A hardware implementation method for shared encryption and decryption of AES based on polynomial basis

Abstract

The present invention discloses a shared encryption and decryption AES hardware implementation method based on a polynomial basis, and belongs to the field of information security technology. The present invention includes four parts: an initial data path, a 1-9 round function data path, a 10-round function data path, and a 4:1 MUX; the initial data path: implements the initial round function function of AES encryption and decryption; the 1-9 round function data path: implements the round function function of the 19th round of AES encryption and decryption; the 10-round function data path: implements the round function function of the 10th round of AES encryption and decryption; the 4:1 MUX: selects 1 from 2 outputs of the initial round function and 2 outputs of the 19th round function as the round function input of the next round. The present invention has the technical advantages of small area and high throughput per unit area relative to the shared encryption and decryption AES hardware implementation based on a normal basis, and can be directly combined with a variety of masking schemes.

Description

Technical Field

[0001] The invention belongs to the technical field of information security, and in particular relates to a hardware implementation method of AES shared encryption and decryption based on a polynomial basis. Background Art

[0002] As the core technology and basic support for network and information security, cryptography is the most effective, reliable and economical means of security. In the past 30 years, with the revolutionary development of integrated circuit (IC) technology, cryptographic hardware has become one of the most widely used cryptographic implementation carriers, with significant advantages in performance and security.

[0003] In actual use of cryptographic devices, the symmetric encryption algorithm AES (Advanced Encryption Standard) is still the most widely deployed. At the same time, the SPN structure and key components used by AES, such as byte substitution, row shift, and column confusion, are also widely used in many other symmetric encryption scheme designs. For example, NIST lightweight certified encryption candidate standard algorithm ASCON, ISO / IEC29192 lightweight block cipher standard algorithm PRESENT, ISO / IEC29192-2 block cipher standard algorithm SM4 algorithm, etc.

[0004] AES (Advanced Encryption Standard) encryption and decryption technology is widely used in link modes such as CBC, CMAC and CCM. In the fields of secure communication protocols, wireless communications and IoT device communications, such as Secure Sockets Layer / Transport Layer Security (SSL / TLS) protocols, IEEE802.11 wireless LAN (for Wi-Fi communications) and IEEE802.15.4 wireless sensor networks (for low-speed wireless communications), there is an urgent need for an AES architecture that supports efficient encryption and decryption in these modes.

[0005] The AES algorithm uses the SPN structure, with different encryption and decryption functions. By combining substitution operations, it can effectively obfuscate and diffuse plaintext information. The SPN structure cipher algorithm has better diffusion than the Feistel structure cipher algorithm, but the asymmetric encryption and decryption causes a certain degree of resource waste.

[0006] The design of AES hardware circuit for shared encryption and decryption based on normal basis was proposed in 2016. For the round function, there are two key technical optimizations. First, the shared design of encryption and decryption round functions is realized through operation reordering and register adjustment, which reduces the area resource consumption caused by the different encryption and decryption of SPN structure. Second, by changing the operation of each round function from polynomial basis to normal basis, the isomorphic mapping required for each cycle is reduced. It is only necessary to change the polynomial basis PB to NB in ​​the initial round operation and from NB to PB in the last round, so the delay of the intermediate round as the critical path is reduced. For online round key generation, there are two key technical optimizations. First, K10 is used as the input key of the decryption round function, and second, the decryption round key of the next cycle is reversed. Through these two technologies, an appropriate amount of combinatorial logic is added, and the decryption round key generation cycle is reduced to 10 cycles, realizing the shared design of encryption and decryption round key generation. Summary of the invention

[0007] Technical problem solved by the present invention: In view of the problem that the existing AES hardware circuit design for shared encryption and decryption based on a normal basis requires more area resources, the present invention provides a shared encryption and decryption AES hardware implementation method based on a polynomial basis based on redundant tower domain inversion from the perspective of shared encryption and decryption. Compared with the shared encryption and decryption AES hardware implementation based on a normal basis, the present invention has the technical advantages of small area and high throughput per unit area, and can be directly combined with a variety of masking schemes. After the combination, the masked AES hardware implementation that is resistant to side channel attacks also has the technical advantages of small area and high throughput per unit area. The method can be applied to implement AES in a variety of hardware platforms such as FPGA and ASIC.

