A self-reversible block cipher, application, instruction set, device and program

Abstract

Disclosed is a block cipher with a self-reversible overall structure. The self-reversible structure is constructed from three inventive points: 1. The main structure starts with an odd-numbered round and alternates between even-numbered and odd-numbered rounds. 2. The odd-numbered round consists of three components in series, decomposing in the encryption direction as: entry operator → S-odd component → exit operator, where the two operators are designed to be inverses of each other, and the inputs of the entry and exit operators are connected to the wheel key. Even-numbered rounds are equal to S-even; both S-odd and S-even are self-reversible logic design components. 3. It is recommended that S-even ≠ S-odd. The main effect of this invention is that the encryption and decryption logic are completely consistent, and the mode transition is equivalent to the reversed wheel key, enabling the construction of a fast-spreading SP-type block cipher. Also disclosed are X-component design, EWES, and other embodiments, operating mode applications, instruction set design methods, IP core products, CPU products, devices, and programs.

Description

Technical Field

[0001] The invention relates to the field of computer symmetric cryptography design and its industrial application, and more specifically to a block cipher with a self-reversible structure. It also relates to the application of block cipher working modes, instruction set design methods, IP core products, CPU products, devices, and programs. Background Art

[0002] 1. Classic block ciphers include the SP structure, the Feistel structure, the generalized Feistel structure, the MISTY structure, and the Lai-Massey structure. Standard SP structures include the American AES, the Korean ARIA, and the ANUBIS. Block ciphers of the Feistel structure (including the generalized Feistel structure) include DES, the Japanese Camellia, and the Chinese SM4.

[0003] 2. Compared to the Feistel structure, the SP structure has the advantage of high diffusion efficiency. Each round of iteration changes every bit, while the Feistel structure only changes half a bit. The "Number of Rounds" section in "Advanced Encryption Standard (AES) Algorithm: The Design of Rijndael" (authored by Delmon et al., translated by Gu Dawu et al., Tsinghua University Press, January 2003) states that the "full diffusion" round count of two-round AES is superior to at least three-round for the Feistel structure. Compared to the SP structure, the Feistel structure (including the generalized Feistel structure) has the advantage of consistent encryption and decryption logic and requires only the reversed round keys.

[0004] 3. Self-invertible block cipher standards include ARIA, ANUBIS, Khazad, and the "SP Network Structure Lightweight LBT Block Cipher with Consistent Encryption and Decryption" and its references (patent application number 201711093878.4). These designs are all SP structures, not non-Feistel structures, and all use involutive P-transformation components or S-transformation components. In particular, the ARIA algorithm uses a 128x128 involutive matrix with 8 branches, while ANUBIS uses a 32x32 involutive matrix and 8x8 involutive S-boxes. Each round of LBT transformation is a composite structure of two layers of S-boxes and an involutive MDS matrix.

[0005] 4. Block cipher standards all define the logical function transformation from plaintext to ciphertext. For different industrial applications and operating modes, the input and output of the logical function transformation or inverse transformation are obviously not limited to plaintext and ciphertext, but also involve at least IV and noise. Confidentiality modes include ECB mode, CBC mode, OFB mode, CFB mode, CTR mode, XTS disk mode, and self-synchronization mode; authentication modes include CBC-MAC, CMAC, CBCR, and TrCBC; and authenticated encryption modes include Encrypt-then-MAC, OCB, CCM, and GCM. According to textbooks, one group of experts only studies block cipher design, while another group only studies block cipher operating modes and their security assessments. The general consensus is that the industrial application of block ciphers is a combination of a certain block cipher and a certain operating mode. Summary of the Invention

[0006] Instruction manual reading guide statement: The ones with ☆☆ prefix are the highest-level summaries, which mainly summarize the technical problems, inventive points, inventive concepts and core technical effects of the present invention; the ☆ prefix and serial number guide the invention content of the present invention.

[0007] The inventors studied the overall structural advantages and disadvantages of block ciphers such as ARIA, ANUBIS, and Khazad. They discovered that while the self-inverting (involution) block cipher standards described in the background art formally implement a self-inverting structure, meaning the encryption and decryption logic are identical, the wheel key forms used in the encryption and decryption phases differ, with the encryption and decryption wheel keys differing by one P transformation (linear transformation). The inventors also discovered that the self-inverting structures or block cipher standards described in the background art all contain an involutionary S-box component or an involutionary P-transformation component. A long-cherished goal in block cipher design and industrial application is an overall structure that achieves the same high diffusion efficiency as the SP structure and, ideally, uses the wheel keys in reverse order for switching between encryption and decryption modes, as in the Feistel structure.

[0008] In summary, the technical problem and purpose of this invention is to construct a novel self-reversible block cipher that meets the aforementioned properties. Specifically, the embodiments should provide a design that can challenge competing products such as Aes, Sm4, and ARIA. The invention proposes a comprehensive structure that possesses two properties: 1. Diffusion efficiency comparable to that of the SP structure, and 2. Encryption and decryption mode switching is equivalent to the reversed wheel key.

