Encryption method and device based on mds matrix construction in block cipher design

Abstract

The application discloses an encryption method and system based on MDS matrix construction in a block cipher design, and the method comprises the following steps: searching all maximum distance separable matrices with minimum depth realization on a given finite field by using an exhaustive search algorithm to obtain a candidate matrix set; processing the candidate matrix set to find a maximum distance separable matrix with optimal realization; and performing encryption processing on an input message based on the maximum distance separable matrix with optimal realization. The matrix obtained by using the construction method of the application can overcome the defects of the existing MDS matrix, such as high implementation cost, poor adaptability to lightweight cryptographic algorithms and the like, and improve the security and high efficiency in the cryptographic design.

Description

Technical Field

[0001] This invention belongs to the field of block cipher design technology, and specifically relates to an encryption method and apparatus based on the construction of MDS matrix in block cipher design. Background Technology

[0002] The statements in this section merely refer to the background art related to this invention and do not necessarily constitute prior art.

[0003] With societal development, internet network security faces significant challenges, making information security and confidentiality technologies particularly crucial. Modern cryptographic systems can be categorized into symmetric and asymmetric cryptography. Symmetric cryptography includes three branches: block ciphers, stream ciphers, and message authentication codes. Among these, block ciphers are characterized by their fast encryption speed, ease of standardization, and suitability for hardware and software implementation, making them the core cryptographic algorithms for message recognition, authentication, and data encryption. They have wide applications in the field of information security.

[0004] To better adapt to societal development, cryptographers proposed lightweight block ciphers. Compared to traditional block ciphers, lightweight block ciphers focus more on improving encryption efficiency, reducing computational resources, and providing encryption functionality on resource-constrained devices with limited storage space and computing power.

[0005] The diffusion principle is an important principle in the security design of block ciphers. The study of linear layers has been a focus of research in recent years. A well-designed linear layer can not only provide the best diffusion effect, but also improve the application efficiency of the algorithm.

[0006] Linear layers play a crucial role in symmetric-key cryptography, providing resistance to differential and linear cryptanalysis. A matrix with optimal diffusion properties is called a maximum distance-separable (MDS) matrix. A typical application is for mixed column operations in AES. Furthermore, MDS matrices are widely used in various other cryptographic applications, including hash functions (Maelstrom, PHOTON) and stream ciphers (MUGI).

[0007] However, finding lightweight MDS matrices is a very challenging task, and using MDS matrices in resource-constrained devices may be too extravagant. In such cases, designers often use approximate MDS matrices, leveraging linear operations implemented through multiple bit-by-bit XORs, or even bit-level permutations through appropriate wiring. Nevertheless, these design strategies often lead to an increase in the number of rounds and complicate security analysis. Therefore, constructing lightweight MDS matrices is an important task. It is worth noting that pursuing lightweight integrative MDS matrices is even more meaningful because the same circuitry can be reused when the inverse matrix is ​​needed.

[0008] Latency, as an important criterion, is receiving increasing attention in the design of cryptographic primitives. Many applications require low latency, including automotive, robotics, and mission-critical computing applications. It affects encryption / decryption throughput and plays a crucial role in low-energy considerations for cryptography. At CHES 2021, Leander et al. proposed a novel fast cryptography that explores a low-latency architecture. Typically, the depth of a circuit can be used as an approximation of latency. Depth is the critical path length of the circuit. Low-latency optimization of linear layers is represented as a shortest linear programming problem (SLPD) with minimum depth.

[0009] Most previous work has focused on constructing matrices with efficiently implementable terms, i.e., local optimization. However, since efficiently implementable terms do not guarantee that the entire matrix is ​​optimal in the implementation process, this construction method may miss lighter matrices. Summary of the Invention

[0010] To address the shortcomings of existing technologies, this invention provides an encryption method and system based on the construction of MDS matrices in block cipher design; it utilizes the latest low-latency matrix global optimization tools to construct a low-latency inductive MDS matrix that currently has the lowest implementation cost.

[0011] On the one hand, it provides an encryption method based on the construction of the MDS matrix in block cipher design;

[0012] Encryption methods based on the construction of the MDS matrix in block cipher design include:

[0013] An exhaustive search algorithm is used to search for all maximum distance separable matrices with minimum depth realization over a given finite field, thus obtaining a set of candidate matrices.

[0014] The candidate matrix set is processed to find the maximum distance separable matrix with optimal implementation;

[0015] The input message is encrypted based on the maximum distance separable matrix with optimal implementation.