[0008] Technical solution: In order to solve the above technical problems, the technical solution adopted by the present invention is as follows:

[0009] A shared encryption and decryption AES hardware implementation method based on a polynomial basis includes four parts: an initial data path, a 1-9 round function data path, a 10-round function data path, and a 4:1 MUX;

[0010] The initial data path: implements the initial round function of AES encryption and decryption;

[0011] The 1-9 round function data path: implements the AES encryption and decryption round function functions of the 1-9 rounds;

[0012] The 10-round function data path: implements the round function function of the 10th round of AES encryption and decryption;

[0013] The 4:1 MUX selects 1 out of 4 from the 2 outputs of the initial round function and the 2 outputs of the 1st to 9th round functions as the input of the next round of round functions.

[0014] Preferably, the initial round function data path portion includes 2 input XOR 1 and A -1 d transformation operation, specifically:

[0015] The round key is expressed as:

[0016] Where f represents the encrypted valid signal, f = 1 represents encryption, and f = 0 represents decryption; r∈{1,2,…,10}; NK 0 Called the initial round key, NK r is called the round key of round r, K 1 , K 2 ,……,K 10 Indicates the first, second, ..., tenth round encryption keys of AES;

[0017] The message M and the initial round key NK 0 Perform 2-input XOR 1 operation, the output is R7, R7 is then passed through A -1 d conversion operation, the output is R8;

[0018] A -1 The d transformation operation is to split the variable into multiple bytes in sequence, and multiply each byte by the matrix A -1 , and XOR d, the matrix A -1 and element d looks like this:

[0019]

[0020] Preferably, the 1-9 round function data path portion includes a shared portion, an encryption-only portion, and a decryption-only portion;

[0021] The shared parts include inversion operation and 2:1DeMUX operation; the encryption-specific parts include: row shift and Ac transformation operation, merge transformation U operation, 5-input XOR operation; the decryption-specific parts include: row shift inversion and 2-input XOR 2 operation, inverse merge transformation V operation and 4-input XOR operation.

[0022] Preferably, the implementation process of the 1-9 round function data path part is:

[0023] Perform an inversion operation on the round function input to output R1, then perform a 2:1 DeMUX operation on R1 to output R2 and R3;

[0024] During encryption, R2 = R1, and R2 is subjected to row shift and Ac transformation to obtain R4; R4 is subjected to the merge transformation U operation to obtain two outputs, and these two outputs, two R4s and the rth round key NK are combined. rAs the input of the 5-input XOR operation, R9 is obtained; R3 = 0, R3 is still 0 after row shift and inversion, and then combined with the round key NK r Perform 2-input XOR 2 operation to obtain R5, and use R5 as an input of the 10-round function data path;

[0025] When decrypting, R3 = R1, R3 and round key NK r After row shift inversion and 2-input XOR 2 operation, R5 is obtained, and then after inverse merging transformation V, 4 outputs are obtained. These 4 outputs are used as inputs of 4-input XOR to obtain R10; R2=0, R2 is row shifted and Ac transformed to obtain R4, and R4 is used as an input of the 10-round function data path.

[0026] Preferably, the Ac transformation operation refers to splitting the variable into multiple bytes in sequence, performing multiplication by matrix A and XOR operation on each byte; the matrix A and the element c are as follows:

[0027]

[0028] As a preference, the combined transformation U includes a matrix U0 and a matrix U1, as follows:

[0029]

[0030] Preferably, the inverse merging transformation V, including V0, V1, V2 and V3, is as follows:

[0031]

[0032]

[0033] Preferably, the 10-round function datapath portion includes 2-input XOR 3 and 2:1 MUX operations;

[0034] First, NK 10 Perform 2-input XOR 3 operation with R4 to calculate When encrypted, NK 10 The 10th round encryption key K 10 , when decrypted, NK 10 Decrypt the round key K for the 10th round 0 ; Then perform 2:1 MUX operation on R6 and R5. When encrypting, f=1, and select R6 as the ciphertext output; when decrypting, f=0, and select R5 as the plaintext output.