[0009] The main research process and invention results are described as follows:

[0010] The inventors believe that only by creating a completely new overall structure can the above technical problems be solved, because the block cipher structures and standards of the background technology cannot solve the technical problems and invention purposes of the present invention.

[0011] The inventor believes that the key to designing a self-inverting structure is to arrange S components, S -1 Component, PComponent, P -1 Components, ultimately achieving a self-inverting structure consisting of alternating S and P components. It should be noted that the S or P components may or may not be involutive. After numerous permutation and combination experiments, the inventors finally found the first design that meets the objectives of this invention, denoted as ☆**1.

[0012] ☆**1 is the first principle design - block cipher including MDS matrix

[0013] The encryption from plaintext to ciphertext is defined as follows:

[0014] 1. A self-inverting structure that starts with an odd number of rounds and alternates between even and odd numbered rounds.

[0015] The beginning of encryption is the first round, and the end of encryption is the third or fifth round;

[0016] 2. Odd round: Input (st, rkeyi, rkeyi+1), output

[0017] S component transformation

[0018] or

[0019] S component transformation (st+rkeyi)-rkeyi+1;

[0020] Among them, S component transformation () is 16 juxtaposed involution property S boxes,

[0021] The recommended typical design of S box is That is, the nonlinear part of the AES S-box;

[0022] 3. Even round: input (st), output

[0023] MDS -1 (S component transformation (MDS(st)));

[0024] Here, MDS() is a 16-byte*16-byte MDS matrix transformation (maximum distance coding matrix).

[0025] Taking round 5 as an example, let's analyze the basic structural types of the aforementioned block ciphers. First, we remove the wheel key binding and analyze only the binding of the S and P components. Expanding the intermediate calculation steps described below demonstrates that while the SP structure conforms to its technical characteristics, the wheel keys are actually isolated sequentially by the S() logic.

[0026] Plain text->S()->MDS->S()->MDS -1->S()->MDS->S()->MDS -1 ->S()->ciphertext.

[0027] Taking 3 rounds as an example, it is proved that the encryption / decryption conversion can be achieved by reversing the wheel keys. In the encryption phase, there are obviously 4 sets of wheel keys (actually 2 pairs), recorded as Rkey0, Rkey1, Rkey2, Rkey3. In the decryption phase, it is only necessary to reverse the order to Rkey3, Rkey2, Rkey1, Rkey0 to achieve decryption. The concepts of entry and exit operators are introduced for the first time here. The corresponding operation logic is and The operation logic corresponding to "S component transformation (st+rkeyi)-rkeyi+1" is "+" and "-".

[0028] We use differential branch number theory to evaluate ☆**1's resistance to differential analysis, demonstrating its robust diffusion performance. Because the number of branches in the MDS matrix is ​​no less than 17, we obtain a lower bound analysis of the active S-box.

[0029] ☆**1 Algorithm round number: 1 2 3 4 5 6 7 8 9

[0030] Lower bound of the number of active S-boxes: 1 17 18 34 35 51 52 68 69

[0031] Thus, ☆**1 embodiment - a block cipher including an MDS matrix can achieve the technical problems and objectives of the present invention. That is, the diffusion efficiency is the same as that of the SP structure, and the decryption method only requires reversing the wheel keys, which clearly satisfies the self-reversibility property by definition.

[0032] ☆**1 The embodiment gave the inventor great confidence. The inventor continued to explore more embodiments that met the purpose of the invention and refined the common content, and finally summarized the inventive points and inventive concepts.

[0033] The following is the research process of the inventors inventing the X-structure component. For the MDS matrix element of embodiment ☆**1, this element contributes to the full diffusion effect and the maximum branch number effect. For the convenience of description, it is defined that the "quasi-MDS matrix" is a full diffusion matrix (the number of branches is not limited); the square matrix of all 1 elements minus the unit matrix is ​​a typical "quasi-MDS matrix"; obviously, the number of branches of the quasi-MDS matrix can be very small but it can still be used as a component to construct a block cipher. Continuing to reduce the avalanche effect of the component, the full diffusion property matrix or nonlinear transformation is not selected. The inventors tracked the position of the related output bits after the input bits have undergone logical transformations or certain components. The inventors' research results are either self-inverted structures or X structures, where the mathematical formula of the X structure is defined as X({l, r})={F -1 (r),F(l)}.