[0016] On the other hand, it provides an encryption system based on the construction of the MDS matrix in block cipher design;

[0017] Encryption systems based on the MDS matrix construction in block cipher design include:

[0018] The search module is configured to use an exhaustive search algorithm to search for all maximum distance separable matrices with minimum depth realization over a given finite field, thereby obtaining a set of candidate matrices.

[0019] The search module is configured to process the set of candidate matrices and find the maximum distance separable matrix with optimal implementation.

[0020] The encryption module is configured to encrypt the input message based on the maximum distance separable matrix with optimal implementation.

[0021] Furthermore, an electronic device is also provided, including:

[0022] Memory, used for non-transitory storage of computer-readable instructions; and

[0023] Processor, for executing the computer-readable instructions,

[0024] When the computer-readable instructions are executed by the processor, they perform the method described in the first aspect above.

[0025] In another aspect, a storage medium is also provided for non-transitory storage of computer-readable instructions, wherein when the non-transitory computer-readable instructions are executed by a computer, the instructions of the method described in the first aspect are executed.

[0026] In another aspect, a computer program product is also provided, including a computer program that, when run on one or more processors, is used to implement the method described in the first aspect above.

[0027] One of the above technical solutions has the following advantages or beneficial effects:

[0028] The matrix constructed using the method of this invention overcomes the shortcomings of existing MDS matrices, such as high implementation cost and poor adaptability to lightweight cryptographic algorithms, thereby improving security and efficiency in cryptographic design. This invention introduces a novel method for constructing lightweight, low-latency inductive MDS matrices. First, an efficient search algorithm for inductive MDS matrices that can be implemented at optimal circuit depth is proposed. Through this method, this invention can obtain… This invention finds all 4×4 involutional MDS matrices. To find a lightweight matrix, a three-layer processing framework is designed, enabling the invention to find the minimum-cost involutional MDS matrix among all 16×16 binary matrices, requiring only 42 XOR gates. The construction method provided by this invention balances search space and processing efficiency through exhaustive search and layered processing. The low-latency involutional MDS matrix constructed using this invention not only ensures low hardware cost in cryptographic applications but also maintains security. The designed block cipher can be used for data encryption and decryption, thus demonstrating practical significance and strong application prospects for the design of lightweight block cipher algorithms. Attached Figure Description

[0029] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0030] Figure 1 This is a schematic diagram illustrating the principle of the matrix search algorithm in Example 1;

[0031] Figure 2 Here is a flowchart of the matrix construction method in Example 1;

[0032] Figure 3 This is a schematic diagram of the three-layer processing framework for the candidate matrix in Example 1. Detailed Implementation

[0033] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0034] Technical terms explained: Low latency: This requires the circuit to be implemented with a minimum required depth. Involution: The inverse of a matrix is ​​itself.

[0035] The maximum distance separable (MDS) matrix is ​​a linear layer component. In many block cipher designs, the diffusion effect is achieved by inputting the MDS matrix (i.e., multiplying the MDS matrix, matrix multiplication). It is itself only a component of encryption and decryption.

[0036] In recent years, many global optimization tools have been proposed and proven to outperform local optimization methods that implement the entire matrix in most cases. Regarding global optimization methods for low-latency matrix implementations, two heuristics are currently the most effective: forward search and backward search. Previous work on MDS matrix construction lacked attention to low-latency scenarios. However, with the increasing number of algorithms proposed that can explore better matrix implementations in low-latency scenarios, this provides an efficient tool for constructing and discovering low-latency MDS matrices in this invention.

[0037] Example 1

[0038] like Figure 1 As shown, this embodiment provides an encryption method based on the construction of the MDS matrix in block cipher design;

[0039] Encryption methods based on the construction of the MDS matrix in block cipher design include:

[0040] S101: Use an exhaustive search algorithm to search for all maximum distance separable matrices with minimum depth realization over a given finite field to obtain a set of candidate matrices;

[0041] S102: Process the candidate matrix set to find the maximum distance separable matrix with optimal realization;

[0042] S103: Encrypt the input message based on the maximum distance separable matrix with optimal implementation.

[0043] Furthermore, an exhaustive search algorithm is used to search... All 4×4 integrative MDS matrices with minimum depth.