[0035] Preferably, the control signal F and the variables R7, R8, R9, and R10 are used as inputs of the 4:1 MUX operation to perform the 4:1 MUX operation; the control signal F=(f, f1), where f represents an encrypted valid signal, and when encrypting, f=1, and f1 represents an initial round valid signal, and when performing the initial round change, f1=1;

[0036] When F=11, the round function output is R7; when F=01, the round function output is R8; when F=10, the round function output is R9; when F=00, the round function output is R10; the round function output is used as the round function input of the next cycle.

[0037] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0038] (1) The present invention proposes a shared encryption and decryption AES hardware implementation method based on a polynomial basis. Compared with the shared encryption and decryption AES hardware based on a normal basis, the area is reduced and the throughput per unit area is increased. In addition, the shared encryption and decryption circuits of the present application are all implemented using basic AND gates, OR gates, and NOT gates, which can be directly combined with the mask scheme, and can be directly further generated into a mask-type shared encryption and decryption circuit. The area of ​​the mask-type shared encryption and decryption circuit is reduced and the throughput per unit area is increased. The method can be applied to a variety of hardware platforms such as FPGA and ASIC.

[0039] (2) This invention proposes a shared encryption and decryption AES hardware circuit design based on a polynomial basis. The invention has the following technical features:

[0040] 1. Compared with the design of shared encryption and decryption circuit based on normal basis, by calculating the intermediate round function on PB basis, the GF(2 8 ) to GF(2 4 ) 2 domain isomorphic transformation; in the last round of function data path, GF(2 4 ) 2 to GF(2 8 ) domain. This reduces the transformation to two isomorphic mappings.

[0041] 2. Correspondingly, all calculations on the intermediate round function data path are based on the PB basis, and the merged affine transformation also needs to be adjusted accordingly. This application focuses on the modified merged affine matrix transformations U and V.

[0042] 3. In the 1-9 round data path of the polynomial basis, the 1-9 round function calculation of the encryption process can be divided into four steps, which are inverse, row shift and Ac transformation, merge affine transformation U and 5-input XOR.

[0043] (3) For the unprotected AES implementation, the polynomial-based RTF-PB AES shared encryption and decryption circuit proposed in this invention uses 3,213 LUTs in the Kintex7 device, and the encryption / decryption throughput reaches 1683Mbps, and the unit area throughput is 523.81Kbps / LUT. Compared with the regular-based RTF-NB AES implementation, the RTF-PB AES implementation proposed in this application reduces the area by 17.04% and increases the compactness by 4.97%.

[0044] For the mask-protected AES implementation, without considering the random number, the ISW-RTF-PB AES mask-type shared encryption and decryption circuit proposed by the present invention on the polynomial basis has a unit area throughput of 205.35Kbps / LUT. Compared with the ISW-RTF-NB AES mask implementation on the regular basis, the ISW-RTF-PB AES implementation proposed by us has an area reduction of 20.83% and a compactness increase of 11.63%.

[0045] On the Kintex7 device, the area of ​​the mask-protected shared encryption and decryption ISW-RTF-PB AES is 1.71 times that of the mask-encrypted ISW-RTF AES. The decryption function is achieved with only a 71% increase in area, and no additional random numbers are required.