[0034] The following are some of the research results and summaries. 奇 (), the module combination of even rounds is refined into S 偶 (). Specifically to ☆**1 embodiment, MDS -1 (S component transformation (MDS())) is equal to S even (), S component transformation () is equal to S odd (). The inventors found that defining MDS (S component transformation (MDS -1 The design of ())) equal to S odd () and S component transformation () equal to S even () can also achieve the technical problem and invention purpose of the present invention, and the number of branches is exactly the same. The inventor found that based on the X structure component design concept, the S box and S box inverse logic of AES can also construct S component transformation () that meets the involution property. The specific method is 8 S boxes and 8 S -1 The left 8 bytes of the input are concatenated and passed through 8 boxes, and the result is placed on the right. The right 8 bytes of the input are concatenated and passed through 8 S -1 The result is placed on the left. This type of structural construction method is called X structure. There are more construction methods in the embodiments and terminology, such as based on 2 128 In Example 5, two designs for Seven and Sodd based on ARX instructions or ARX modules are presented for constructing multiplication inverses over a field. In summary, Seven and Sodd are essentially logical transformations that can perform certain diffusion and obfuscation functions. The combined effect of these two functions achieves the effect of full (error) diffusion.

[0035] ☆☆2 In order to intuitively reflect the invention point and inventive concept, the following formula is used to describe the overall structure. The use of the formula description makes it easier to prove the self-reversibility of the overall structure.

[0036] 1. Encryption starts from the first round and ends at an odd-numbered round;

[0037] 2. Odd rounds: Input (st, rkeyi, rkeyi+1), output

[0038] S_odd(rkeyi + st) - rkeyi+1

[0039] where S_odd = S_odd -1 , it should be noted that the "+" and "-" operators can be generalized to the concepts of the input arithmetic unit and the output arithmetic unit;

[0040] 3. Even rounds: Input (st), output

[0041] S_even(st), where it is recommended that S_even ≠ S_odd, and S_even = S_even -1 .

[0042] ☆☆Summary of the invention points. First, the present invention involves 4 indispensable components, and the definitions and construction of the connection relationships of the 4 components are defined through 3 invention points. The first invention point is the structure of the start of an odd round ending and the alternation of even rounds - odd rounds. The other two invention points are stated as follows.

[0043] The second invention point: The input arithmetic unit and the output arithmetic unit are inverse operation logics. The S_odd logic transformation is respectively connected to the output end of the input arithmetic unit and one input end of the output arithmetic unit. The main function of the arithmetic unit is to fuse the entropy (information) of the wheel key with the plaintext or a certain intermediate result. There is a cancellation synergistic effect between the two arithmetic units. Because of the inverse operation logic design, there is a cancellation effect, and the cancellation effect realizes the consistency of the encryption and decryption logics. In addition, if the two pairs of arithmetic units designed can provide a certain non-linear confusion effect, it is also acceptable. The main contribution of this invention point is that the encryption and decryption mode switching can be achieved only by reversing the wheel key with the logic circuit unchanged; here, the S_odd logic must contribute a certain diffusion effect, but the confusion effect depends on the situation. If the arithmetic unit cannot contribute a non-linear confusion effect, the S_odd logic must contribute a sufficient non-linear confusion effect. It should be noted that in addition to the common "+" and "-", "*" and " / " operators, a two-dimensional substitution table controlled by the wheel key can also be selected; in the part of the term explanation and Embodiment 6, the demonstration of the vertical decomposition and horizontal decomposition of "the output of the input arithmetic unit and the output arithmetic unit" will be described in detail.

[0044] The 3rd inventive point: "It is recommended that S_even ≠ S_odd", especially "it is recommended to limit S_even ≠ S_odd"; the scope of substantial protection is all of S_even ≠ S_odd and the part of S_even = S_odd. The above inventive points are the results of research and derivation. The effect contributed by this inventive point is that there is a degree of freedom in the logical selection of S_even and it solves the situation where the poor diffusion ability of S_odd leads to the failure of constructing a block cipher. For a more specific analysis, because S_even ≠ S_odd, there are theoretically a large number of selections for S_even. By contradiction: The inventor found that if it is limited that S_even = S_odd and S_odd cannot achieve full diffusion, then the entire block cipher will fail due to the inability to achieve full diffusion. Here, the meaning of "full diffusion" is that each input symbol is associated with all input symbols; obviously, constructing a "S_even = S_odd" logic with full diffusion is not friendly to both the design of the block cipher and the engineering implementation of the block cipher.

[0045] ☆☆4: Combining the statements of ☆☆2 and ☆☆3, the inventive concept is to construct a self-inverse block cipher for 4 components and 3 inventive points, and its language description is as follows. It should be noted that for the description of the structure, there is no order restriction on the labels.

[0046] ☆1. A self-inverse block cipher includes several groups of round keys. The invention content is an overall structure, and the overall structure is a self-inverse structure starting from odd rounds and alternating with even rounds - odd rounds.