[0044] Furthermore, S101: Using an exhaustive search algorithm, search for all maximum distance separable matrices with minimum depth realization over a given finite field, obtaining a candidate matrix set, including:

[0045] S101-1: For each item in the first and second rows of the initial 4×4 matrix, iterate through each element in the domain;

[0046] S101-2: Based on the involution property, find the other 8 terms of the initial 4×4 matrix to obtain the complete 4×4 matrix;

[0047] S101-3: Check if the complete 4×4 matrix satisfies the property of the maximum distance separable matrix. If yes, proceed to S101-4; otherwise, return to S101-1.

[0048] S101-4: Check if the complete 4×4 matrix satisfies the involution property. If yes, proceed to S101-5; otherwise, return to S101-1.

[0049] S101-5: Check if a complete 4×4 matrix can be implemented at the optimal depth. If yes, proceed to S101-6; otherwise, return to S101-1.

[0050] S101-6: Store the complete 4×4 matrix into the candidate matrix set.

[0051] Further, S101-1: traversing each element in the domain for each item in the first and second rows of the 4×4 matrix, specifically includes:

[0052] For a 4×4 matrix:

[0053]

[0054] Among them, A i (0≤i≤4) is a finite field A 2×2 matrix over a finite field The items A1 and A2 in the table are iterated through in a loop.

[0055] It should be understood that It is a 2 m A finite field of n elements. (By...) The finite field defined by the irreducible polynomial p(x) of degree m. It can be represented as Each term of the 4×4 matrix constructed in this example can be derived from the irreducible polynomial x. 4 +x+1 defined The elements on the table are represented.

[0056] It is a 2 4 A finite field with n elements. (Finite field) Depend on The definition of an irreducible polynomial p(x) of degree m can be expressed as:

[0057] Further, S101-2: Based on the involution property, the other 8 terms of the initial 4×4 matrix are obtained to obtain the complete 4×4 matrix, specifically including:

[0058] Based on the matrix involution property, the elements of the third and fourth rows of the input matrix are obtained from the elements of the first and second rows of the initial 4×4 matrix.

[0059] Furthermore, the involution property means that a matrix multiplied by itself equals the identity matrix, that is, a matrix is ​​the same as its inverse matrix.

[0060] Further, S101-3: Check whether the complete 4×4 matrix satisfies the property of a maximum distance separable matrix, specifically including:

[0061] Verify whether each 1×1, 2×2, and 3×3 submatrices of the complete 4×4 matrix and the entire 4×4 matrix have full rank. If they all have full rank, it means that the current input matrix satisfies the property of a maximum distance separable matrix; otherwise, it means that the current input matrix does not satisfy the property of a maximum distance separable matrix.

[0062] Further, S101-4: Check whether the complete 4×4 matrix satisfies the involution property, specifically including:

[0063] Verify whether a complete 4×4 matrix satisfies the property that multiplying the complete 4×4 matrix by itself yields the identity matrix. If it does, the complete 4×4 matrix satisfies the involution property; otherwise, it does not.

[0064] For example, the combination needs to satisfy property A. 2 =I, where A is the matrix to be checked and I is the identity matrix.

[0065] Furthermore, S101-5: Check whether the complete 4×4 matrix can be achieved at the optimal depth, specifically including:

[0066] Calculate whether the number of 1s in each row of a complete 4×4 matrix is ​​less than 8. If it is less, it means that the complete 4×4 matrix can be realized at the optimal depth. If it is greater, it means that the complete 4×4 matrix cannot be realized at the optimal depth.

[0067] For example, the depth of a binary matrix can be determined by calculating whether the number of 1s in each row is less than 8. If the matrix satisfies this condition, then it means that it can be implemented at a depth of 3.

[0068] The optimal depth is defined as the circuit depth of 3. At the FSE2019 conference, Li Shun et al. proved that for a 4x4 MDS array over F2^8, the circuit depth is at least 3. Similarly, it can be proven that the optimal implementation depth for a 4x4 MDS array over F2^4 is 3.

[0069] S101-3 to S101-5 play a crucial role in filtering out candidate matrices that do not meet the desired attributes such as MDS, integrability, or having the required depth.

[0070] Using S101-3 to S101-5, any involutional MDS matrix with minimum depth can be found, indicating that the present invention has performed an exhaustive search of candidate matrices in the target domain. The present invention obtained approximately 500,000 candidate involutional MDS matrices. The method of the present invention employs an exhaustive search approach, but compared to direct search strategies, the search strategy of the present invention overcomes the computational burden by applying involution properties and screening functions, which greatly reduces the search space.