[0046] It can be seen that, whether for unprotected or masked AES implementation, the shared encryption and decryption design based on the polynomial basis requires less area overhead and has a higher throughput per unit area than the encryption and decryption design based on the regular basis. Therefore, when area and throughput per unit area are prioritized, it is recommended to choose the unprotected and protected shared encryption and decryption method based on the polynomial basis for AES hardware design. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a schematic diagram of the AES hardware implementation method for shared encryption and decryption based on a polynomial basis of the present invention. DETAILED DESCRIPTION

[0048] The present invention is further illustrated below in conjunction with specific examples. The examples are implemented based on the technical solutions of the present invention. It should be understood that these examples are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0049] The polynomial-based shared encryption and decryption AES hardware implementation method of the present application is mainly used in the field of cryptographic hardware design, and has the technical advantages of low area and high throughput per unit area; it can also be applied to the field of cryptographic hardware design for resisting side channel attacks, and directly combined with a variety of masking schemes, and the masked AES hardware implementation for resisting side channel attacks after the combination also has the technical advantages of small area and high throughput per unit area. The method can be applied to implement AES in a variety of hardware platforms such as FPGA and ASIC.

[0050] like Figure 1 As shown, the shared encryption and decryption AES hardware implementation method based on polynomial basis provided by the present application includes four parts: initial data path, 1-9 round function data path, 10 round function data path and 4:1MUX, and each part operates on the polynomial basis.

[0051] The initial data path implements the initial round function of AES encryption and decryption.

[0052] 1-9 round function data path: implements the round function functions of AES encryption and decryption rounds 1-9;

[0053] 10-round function data path: implements the 10th round function of AES encryption and decryption;

[0054] 4:1MUX: Select 1 from the 2 outputs of the initial round function and the 2 outputs of the 1st to 9th round functions as the input of the next round of round functions.

[0055] like Figure 1 As shown, the initial round function data path portion includes 2 input XOR 1 and A -1 d transformation operation, specifically:

[0056] The round key is expressed as:

[0057] Where f represents the encrypted valid signal, f = 1 represents encryption, and f = 0 represents decryption; r∈{1,2,…,10}; NK 0 Called the initial round key, NK r is called the round key of round r, K 1 , K 2 ,……,K 10 Indicates the first, second, ..., tenth round encryption keys of AES;

[0058] First, the input is a 128-bit message M and a 128-bit initial round key NK 0 Perform 2-input XOR 1 operation, the output is R7, R7 is then passed through A -1d conversion operation, the output is R8; R7 and R8 are used as the two inputs of 4:1MUX. These operations are all based on polynomial basis.

[0059] A -1 The d transformation operation is to split the variable into 16 bytes in sequence, and multiply each byte by the matrix A. -1 , and XOR d, the matrix A -1 and element d looks like this:

[0060]

[0061] The data path of the 1-9 round function includes a shared part, an encryption-only part, and a decryption-only part; the shared part includes an inversion operation and a 2:1 DeMUX operation.

[0062] The encryption-specific parts include: row shift and Ac transform operations, merge transform U (U0 and U1) operations, and 5-input XOR operations;

[0063] The decryption-specific parts include: row shift inversion and 2-input XOR 2 operation, inverse merge transformation V (V0, V1, V2, V3) operation and 4-input XOR operation; these operations are all on a polynomial basis.

[0064] The input of the round data path of round function 1-9 is 128-bit round function input and round key NK r , the output is R9 and R10.

[0065] The specific operation process of the 1-9 round function data path is:

[0066] First, the input is a 128-bit round function input for inversion operation, and the output is R1. Then R1 is subjected to a 2:1 DeMUX operation, that is, the input is the R1 variable, and the output is the two variables R2 and R3.

[0067] During encryption, R2 = R1, R3 = 0, R2 is row-shifted and Ac-transformed to obtain R4; R4 is combined and transformed U to obtain two outputs, these two outputs, 2 R4s and the rth round key NK r As the input of the 5-input XOR operation, R9 is obtained; at this time, R3 is 0, and R3 is still 0 after row shift inversion, and then combined with the round key NK r Perform 2-input XOR 2 operation to get R5, and use R5 as an input of the 10-round function data path;

[0068] When decrypting, R2 = 0, R3 = R1, R3 and round key NK rAfter row shift inversion and 2-input XOR 2 operation, R5 is obtained, and then 4 outputs are obtained through inverse merging transformation V. These 4 outputs are used as inputs of 4-input XOR, and R10 is obtained. At this time, R2 is 0. After row shift and Ac transformation, R2 can be obtained to obtain R4, which is used as an input of the 10-round function data path.