[0047] The above overall structure is defined as follows:

[0048] 1. The start of encryption is the 1st round, and the end of encryption is a certain odd round;

[0049] 2. The odd-round structure is a series structure including 3 components;

[0050] According to the decomposition from input to output in the encryption direction,

[0051] an input arithmetic unit, S_odd, and an output arithmetic unit,

[0052] wherein, the input arithmetic unit and the output arithmetic unit are designed with inverse operation logics, and S_odd is a self-inverse logical transformation;

[0053] 3. The internal connection relationship of odd rounds is as follows:

[0054] The input end of the input arithmetic unit is connected to a certain group of round keys,

[0055] The input end of the output arithmetic unit is connected to a certain group of round keys,

[0056] The input of S_odd is connected to the output end of the input arithmetic unit,

[0057] The output of S_odd is connected to the other input end of the output arithmetic unit;

[0058] 4. An even number of rounds is equivalent to a self-inverse logical transformation, denoted as S even;

[0059] 5. The relationship between Seven and Sodd is, "recommend Seven ≠ Sodd"; specifically, the limited scope of "recommend Seven ≠ Sodd" is a special term, and "recommend Seven ≠ Sodd" means Seven ≠ Sodd for all and Seven = Sodd.

[0060] It should be noted that the "series structure including 3 components" is not limited to 3 components. The following is an example of a series structure of 5 components, based on the formula description of the odd-numbered wheel of ☆☆2, Px -1 (Sqi(rkeyi+Px(st))-rkeyi+1), where Px and Px -1 A pair of reversible transformations is provided in more detail in Example 6 and the explanation of related terms. In short, any design solution that achieves the same technical effect as the present invention by extending the main inventive concept of cancellation as demonstrated and explained in this specification also falls within the scope of protection of the present invention.

[0061] ☆☆5: Demonstrate and state the main effects of the invention:

[0062] 1. The overall structure of the present invention is able to achieve completely consistent encryption and decryption logic, and decryption can be achieved by simply using the wheel keys in reverse order. Substituting into formula ☆☆2, it is clearly established.

[0063] 2. During the construction of the S-even and S-odd logic components, as long as the S-even and S-odd logic of ☆☆2 does not degenerate, an SP-type block cipher can be constructed. Non-degenerate here means that each S-even and S-odd output is associated with at least two input symbols.

[0064] First, the structural construction results of ☆☆2 and ☆1 can solve the technical problems of this invention. The above technical effects, when applied to industrial applications and engineering implementations, can achieve encryption and decryption functions with a single set of hardware, software, or instruction sets, while preserving the wheel key's form. This is because the overall structure of this invention is equivalent to a certain SP structure cipher, and using branch number analysis techniques, it is theoretically possible to construct a low-latency block cipher with good parallelism. In short, it is very user-friendly in terms of software development and implementation, hardware development and implementation, and user use.

[0065] In summary, the technical effects of the invention also include:

[0066] 3. It is very user-friendly for users who call the encryption and decryption modules, as they only need to call one set of software, hardware or instruction set;

[0067] 4. It is friendly to engineers who develop encryption and decryption modules. They only need to focus on developing one set of encryption software, one set of encryption hardware or one set of encryption instruction sets, saving manpower and circuit area.

[0068] ☆2. For the block cipher described in ☆1, the input arithmetic unit and the output arithmetic unit are modulo-2 addition arithmetic units, that is operation;

[0069] The odd rounds only include 3 components, specifically an input arithmetic unit, an output arithmetic unit, and an S-odd logic module;

[0070] It is specified that S-even ≠ S-odd.

[0071] Statement of design principle and technical effect. 1. Compared with the “+” and “-” arithmetic units and the more complex round key selection substitution table, The operation is the design with the least energy consumption and area consumption, which can be efficiently implemented by both the CPU and hardware, and is also the most commonly used arithmetic unit in block cipher design. 2. Since S-even ≠ S-odd is specified, there are theoretically a large number of selections for S-even; compared with the LBT structure in the background technology, S-odd and S-even do not need to be restricted to the design category of full diffusion. 3. Only including 3 components is the simplest and most concise design in engineering, and the formal simplicity is a design advantage; more forms of odd-round construction methods will be stated in the term explanations and embodiments of the arithmetic unit and odd rounds. The inventor believes that the technical effect of a more complex design is that the security may be better at the same computational cost, and a more complex structure is disadvantageous to the security analysis side.

[0072] ☆3. For the block cipher described in ☆1 or ☆2,

[0073] S-even and S-odd share the same non-linear logic.

[0074] Statement of design purpose and technical principle: In order to compete with the 1-beat 1-round mode of the Feistel structure in terms of circuit area performance in the 1-beat 1-round mode, and substantially solve the problem of circuit area saving; the amount of saved area / amount of code space is approximately equal to the area of the non-linear logic that can be shared. The solution is to select S-even and S-odd stages to尽量满足 the area of the non-linear logic that can be shared is large enough.

[0075] The above construction method can be introduced for formula description and evaluation. The shared non-linear logic is denoted as Wire_Share(). Therefore, S-odd and S-even of the present invention are organized into the following expressions:

[0076] S-odd(st) = P-odd -1 (Wire_Share(P-odd(st)))

[0077] and S-even(st) = P-even -1 (Wire_Share(P-even(st)).