[0071] Furthermore, such as Figure 2 As shown, S102: Process the candidate matrix set to find the maximum distance separable matrix with optimal implementation, specifically including:

[0072] S102-1: The BP algorithm with circuit depth awareness is used to process the candidate matrices in the candidate matrix set in the first layer to obtain the first candidate matrix subset; it is determined whether the number of XOR operations of each candidate matrix in the first candidate matrix subset is within the set range. If it is, the candidate matrix is ​​retained; if not, the candidate matrix is ​​discarded to obtain the second candidate matrix subset. The BP algorithm with circuit depth awareness is used in this process.

[0073] S102-2: The backward search algorithm is used to process the candidate matrices in the second candidate matrix subset in the second layer to obtain the third candidate matrix subset. It is then determined whether the number of XOR operations for each candidate matrix in the third candidate matrix subset is the minimum. If it is, the candidate matrix is ​​retained; otherwise, it is discarded to obtain the fourth candidate matrix subset.

[0074] S102-3: Using a general search framework, the candidate matrices in the fourth candidate matrix subset are processed in the third layer to select the optimal candidate matrix, which is then used as the maximum distance separable matrix.

[0075] It should be understood that the above technical solution uses a three-layer processing framework to effectively process all obtained candidate matrices. The XOR number is the number of XOR operations required when applying the diffusion matrix, and is used to measure the efficiency of the diffusion layer. The fewer the XOR numbers, the higher the efficiency.

[0076] Further, S102-1: Using a circuit-depth-aware BP algorithm, the candidate matrices in the candidate matrix set are processed in the first layer to obtain a first candidate matrix subset; it is determined whether the number of XOR operations for each candidate matrix in the first candidate matrix subset is within a set range. If it is, the candidate matrix is ​​retained; otherwise, it is discarded to obtain a second candidate matrix subset. The circuit-depth-aware BP algorithm specifically includes:

[0077] S102-11: Given a binary matrix M, the input signal is {t0, t1, ..., t2}. n-1 The output signal is {y0, y1, ..., y}. m-1}, base set and output set Each input signal and output signal is contained separately. Then, an m-integer vector Dist is initialized, which tracks each target value and... Dist is the distance; Dist is used It means that, among them Indicates from Obtain y i Minimum number of XOR gates required;

[0078] S102-12: Multiple times from the base set Choose two values, add them together to get a new value, and update the base set with this new value. Continue until all target signals are generated;

[0079] The update process for S102-12 is based on the following rules:

[0080] Rule 1: To For each distinct pair of values ​​in the array, an XOR operation is performed to generate a new value. This new value is used to recalculate the Dist vector and to calculate the new distance.

[0081] Rule 2: If a pair of values ​​can produce the target signal, then select that pair first; otherwise, select the smallest one. And put the corresponding values ​​into In the case where two values ​​are equal, the value with the larger Euclidean norm is chosen as the candidate.

[0082] Rule 3: If there are still many candidates, then choose one randomly.

[0083] Preferably, the set range is 43 to 49.

[0084] This refers to the Boyar-Peralta (BP) algorithm with circuit depth awareness. The BP algorithm was proposed by Boyar and Peralta in 2010. While it is significantly slower than the Paar algorithm and unsuitable for large matrices due to its exhaustive search of distance vectors, it often produces more efficient circuits. The overall idea of ​​the algorithm is to find a common path among as many targets as possible. Therefore, at each step, the next gate is selected to minimize the distance to the maximum number of targets. At FSE 2019, Li et al. proposed an improved BP algorithm with circuit depth awareness that limits the depth of the output circuit. The original BP algorithm aims to minimize the number of XOR gates in an implementation regardless of circuit depth, which is not suitable for low-latency scenarios. Therefore, this invention employs a BP algorithm with circuit depth awareness, selecting only signals not exceeding a certain depth limit and introducing a new concept, dist, that considers circuit depth. The improved BP algorithm can handle the optimization of MDS matrix implementations at the optimal depth.

[0085] Further, in S102-2: a backward search algorithm is used to perform a second-level processing on the candidate matrices in the second candidate matrix subset to obtain a third candidate matrix subset. It is then determined whether the number of XOR operations (XOR) for each candidate matrix in the third candidate matrix subset is the minimum. If it is, the candidate matrix is ​​retained; otherwise, it is discarded, resulting in a fourth candidate matrix subset. The backward search algorithm is as follows:

[0086] Place the output and input signals into the working set respectively. and input set middle;

[0087] Then, the predecessor node set Save can be used for splitting The value, and Matching in the forward search and The difference is, and They are all dynamic and changing, when express If there is at least one non-input value, it will be split according to the following five rules to reduce the search space; until... When, it means The values ​​in are all from the input set. The algorithm terminates and outputs the circuit generated during the segmentation process, based on the value in the input field.