[0069] Among them, performing the Ac transformation operation on R2 means splitting R2 into 16 bytes in sequence, multiplying each byte by the matrix A and performing the XOR operation with c. The matrix A and the element c are as follows:

[0070]

[0071] The combined transformation U, including the matrix U0 and the matrix U1, is as follows:

[0072]

[0073] The inverse merge transformation V, including V0, V1, V2 and V3, is as follows:

[0074]

[0075]

[0076] One of the inputs of the 5-input XOR is the round key NK r , whose output is R9.

[0077] 2 input XOR 2 one input is round key NK r The output of the 4-input XOR is R10.

[0078] In this embodiment, R4 and R5 can be used in a 10-round function data path, thereby reducing the area of ​​the 10-round function data path.

[0079] The input and output of the inversion of the present application are both elements on a polynomial basis. Under the condition that the input and output are both polynomial bases, the inversion module can be replaced arbitrarily. The redundant tower domain inversion method is selected in the present invention for inversion operation. The redundant tower domain inversion method is a prior art. The referenced publicly published documents are as follows: Ueno R, Homma N, Sugawara Y, et al. Highly efficient GF(2 8)inversion circuit based on redundant GF arithmetic and its application to AES design[C] / / Cryptographic Hardware and EmbeddedSystems-CHES2015.Springer,2015:63-80.

[0080] In this embodiment, row shift, row shift inversion and encryption round key K r Consistent with the AES cryptographic algorithm standard.

[0081] The 10-round function data path includes 2-input XOR 3 and 2:1MUX operations. MUX stands for multiplexer, and 2:1MUX stands for 2-to-1 selector. The specific operations of the 10-round function data path are:

[0082] The input of the 10-round function data path includes NK 10 , R4 and R5. First, NK 10 , R4 performs 2-input XOR 3 operation and calculates When encrypted, NK 10 The 10th round encryption key K 10 , when decrypted, NK 10 Decrypt the round key K for the 10th round 0 ; Then perform 2:1 MUX operation on R6 and R5. When encrypting, f=1, and select R6 as the ciphertext output; when decrypting, f=0, and select R5 as the plaintext output.

[0083] The inputs of 4:1MUX are R7, R8, R9, R10 and control signal F. Control signal F = (f, f1), f represents the encryption valid signal, when encrypting, f = 1, f1 represents the initial round valid signal, when performing the initial round change, f1 = 1.

[0084] When F=11, the round function output is R7; when F=01, the round function output is R8; when F=10, the round function output is R9; when F=00, the round function output is R10; the round function output is used as the round function input of the next cycle.

[0085] Table 1 shows the comprehensive results of the common AES based on the lookup table S-box. Specifically, on the Virtex-5 device, the LUT resources used by the decryption round function of AES are 1.45 times that of the encryption round function, and the LUT resources used for decryption key generation are 3.13 times that of encryption key generation. It can be seen that due to the different encryption and decryption round functions and encryption and decryption key generation, the area of ​​AES hardware design increases significantly. Therefore, the design of AES encryption and decryption shared core functions is very important for reducing the area of ​​AES.

[0086] Table 1 Comprehensive evaluation results of each AES module based on LUT implementation on Virtex-5 device

[0087]

[0088] Table 2 Comprehensive results of four shared encryption and decryption AES on Kintex7 device

[0089]

[0090] Table 2 shows the comprehensive results of AES on Kintex-7 devices after using the shared encryption and decryption method. Table 3 shows the comprehensive results of AES with only mask encryption.

[0091] Table 3 Comprehensive results of masked AES encryption on Kintex7 device

[0092]

[0093] RTF-PB AES represents the implementation of the combination of Redundant Tower Field inversion and the shared encryption and decryption AES based on polynomial basis proposed in this application, and the round function is calculated on the polynomial basis. RTF-PB AES is a specific implementation of the present invention, including encryption and decryption parts.