[0078] Obviously, by simply increasing the area of the selection circuit, Wire_Share() can be multiplexed. The following is the behavioral description of the Verilog hardware code, where flage guides the selection of either S odd or S even.

[0079] Input (st, flage), output out128;

[0080] assign w_temp = Wire_Share(flage == 1? P_odd(st) : P_even(st));

[0081] assign out128 = flage == 1? P_odd -1 (w_temp) : P_even -1 (w_temp).

[0082] Evaluate the area consumption of one round and one beat of the present invention from the above expressions. The total area of the encryption and decryption logic and the saved area are approximately: P_odd -1 () + P_odd() + P_even -1 + P_even + Wire_Share() + the area of the selection circuit and Wire_Share().

[0083] Furthermore, it is recommended that one of P_odd and P_even be selected as a direct transformation; typically, the structure is such that S_odd(st) = P -1 (Wire_Share(P(st))), S_even = Wire_Share(). Define S_even() = X() and S_odd = P -1 (X(P())). The basic idea is that in the physical S_odd circuit, X({l, r}) = {Sx -1The area ratio of {(r), Sx(l)} is as large as possible. The X component is also required to have a P that works with it to at least achieve entropy exchange between {l, r}. Of course, the P selection must have minimal industrial implementation overhead and be able to actively increase the number of differentially active S-boxes. Examining the results of Example 2, the combinational circuit for the multiplexing mode in the 1-beat, 1-round mode consumes 1603 cells, the combinational circuit for the 1-beat, 2-round mode with S-odd consumes 1508 cells, and the combinational circuit for S-even consumes 1016 cells. Therefore, it can be assumed that the circuit area ratio for the 1-beat, 1-round mode with multiplexing is 63.38% (1016 / 1603). Taking S-odd as a unit, the ratio of the circuit for the multiplexing mode to S-odd is 106.3% (1603 / 1508). The closer the former and latter indicators are to 1, the better. In summary, in EWES's 1-beat, 1-round mode, the area ratio of the multiplexing mode circuit to the X component is 63.38%. The area of ​​the multiplexing mode circuit in this 1-beat, 1-round mode is 106.3% of the area of ​​the ALU + S-odd logic, while the selection circuit consumes only 6.3%. The circuit area analysis of the above embodiment also demonstrates that the area consumed in the 1-beat, 1-round mode is essentially equivalent to the largest area of ​​the S-even and S-odd logics. The overall results show that the selection circuit area is indeed relatively small, so the area saved is essentially equal to Wire_Share() minus the selection circuit area.

[0084] ☆4. The block cipher according to ☆3,

[0085] The reused nonlinear logic is equal to the X-structured logic transformation, where the definition of the X-structured logic transformation is that the nonlinear transformation F of the left input is placed on the right, and the nonlinear transformation F of the right input is placed on the right. -1 Put it on the left.

[0086] Design principle and technical effect description. As mentioned above, the X structure component is also one of the inventive points of the embodiment of the present invention. The X structure component can construct S odd or S even components. Because the X structure has many advantages, it is defined that X() = Wire_Share(), where the mathematical formula of the X structure is defined as X({l, r}) = {F -1 (r),F(l)}.

[0087] Obviously, the X structure is self-inverted (involutive). It should be noted that F and F -1 Does not enforce the self-inverse property (i.e. F = F -1 ).

[0088] The following lists the main advantages of the X structure component, which are also the advantages of block cipher ☆4.

[0089] 1. To construct self-inverting S-even and S-odd components, there is no need to use self-inverting components, which obviously expands the selection range.

[0090] 2. In some cases, F and F -1 can be implemented in parallel. For example, in the embodiment EWES, on a superscalar cpu platform, the pairing of lookup table instructions and calculation instructions is achieved through instruction pairing.

[0091] ☆5. The block cipher according to ☆4,

[0092] limits the length of the block cipher to 8 bytes, 16 bytes or 32 bytes;

[0093] limits the number of end rounds of the block cipher to N, where N is an odd number greater than or equal to 5;

[0094] limits the said F to be designed in SP structure, where the S box is designed as the inverse element in the 256 field and P has a linear diffusion effect.

[0095] Statement of design principle and technical effect. By limiting the SP structure, two benefits are brought:

[0096] 1) Since the P element of the F component already has a certain linear diffusion effect, when designing P and P -1 , the design pressure of the linear layer index is greatly reduced. More specifically, when P is in a certain case of exclusive-OR gates, it is easier to select a design with a very large differential branch number. The EWES algorithm in the embodiment is a design model. The branch number of 2 rounds of EWES is 10, but the P component of EWES only has 5 64-bit operations. Obviously, these linear relationships are not sufficient to support the design with a branch number of 10; therefore, the linear transformation of the F component of the EWES algorithm makes an indispensable contribution to the branch number as high as 10.