[0088] Rule 1: If Then t will be placed middle;

[0089] Rule 2: If satisfy w will Delete;

[0090] Rule 3: If satisfy and Delete w and Add p2 to ;

[0091] Rule 4: If satisfy in Remove w1 and w2, and add p1, p2 and p3.

[0092] Rule 5: This is a default rule, which will... Divided into p1 and p1 and p2 were placed middle.

[0093] It should be understood that the backward search algorithm, a novel algorithm for low-latency scenarios, aims to iteratively split each output (dividing it into two XOR operations) until all inputs have been reached. By limiting the splitting time, the algorithm can find a suboptimal solution with the minimum circuit depth. The advantage of the backward search method lies in its backward framework, which ensures that each node reaches the minimum depth, a feature applicable to all matrices. In contrast, forward algorithms lack this property, which affects whether a node can be used to generate new nodes. Therefore, for certain matrices, this algorithm can cover more implementations with the minimum depth in a finite amount of time compared to previous algorithms.

[0094] It should be understood that a new general search framework has been proposed to further optimize the implementation of linear layers. This framework incorporates two additional techniques: partitioning optimization and expanding the base values. The new framework outperforms previous heuristic algorithms, including both forward and backward search algorithms, in terms of the number of XOR gates and search time. For forward search algorithms (such as BP) and backward search algorithms, many good candidate implementations are discarded due to the significant reduction in the search space during the search process. The new general search framework, employing two optimization techniques introduced by Liu et al., partially addresses this problem. This framework partitions a given circuit, expands the base values, and progressively optimizes the parallel circuit, thereby optimizing the entire circuit based on the results of any heuristic algorithm. Specifically, the framework does not optimize the complete matrix but only considers a portion of the circuit and expands the additional base values ​​of the heuristic algorithm.

[0095] Introduction to the General Search Framework: This framework partitions a given circuit, expands the base values, and progressively optimizes parallel circuits, thereby optimizing the entire circuit based on the results of any heuristic algorithm. By providing a partitioned optimization technique through output signal partitioning and progressive optimization, more good candidate implementations can be provided. Furthermore, different heuristics often use different search spaces. Some good circuits will never be recommended. Therefore, this algorithm employs an expanded base value technique to overcome the limitations of forward and backward search. Specifically, this framework does not optimize the complete matrix but only considers a portion of the circuit and expands the heuristic algorithm with additional base values.

[0096] Further, in S102-3: a general search framework is used to perform a third-level processing on the candidate matrices in the fourth candidate matrix subset to select the optimal candidate matrix. The optimal candidate matrix is ​​used as the maximum distance separable matrix. The general search framework includes:

[0097] The input is a given circuit that achieves the target matrix M. The output is a new circuit that implements M.

[0098] S102-31: Place the input signal and output signal into the base set respectively. and output set In the middle, computing circuit Corresponding topological sequence And Assign to

[0099] S102-32: Select a subset To expand the base set To generate the extended base set

[0100] S102-33: From Select a subset as the optimized partial target set. in, Represents a set Remove set The remaining set;

[0101] S102-34: Utilization and Generating partial circuits There are two modes for generating partial circuits. Suppose the given circuit C is obtained by the forward search algorithm There are two modes for generating it.

[0102] Pattern 1 uses the same heuristic algorithm To generate;

[0103] Mode 2 uses a different heuristic algorithm. To generate

[0104] S102-35: Will and Merged into the new circuit In the middle; for each value in the circuit There are two possibilities. or

[0105] For the first case Place the corresponding XOR gate into the new circuit. middle;

[0106] For the second case use Replace the XOR gate in The XOR gate incident that occurred before;

[0107] S102-36: Remove redundant XOR gates. After completing the merging circuit process, if the implemented circuit... If there are redundant XOR gates, the redundant gates are removed from the given circuit using a graph expansion method.

[0108] S102-37: If the new circuit Compared to the previous If fewer XOR gates are used, then... Updated to

[0109] S102-38: Traverse all possible... and And repeat steps S102-32 to S102-38.

[0110] For example, S103: Encrypting the input message based on the optimally implemented maximum distance separable matrix, specifically includes:

[0111] The extended key is obtained by multiplying the optimally implemented maximum distance separable matrix with the original key;

[0112] The input message is encrypted using the extended key to obtain encrypted data.