[0094] RTF-NB AES represents the implementation of combining the redundant tower field (RTF) inversion with the existing AES based on the normal basis for shared encryption and decryption, and the round function is calculated on the NB. RTF-NB AES is a direct comparison implementation of the present invention, including encryption and decryption parts. The existing AES based on the normal basis for shared encryption and decryption, the referenced publicly published literature is as follows: Ueno R, Morioka S, Homma N, et al. A high throughput / gate AES hardware architecture by compressing encryption and decryption datapaths-towardefficient CBC-mode implementation [C] / / Cryptographic Hardware and Embedded Systems-CHES2016. Springer, 2016: 538-558.

[0095] ISW-RTF-PB AES represents the implementation of the ISW mask combined with the RTF-PB AES proposed in the present invention. This scheme can resist first-order side channel attacks and uses 864-bit random numbers. ISW-RTF-PB AES is the implementation of the present invention combined with the mask, including encryption and decryption parts.

[0096] ISW-RTF-NB AES represents the implementation of ISW mask combined with RTF-NB AES, which can resist first-order side channel attacks and uses 864-bit random numbers. It is a comparative implementation of ISW-RTF-PB AES, including encryption and decryption parts.

[0097] ISW-RTF AES means the encryption implementation using the combination of redundant tower field and ISW mask, which only contains the encryption part. ISW-RTF AES combines ISW mask and redundant tower field technology. The referenced publicly published literature is as follows: Qian Zhang, Yongbin Zhou*, Shuang Qiu, Wei Cheng, Jingdian Ming, Rui Zhang. A Compact AES Hardware Implementation Secure Against 1st-Order Side-Channel Attacks[C]. / / 36th IEEE International Conference on Computer Design(ICCD 2018)}, 2018:545-552.

[0098] The ISW mask in this embodiment is a prior art, and the referenced publicly published documents are as follows: Yuval Ishai, Amit Sahai, David A. Wagner: Private Circuits: Securing Hardware against Probing Attacks. CRYPTO 2003: 463-481.

[0099] For the unprotected AES implementation, the RTF-PB AES shared encryption and decryption circuit proposed in this paper uses 3,213 LUTs in the Kintex7 device, with an encryption / decryption throughput of 1683Mbps and a unit area throughput of 523.81Kbps / LUT. Compared with the RTF-NB AES implementation, the RTF-PB AES implementation proposed in this application has a 17.04% reduction in area and a 4.97% increase in compactness.

[0100] For the mask-protected AES implementation, without considering the random number, the ISW-RTF-PB AES mask-type shared encryption and decryption circuit proposed in the present invention has a unit area throughput of 205.35 Kbps / LUT. Compared with the ISW-RTF-NB AES implementation, the ISW-RTF-PB AES implementation area is reduced by 20.83% and the compactness is increased by 11.63%.

[0101] On the Kintex7 device, the area of ​​the mask-protected shared encryption and decryption ISW-RTF-PB AES is 1.71 times that of the mask-encrypted ISW-RTF AES. The decryption function is realized with only 71% increase in area, and no additional random numbers are required. In Table 1, the encryption and decryption area is 2.45 times the encryption area. Therefore, the area required for decryption is reduced by sharing encryption and decryption.

[0102] It can be seen that, whether for unprotected or masked AES implementation, the shared encryption and decryption design based on the polynomial basis requires less area overhead and has a higher throughput per unit area than the encryption and decryption design based on the regular basis. Therefore, when area and throughput per unit area are prioritized, it is recommended to choose the method of completing unprotected and protected shared encryption and decryption based on the polynomial basis.