[0097] 2) Similar to the large table lookup implementation of AES, it is friendly to superscalar instructions. Because sp -1 (r) and sp(l) are implemented in parallel, and the sp table lookup implementation and the operation of p -1 can be executed in parallel through instruction pairing. The measured results are shown in the performance of the EWES and AES in the X64 platform. The main definition of the EWES algorithm is that S_odd(st) = P -1 (X(P(st))), S_even = X(), where X({l, r}) = {sp -1 (r), sp(l)}.

[0098] ☆6. The block cipher according to ☆5,

[0099] limits the length of the block cipher to 16 bytes,

[0100] limits the differential branch number to be greater than or equal to 10.

[0101] The purpose and significance of the above design is that the length of the block cipher is 16 bytes, which is currently the most widely used industrial interface standard; compared with industrial standards such as ARIA and AES, the number of differential branches greater than or equal to 10 is a large branch number design. The strong correlation and indivisibility of at least 10 bytes between each two layers of S-boxes is a fact. The inventor believes that regardless of the type of block cipher analysis, the number of branches of 10 is sufficient to support a minimum security of 80 bytes, which is sufficient for IoT application scenarios. It should be noted that the method for determining the number of differential branches is to determine the minimum code weight of not less than 10 through the check matrix. More specifically, by solving the equation, it is proved that there is no correlation between any 9 columns of the 32 columns of the check matrix.

[0102] ☆7. The block cipher according to ☆6,

[0103] Encryption starts from round 1 and ends at round 7;

[0104] 8 sets of wheel keys, recorded as rkey0-rkey7;

[0105] Odd rounds: input st, output

[0106] S Qi

[0107] Where, S(t)=P -1 (X(P(t)));

[0108] Even round: input st, output X(st);

[0109] The called linear diffusion component P: is defined based on the 64-bit modulo 2 addition instruction and the circular shift instruction. The input is {l, r}. The intermediate steps of the calculation are:

[0110] The called X() component: define X({l,r}) = {Sx -1 (r),Sx(l)}, where Sx -1 The (r) element is the sp structure transformation. More specifically, the p transformation part is a linear combination of 9 64-bit cyclic shifts. The 9 left shift parameters are 2, 0, 8, 16, 24, 32, 40, 48, and 56. The intermediate result of the linear combination is passed through 8 juxtaposed S -1 Box, S -1 Defined by the following S-box;

[0111] The called S-box: Based on the inverse element design on the GF256 field, due to space limitations, the table lookup output of 0x00-0xff is shown in Example 2 - EWES algorithm. The following is the table lookup output of 0x00-0x0f: b2 c0 a0 48 54 fc 99 2f 39 e3 2cf7 cc d8 5a 8d; the definition of other modules, P -1 () module and Sx() module refer to P() module and Sx -1 ()Module definition.

[0112] The above is also extracted from Example EWES, see the Example and its related drawings for details.

[0113] ☆8. An operating mode (application method) based on a block cipher, wherein the operating mode is one of a confidentiality mode, an authenticated operating mode, or an authenticated encryption mode, and the invoked block cipher meets the definitions of ☆1-7.

[0114] Paragraph 4 of the "Background Technology" section states that block cipher standards are not limited to encryption and decryption. There are many different operating modes and related standards. For specific modes, refer to cryptography textbooks and industry standards. Block cipher standards are publicly recognized for their performance and security. Regarding the performance and security of operating modes, researchers can review research findings or published national standardization documents. Therefore, a block cipher standard combined with a specific operating mode represents the current form of industrial application.

[0115] In order to illustrate the position of the instruction set construction method of the present invention in the industrial ecology, the following supplementary explanation of common knowledge is given.

[0116] The definition of an instruction set architecture (ISA) is the interface and standard between computer hardware and system software. It refers to the computing functional characteristics and conceptual structure visible to machine language programmers or operating system, compiler, and interpreter designers. Its core component is the instruction system, which also includes data type and data format definitions, register organization, I / O addressing and data transmission methods, interrupt structure, computer state definition and switching, memory protection, etc. The quality of ISA design directly determines the performance and cost of the computer. The instruction set is the core of the computer ecosystem. Well-known instruction set architectures include Intel and AMD's X64 series, ARM series, RISC-V, and ALPHE series.

[0117] According to the hierarchical division of the industrial ecosystem, the definition of the computer field from top to bottom is: user / application->operating system->instruction set architecture (ISA)->microarchitecture->IP hard core-(tapeout)->CPU chip.

[0118] ☆9. A method for constructing an instruction set, wherein the defined instructions functionally implement the S-odd logical transformations and / or the S-even logical transformations defined in ☆1-7. The "or" condition means that either the S-even or S-odd logical transformation is selected, and the other logical transformation can be quickly calculated using existing general-purpose instructions.