[0113] The original key is a predefined value.

[0114] This invention proposes a novel low-latency integrative MDS matrix construction method, comprising two main parts: an exhaustive search algorithm to obtain all MDS matrices satisfying certain constraints, and a novel three-layer processing framework to find low-depth implementations of candidate matrices. The search algorithm of this invention is an exhaustive search algorithm, enabling it to obtain finite field implementations. All 4×4 involutional MDS matrices are obtained, which can be optimally implemented in depth. Subsequently, utilizing three state-of-the-art heuristics suitable for low-latency scenarios, this invention designs a three-layer processing framework to efficiently process all obtained candidate matrices and explore their lightweight, low-latency implementations. The three-layer processing framework of this invention employs a hierarchical processing method and fully considers the characteristics of these three heuristics in terms of processing speed and optimization effect. This allows it to achieve a good balance between processing efficiency and search space.

[0115] The three-layer processing framework in this invention employs a hierarchical processing approach and fully considers the characteristics of the three heuristic algorithms in terms of processing speed and optimization effect. The optimization effects of the three optimization algorithms generally improve from worst to best, but their processing efficiency decreases from fastest to slowest. Previous works on MDS matrix search only considered the implementation cost of using a single optimization tool to obtain the matrix. In contrast, the framework of this invention combines three state-of-the-art heuristics, achieving a good balance between processing efficiency and search space.

[0116] This framework first uses a backpropagation (BP) algorithm with circuit depth awareness, which can be abbreviated as LSL algorithm (using the initials of its proposers Shun Li, Siwei Sun, and Chaoyun Li) to perform the first layer of processing on all candidate algorithms. Compared with general search frameworks such as backward search algorithms, additional partitioning optimization, and extended base value techniques, the LSL algorithm shows superior processing speed. Therefore, this invention chooses the LSL algorithm as the tool for the initial processing step of candidate matrices, selecting low-cost matrices for further optimization in subsequent layers. For further processing, this invention selects matrices with XOR counts between 43 and 49, totaling 5463.

[0117] For the second layer, this invention employs the backward search algorithm proposed by Liu et al. to process the remaining matrix after the first layer. The backward search algorithm has significant advantages in searching for low-latency matrices. Therefore, this invention uses this heuristic algorithm to further process the 5463 candidate objects selected from the previous layer. After processing by the second layer algorithm, this invention obtains the integrative MDS matrix with minimum XOR, which has a cost of 42 XOR gates, saving one XOR gate compared to existing technologies.

[0118] To further optimize the obtained optimal 42-XOR MDS implementation, this invention applies the general search framework algorithm proposed by Liu et al. (mentioned above) to the third-layer processing. From the perspective of low latency metrics, this framework helps to find a better implementation based on a given implementation. This invention uses the 42-XOR circuit obtained through backward search as input and attempts to further optimize it using the general search framework code. Since the algorithm involves random selection operations, it continuously attempts to optimize once started. After the algorithm completes, no result with fewer than 42 XOR gates is obtained. Although no better implementation is obtained for the corresponding MDS matrix, the third-layer processing covers a wider range of possibilities, ensuring the superiority of the output results of this three-layer processing framework.

[0119] In summary, the present invention can formalize the three-layer processing framework of the present invention, such as... Figure 3 As shown. By applying the search framework of this invention, this invention performs three steps on more than 500,000 low-latency integrative MDS matrices obtained through the matrix search algorithm in the first step.

[0120] Step 1: A faster heuristic algorithm, the LSL algorithm, is used to initially filter candidate matrices for preliminary selection. After this step, the present invention selects matrices with XOR counts ranging from 43 to 49 for further processing, resulting in 5463 matrices remaining after the first layer of processing.

[0121] Step 2: Process the remaining 5463 matrices using a backward search algorithm. Finally, four optimal depth-integral MDS matrices were obtained, with a cost of 42 XOR gates.

[0122] Step 3: Apply a general search framework to further optimize the obtained optimal implementation of 42 XOR. The algorithm was set to run for 5 days using CPU time. After completion, no results with fewer than 42 XOR gates were obtained. CPU time reflects the time taken to complete the process when the CPU is working at full speed.

[0123] Through the three-layer processing framework of this invention, we obtain four integrative MDS matrices that can be implemented at the optimal depth of 3, at a cost of 42 XOR gates, while the previous best result required 43 XOR gates.