[0103] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A hardware implementation method for shared encryption and decryption of AES based on polynomial basis, characterized in that: include: Step 1: Implement the initial round function function of AES encryption and decryption through the initial round function data path part; Step 2: Implement the round function functions of AES encryption and decryption of rounds 1 to 9 through the 1-9 round function data path part; The 1-9 round function data path portion includes a shared portion, an encryption-only portion, and a decryption-only portion; The shared part implements the inversion operation and 2:1DeMUX operation; the encryption-specific part implements the row shift and Ac transformation operation, merge transformation U operation, and 5-input XOR operation; the decryption-specific part implements the row shift inversion and 2-input XOR 2 operation, inverse merge transformation V operation, and 4-input XOR operation; The implementation process of the data path part of the 1-9 round function is as follows: Perform an inversion operation on the round function input to output R1, then perform a 2:1 DeMUX operation on R1 to output R2 and R3; During encryption, R2 = R1, and R2 is shifted and transformed by Ac to obtain R4; R4 is merged and transformed by U to obtain two outputs, and these two outputs, two R4s and the key NK of the rth round are combined. r As the input of the 5-input XOR operation, R9 is obtained; R3 = 0, R3 is still 0 after row shift and inversion, and then combined with the round key NK r Perform 2-input XOR 2 operation to obtain R5, and use R5 as an input of the data path part of the 10-round function; When decrypting, R3 = R1, R3 and round key NK r After row shift inversion and 2-input XOR 2 operation, R5 is obtained, and then 4 outputs are obtained after inverse merging transformation V. These 4 outputs are used as inputs of 4-input XOR to obtain R10; R2 = 0, R2 is row shifted and Ac transformed to obtain R4, and R4 is used as an input of the data path part of the 10-round function; The Ac transformation operation is to split the variable into multiple bytes in sequence, and each byte is multiplied by the matrix A and XORed with c; the matrix A and the element c are as follows: Step 3: Implement the round function function of the 10th round of AES encryption and decryption through the 10-round function data path part; The 10-round function datapath part implements 2-input XOR 3 and 2:1 MUX operations; First, NK 10 Perform 2-input XOR 3 operation with R4 to calculate When encrypted, NK 10 The 10th round encryption key K 10 , when decrypted, NK 10 Decrypt the round key K for the 10th round 0 ; Then perform 2:1 MUX operation on R6 and R5. When encrypting, f=1, and select R6 as the ciphertext output; when decrypting, f=0, and select R5 as the plaintext output; Step 4: Through the 4:1 MUX, select 1 from the 2 outputs of the initial round function data path part and the 2 outputs of the 1-9 round function data path part as the input of the next round of round function; The control signal F and variables R7, R8, R9, and R10 are used as inputs of the 4:1 MUX operation to perform the 4:1 MUX operation; the control signal F = (f, f1), where f represents an encrypted valid signal. When encrypting, f = 1, and f1 represents an initial round valid signal. When performing the initial round transformation, f1 = 1; When F=11, the round function output is R7; when F=01, the round function output is R8; when F=10, the round function output is R9; when F=00, the round function output is R10; the round function output is used as the round function input of the next cycle.

2. The method for implementing AES hardware based on polynomial basis for shared encryption and decryption according to claim 1, characterized in that: The initial round function data path part implements 2-input XOR 1 and A -1 d transformation operation, specifically: The round key is expressed as: Where f represents the encrypted valid signal, f = 1 represents encryption, and f = 0 represents decryption; r∈{1,2,…,10}; NK 0 Called the initial round key, NK r is called the round key of round r, K 1 , K 2 ,……,K 10 Indicates the first, second, ..., tenth round encryption keys of AES; The message M and the initial round key NK 0 Perform 2-input XOR 1 operation, the output is R7, R7 is then passed through A -1 d conversion operation, the output is R8; A -1 The d transformation operation is to split the variable into multiple bytes in sequence, and multiply each byte by the matrix A. -1 , and XOR d, the matrix A -1 and element d looks like this:

3. The method for implementing AES hardware based on polynomial basis shared encryption and decryption according to claim 1, characterized in that: The combined transformation U, including the matrix U0 and the matrix U1, is as follows:

4. The method for implementing AES hardware based on polynomial basis for shared encryption and decryption according to claim 1, characterized in that: The inverse merge transformation V, including V0, V1, V2 and V3, is as follows:

Images