[0119] First, it should be noted that general-purpose instruction sets can implement any standard block cipher. The purpose of new instructions is to accelerate the encryption and decryption speed of block ciphers, which is meaningful. Based on the above reasons, the acceleration of the instruction set construction method focuses on the S-odd and S-even logical transformations. The purpose of the invention of ☆9 is to define new instructions that can significantly accelerate the execution speed of S-even and / or S-odd. Furthermore, instructions designed to accelerate only S-even and S-odd nonlinear transformations also fall within the scope of protection of ☆9, as detailed in paragraph "#4" below.

[0120] Defining instructions on instruction set architectures to accelerate block ciphers or hash algorithms has industry precedent and related patents. Intel, in particular, has a large portfolio of patents targeting AES and hash algorithms. Furthermore, Intel's instruction set manuals implement some of these patents as appropriate. For example, the Intel instruction set manuals define the AES-NI and VAES instructions: AESENC, AESENCLAST, AESDEC, AESDECLAST, AESKEYGENASSIST, and AESIMC. Four instructions must be defined and used to perform AES encryption and decryption: AESENC, AESENCLAST, AESDEC, and AESDECLAST. The Loongson instruction set also defines instructions to accelerate SM4.

[0121] Because the encryption and decryption logic of the present invention is consistent and the encryption and decryption switching only requires the reverse wheel key, the present invention only needs to define and use 2 instructions. The 1-beat 2-round mode is, S odd->S even instruction 1, S odd instruction 1. The 1-beat 1-round mode is, S odd instruction 1, S even instruction 1. The inventor believes that 2 instructions are more conducive to the wiring design of the micro-architecture layer and IP hard core. In Example 2, a reference effect of S odd and S even multiplexing nonlinear logic is given. Three instruction set design demonstrations are given below. According to the recommendation from performance priority to area priority, the 1-line 2-round mode is, The 1-line 1-round mode placed in front, The following description is for the EWES embodiment, S even = X (st) and S odd = P -1 (X(P(st))), its implementation principle can be extended to other block ciphers that meet the definition of ☆1-7.

[0122] #1 1 line 2 rounds model

[0123] ALU type 3-operand instruction; the operands are recorded as %xmmx, %xmmy, %xmmz, and the opcode definitions are as follows.

[0124] The logical function corresponding to EWES_odd is: input (%xmmx, %xmmy, %xmmz)

[0125]

[0126] The logical function corresponding to EWES_odd_env is: input (%xmmx, %xmmy, %xmmz)

[0127] %xmmz←X(EWES_odd(%xmmx,%xmmy,%xmmz)).

[0128] Formally, EWES_odd_env is the output of EWES_odd concatenated with X(). Microarchitectural design recommendations prioritize speed with a one-step implementation of EWES_odd_env, while prioritize area with a two-step implementation, where one step is used to calculate EWES_odd and one step is used to calculate X().

[0129] #2 Pre-placed 1-line 1-round mode

[0130] ALU type 3-operand instruction; the operands are recorded as %xmmx, %xmmy, %xmmz, and the opcode definitions are as follows.

[0131] EWES_xor_odd(%xmmx,%xmmy,%xmmz)

[0132] implement:

[0133] EWES_xor_env(%xmmx,%xmmy,%xmmz)

[0134] implement:

[0135] #3 Post-positioned 1-line 1-wheel mode

[0136] ALU type 3-operand instruction; the operands are recorded as %xmmx, %xmmy, %xmmz, and the opcode definitions are as follows.

[0137] EWES_odd_xor(%xmmx,%xmmy,%xmmz)

[0138] implement:

[0139] EWES_env_xor(%xmmx,%xmmy,%xmmz)

[0140] implement:

[0141] The three-operand description above is merely a functional definition. The Intel instruction set manual and related Intel patents provide sufficient reference examples for implementing these three operands. For example, a two-round %xmmz call can be implicitly invoked, for example, by specifying %xmmz as %xmm0. Alternatively, refer to the reference example where all three operands are input registers. Reference implementations of the post-positioned single-line, single-round mode include AESENC, AESENCLAST, VAESENC, and VAESENC. Integration with existing instruction sets (ISAs) depends on the copyright holders of the instruction sets. For example, the implicit approach has the advantage of a fixed critical path, making it easier to generate physical critical path circuits. However, the implicit approach is disadvantageous in terms of pipeline compatibility with CPU microarchitectures.

[0142] #4 Implement instructions for X components or 1 / 2 of X components

[0143] First, some instruction sets don't support 128-bit registers, or the instruction set designers believe that directly constructing a single-pass, one-round pattern or a single-pass, two-round pattern consumes too much area. For engineering applications, accelerating only the nonlinear portion of the X component yields satisfactory results. It can be assumed that the designed instructions only accelerate the nonlinear transformations of S even and S odd, while other logical operations are performed at high speed by the general instruction set. The inventors simulated the practical effects of a certain embodiment on an X64 platform, demonstrating the practical effects of accelerating the Sx(r) and Sx(l) elements of the X component using two hard instructions.