[0124] Example 2

[0125] This embodiment provides an encryption system based on the construction of an MDS matrix in block cipher design;

[0126] Encryption systems based on the MDS matrix construction in block cipher design include:

[0127] The search module is configured to use an exhaustive search algorithm to search for all maximum distance separable matrices with minimum depth realization over a given finite field, thereby obtaining a set of candidate matrices.

[0128] The search module is configured to process the set of candidate matrices and find the maximum distance separable matrix with optimal implementation.

[0129] The encryption module is configured to encrypt the input message based on the maximum distance separable matrix with optimal implementation.

[0130] It should be noted that the search module, finding module, and encryption module described above correspond to steps S101 to S103 in Embodiment 1. The examples and application scenarios implemented by these modules and their corresponding steps are the same, but they are not limited to the content disclosed in Embodiment 1. It should also be noted that these modules, as part of the system, can be executed in a computer system, such as a set of computer-executable instructions.

[0131] The descriptions of each embodiment in the above embodiments have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0132] The proposed system can be implemented in other ways. For example, the system embodiments described above are merely illustrative, and the division of modules described above is only a logical functional division. In actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed.

[0133] Example 3

[0134] This embodiment also provides an electronic device, including: one or more processors, one or more memories, and one or more computer programs; wherein, the processor is connected to the memory, and the one or more computer programs are stored in the memory. When the electronic device is running, the processor executes the one or more computer programs stored in the memory to cause the electronic device to perform the method described in Embodiment 1.

[0135] It should be understood that in this embodiment, the processor can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0136] Memory may include read-only memory and random access memory, and provides instructions and data to the processor. A portion of memory may also include non-volatile random access memory. For example, memory may also store information about the device type.

[0137] In the implementation process, each step of the above method can be completed by the integrated logic circuits in the processor hardware or by software instructions.

[0138] The method in Embodiment 1 can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor. The software modules can reside in readily available storage media in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, a detailed description is not provided here.

[0139] Those skilled in the art will recognize that the units and algorithm steps described in connection with the various examples of this embodiment can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention.

[0140] Example 4

[0141] This embodiment also provides a computer-readable storage medium for storing computer instructions, which, when executed by a processor, complete the method described in Embodiment 1.

[0142] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An encryption method based on the construction of the MDS matrix in block cipher design, characterized by: include: An exhaustive search algorithm is used to search for all maximum distance separable matrices with minimum depth realization over a given finite field, thus obtaining a set of candidate matrices. The candidate matrix set is processed to find the maximum distance separable matrix with optimal implementation; The input message is encrypted based on the optimally implemented maximum distance separable matrix. Specifically, the exhaustive search algorithm is used to search for all maximum distance separable matrices with minimum depth realization over a given finite field, resulting in a candidate matrix set, which includes: (1): For each item in the first and second rows of the initial 4×4 matrix, traverse every element in the domain; (2): Based on the involution property, find the other 8 terms of the initial 4×4 matrix to obtain the complete 4×4 matrix; (3): Check whether the complete 4×4 matrix satisfies the property of the maximum distance separable matrix. If it does, proceed to (4); otherwise, return to (1). (4): Check if the complete 4×4 matrix satisfies the involution property. If it does, proceed to (5); otherwise, return to (1). (5): Check if the complete 4×4 matrix can be implemented at the optimal depth. If yes, proceed to (6); otherwise, return to (1). (6): Store the complete 4×4 matrix into the candidate matrix set; Specifically, the process of processing the candidate matrix set to find the maximum distance separable matrix with optimal implementation includes: The Boyar-Peralta algorithm with circuit depth awareness is used to perform the first layer of processing on the candidate matrices in the candidate matrix set to obtain the first candidate matrix subset. It is then determined whether the number of XOR operations on each candidate matrix in the first candidate matrix subset is within a set range. If it is, the candidate matrix is ​​retained; otherwise, it is discarded to obtain the second candidate matrix subset. The backward search algorithm is used to process the candidate matrices in the second candidate matrix subset in the second layer to obtain the third candidate matrix subset. It is then determined whether the number of XOR operations for each candidate matrix in the third candidate matrix subset is the minimum. If it is, the candidate matrix is ​​retained; otherwise, it is discarded to obtain the fourth candidate matrix subset. A general search framework is used to perform a third-level processing on the candidate matrices in the fourth candidate matrix subset to select the optimal candidate matrix, which is then used as the maximum distance separable matrix.

