illustrative embodiments; however, the order of description should not be construed as implying that these operations or steps must depend on the order. In particular, these operations or steps do not need to be performed in the order presented.
[0057] This application may be implemented in other specific forms without departing from its spirit and essential characteristics. For example, features described in a particular embodiment may be modified without departing from the basic spirit of this application. Therefore, the present embodiments are to be regarded as exemplary rather than limiting in all respects, and the scope of this application is defined by the appended claims rather than the foregoing description, and all changes falling within the meaning and scope of the claims and their equivalents are thus included within the scope of this application.
Claims
1. An Advanced Encryption Standard (AES) encryption device for performing multi-round encryption on plaintext information to be encrypted, the AES encryption device comprising a key expansion module and an encryption module, wherein, For the first round of encryption in the multi-round encryption: The key expansion module is configured to provide the encryption seed key to the encryption module and store the encryption seed key as the encryption round key for the first round. The encryption module is configured to perform the first round of encryption on the plaintext information based on the encryption seed key; as well as For each current round of encryption in the multi-round encryption from the second round to the last round: The key expansion module is configured to expand the key based on the encryption round key of the previous round to generate the encryption round key for the current round, provide the encryption round key for the current round to the encryption module, and store the encryption round key for the current round to replace the encryption round key of the previous round. The encryption module is configured to encrypt the plaintext information that has been encrypted in the previous round based on the encryption round key of the current round.
2. The AES encryption device according to claim 1, wherein, The AES encryption device is coupled to the corresponding AES decryption device, and the key expansion module is configured to provide the generated final round encryption key to the AES decryption device as the decryption seed key for the AES decryption device.
3. An Advanced Encryption Standard (AES) decryption device for decrypting encrypted information obtained through multiple rounds of encryption, the AES decryption device comprising a reverse key expansion module and a decryption module, wherein, For the first round of decryption in the multi-round decryption: The reverse key expansion module is configured to provide a decryption seed key to the decryption module and store the decryption seed key as the decryption round key for the first round. The decryption module is configured to perform the first round of decryption on the encrypted information based on the decryption seed key; as well as For each current round of decryption in the multi-round decryption from the second round to the last round: The reverse key expansion module is configured to perform reverse key expansion based on the decryption round key of the previous round to generate the decryption round key of the current round, provide the current round decryption round key to the decryption module, and store the current round decryption round key to replace the previous round decryption round key. The decryption module is configured to decrypt the encrypted information that was decrypted in the previous round based on the decryption round key of the current round.
4. The AES decryption device according to claim 3, wherein, The AES decryption device is coupled to a corresponding AES encryption device, which includes a key expansion module and an encryption module to generate the encrypted information obtained through multiple rounds of encryption. The reverse key expansion module is coupled to the key expansion module and receives the encryption round key of the last round generated by the key expansion module, which is used as the decryption seed key.
5. An Advanced Encryption Standard (AES) encryption / decryption device, comprising the AES encryption device according to claim 1 and the AES decryption device according to claim 3, wherein, The key expansion module is coupled to the reverse key expansion module and is configured to provide the generated final round encryption key to the AES decryption device as the decryption seed key of the AES decryption device.
6. An Advanced Encryption Standard (AES) encryption method for performing multiple rounds of encryption on plaintext information to be encrypted to obtain encrypted information, the AES encryption method comprising: For the first round of encryption in the multi-round encryption: The key expansion module provides the encryption seed key to the encryption module and stores the encryption seed key as the encryption round key for the first round. The encryption module performs the first round of encryption on the plaintext information based on the encryption seed key; as well as For each current round of encryption in the multi-round encryption from the second round to the last round: The key expansion module expands the key based on the encryption round key of the previous round to generate the encryption round key for the current round. This current round encryption round key is then provided to the encryption module, and stored to replace the encryption round key of the previous round. The encryption module encrypts the plaintext information that was encrypted in the previous round based on the encryption round key of the current round.
7. The AES encryption method according to claim 6 further includes: The key expansion module provides the generated final round encryption key to the AES decryption device configured to decrypt the encrypted information, so as to serve as the decryption seed key for the AES decryption device.
8. An Advanced Encryption Standard (AES) decryption method for performing multiple rounds of decryption on encrypted information obtained through multiple rounds of encryption, the AES decryption method comprising: For the first round of decryption in the multi-round decryption: The reverse key expansion module provides the decryption seed key to the decryption module and stores the decryption seed key as the decryption round key for the first round. The decryption module performs the first round of decryption on the encrypted information based on the decryption seed key; as well as For each current round of decryption in the multi-round decryption from the second round to the last round: The reverse key expansion module performs reverse key expansion based on the decryption round key of the previous round to generate the decryption round key for the current round. This current round decryption round key is then provided to the decryption module, and stored to replace the decryption round key of the previous round. The decryption module decrypts the encrypted information that was decrypted in the previous round based on the decryption round key of the current round.
9. The AES decryption method according to claim 8, wherein the decryption seed key is the final round encryption key generated by the key expansion module in the AES encryption device configured to generate the encrypted information.