2. The encryption method based on MDS matrix construction in block cipher design as described in claim 1, characterized in that, Check whether the complete 4×4 matrix satisfies the property of a maximum distance separable matrix, specifically including: Verify whether each 1×1, 2×2, and 3×3 submatrices of the complete 4×4 matrix and the entire 4×4 matrix have full rank. If they all have full rank, it means that the current input matrix satisfies the property of a maximum distance separable matrix; otherwise, it means that the current input matrix does not satisfy the property of a maximum distance separable matrix.

3. The encryption method based on MDS matrix construction in block cipher design as described in claim 1, characterized in that, Check whether a complete 4×4 matrix satisfies the involution property, specifically including: Verify whether a complete 4×4 matrix satisfies the property that multiplying the complete 4×4 matrix by itself yields the identity matrix. If it does, the complete 4×4 matrix satisfies the involution property; otherwise, it does not.

4. The encryption method based on MDS matrix construction in block cipher design as described in claim 1, characterized in that, Checking whether a complete 4×4 matrix can be achieved at the optimal depth includes: Calculate whether the number of 1s in each row of a complete 4×4 matrix is ​​less than 8. If it is less, it means that the complete 4×4 matrix can be realized at the optimal depth. If it is greater, it means that the complete 4×4 matrix cannot be realized at the optimal depth.

5. The encryption method based on MDS matrix construction in block cipher design as described in claim 1, characterized in that, The Boyar-Peralta algorithm with circuit depth awareness specifically includes: Given a binary matrix M, the input signal is , This is the original input signal for the block cipher matrix operation stage. This represents one independent input signal, where n is the total number of input signals, i.e., the input dimension value, equal to the number of columns in the MDS matrix to be processed; the output signal is... , The output signal after the XOR operation of the Boyar-Peralta algorithm is given. Represents one independent output signal, where m is the total number of output signals, i.e., the output dimension value, equal to the number of rows in the MDS matrix to be computed; base set. and output set Each signal contains all input and output signals, and then an integer vector is initialized. It tracks each target value and distance, It is a one-dimensional integer array vector with a length equal to m of the total number of output signals, specifically used for real-time tracking of the target output signal and the initial input basis set for each channel. The minimum XOR gate overhead distance between them; each element in the vector is a non-negative integer, corresponding to the minimum number of XOR operations for a single output signal; use It means that, among them Indicates from the base set Obtain the output signal Minimum number of XOR gates required Multiple times from base set Choose two values, add them together to get a new value, and update the base set with this new value. Continue until all target signals are generated; The update process is based on the following rules: Rule 1: To For each distinct pair of values ​​in the array, an XOR operation is performed to generate a new value, which is then used for recalculation. Vectors, and calculate the new distance. , Defined as From this, we can conclude that: It is precisely the base set Generated through XOR gate Minimum number of nodes required The smaller the value, the more likely it is to be a base set. Distance from output node The closer they are; among them, The number of base set elements participating in the XOR operation is a positive integer, and its value corresponds to the total number of XOR input terms required to generate the output signal of this channel. as base set The subscript index of the element. For the range of values ​​from arrive positive integers, Indicates the first in the base set One element participating in the XOR operation; Rule 2: If a pair of values ​​can produce the target signal, then select that pair first; otherwise, select the smallest one. and put the corresponding value into In the case where two values ​​are equal, the value with the larger Euclidean norm is chosen as the candidate. Rule 3: If there are still many candidates, then choose one randomly.

6. An encryption system based on MDS matrix construction in block cipher design, employing the encryption method based on MDS matrix construction in block cipher design as described in any one of claims 1-5, characterized in that, include: The search module is configured to use an exhaustive search algorithm to search for all maximum distance separable matrices with minimum depth realization over a given finite field, thereby obtaining a set of candidate matrices. The search module is configured to process the set of candidate matrices and find the maximum distance separable matrix with optimal implementation. The encryption module is configured to encrypt the input message based on the maximum distance separable matrix with optimal implementation.

7. An electronic device, characterized in that it comprises: Memory is used to store computer-readable instructions in a non-transitory manner. as well as Processor, for executing the computer-readable instructions, When the computer-readable instructions are executed by the processor, they perform the method described in any one of claims 1-5.

8. A storage medium characterized by being non-transitory. The system stores computer-readable instructions, wherein, when the non-transitory computer-readable instructions are executed by a computer, the instructions of the method according to any one of claims 1-5 are executed.

Images