[0144] Comparing the X64 performance of Example EWES and Example 3.1, on the X64 platform, the performance of a single-channel EWES is 12.5C / B. If the X component Sx -1 (r) is defined as (r*A) mod 2 64 , Sx(l) element is defined as (r*A -1 )mod2 64 , the measured result is 4.9C / B. If EWES's Sx -1 The execution efficiency of the Sx(r) and Sx(l) instructions is equivalent to the multiplication instructions of the i7-4770, with a performance of 4.9C / B, equivalent to a 250% improvement. Therefore, the design of instructions only accelerates the nonlinear part of S even and S odd, and the effect is also very significant.

[0145] Based on the above statements, we recommend using one instruction to implement the "S odd + S even" design, which is defined as follows.

[0146] ☆10. According to the instruction set construction method described in ☆9,

[0147] The inlet operator and the outlet operator are modulo 2 addition operators, that is, Operation;

[0148] The instructions constructed are two AUL type instructions, the operand mnemonics are %xmmx, %xmmy, %xmmz, and the instruction mnemonics that define the odd round function are fun_odd(%xmmx, %xmmy, %xmmz).

[0149]

[0150] Define the instruction mnemonic for odd round + even round function, fun_odd_env(%xmmx, %xmmy, %xmmz)

[0151] %xmmz←Seven(fun_odd(%xmmx,%xmmy,%xmmz));

[0152] The entity call mode of operand %xmmz is one of the following three situations: implicit call, 3-operand call, and coprocessor module call.

[0153] The implicit call is demonstrated by the mul / imul instructions of i386, with the eax / rax and edx / rdx registers as implicit source operands; the 3-operand call is demonstrated by the FMA3 instruction set and Intel's patented "three-operand addition instruction" - CN102103486B; the coprocessor call can refer to the custom instruction set part of RISC-V, and the called coprocessor core module can refer to the appendix of this invention. Figure 6 -EWES Example 1 takes 2 rounds of state machine calculation circuit.

[0154] In order to state the position of the IP core (intellectual Property) products related to the present invention in the industrial ecology, common knowledge is supplemented again. Now the SOC ecology (System On chip) is prevalent in the chip industry. Chip manufacturers often reduce the complexity of design by purchasing third-party hardware IP cores, and concentrate limited resources on the development of key modules of integrated design cores; in short, purchasing IP core products to assemble chips is one of the current industrial ecosystems. The IP core may be in various forms, including hardware code (behavioral level description of the algorithm), netlist or layout (GDS). The layout is essentially a hardware IP core, which is a drawing for chip tape-out. Currently, companies that sell IP hard core products include ARM, Sysnopsys, and TSMC.

[0155] ☆11. An IP core product, the IP core includes the S-odd logic transformation and / or the S-even logic transformation defined by ☆1-7, or the IP core includes a block cipher operation module defined by ☆1-7.

[0156] The block cipher constructed by the present invention is implemented in the IP core product in a manner including but not limited to, an instruction set circuit for accelerating block cipher operations, especially a low-latency wiring design result which can be sold as a product. Figure 6 A block cipher computing component based on finite state machine automaton.

[0157] ☆12. A CPU chip, wherein the defined instructions functionally implement the S-odd logical transformation described in ☆1-7, and the S-even logical transformation. The "or" condition means that either the S-even logical transformation or the S-odd logical transformation is selected, and the other logical transformation can be quickly calculated using other general-purpose instructions. For details, refer to the instruction set construction method in section ☆9.

[0158] Because the chip tape-out is based on the IP hard core, the protection content and definition can refer to an IP core product.

[0159] ☆13. An information processing device comprising a block cipher computing module capable of implementing the functions of ☆1-7.

[0160] The EWES embodiment of the present invention is a competitor to SM4 and AES. Therefore, in theory, EWES or the present invention can replace SM4 and AES modules in applications and devices related to SM4 and AES. According to Chinese standard guidelines, commercial cryptographic products based on the SM4 algorithm include at least USB smart cryptographic keys, cloud server cryptographic machines, IPSec VPN gateways, and SSL VPN gateways. Related industrial applications. According to the relevant operating modes and standards described in Background Technology 4, physical products such as communication terminals, WiFi, and communication handsets can also be used. Communication modules use authentication and encryption protection modules.

[0161] ☆14. A computer program product comprising a computer program or instructions, characterized in that when the computer program or instructions are executed, the block cipher computing function defined in ☆1-7 is implemented.

[0162] Program / instruction types include binary executable code and directly / indirectly executed scripting languages, where indirect means compiled and executed by a general compiler, such as Go language code. Computers here include but are not limited to general-purpose CPUs, single-chip microcomputers, and programmable hardware such as FPGAs. Therefore, the corresponding code forms are: compilable code includes but is not limited to source code such as C language and Go language, scripting languages ​​include but are not limited to Java and shell, and FPGA code includes but is not limited to downloadable and executable hardware code and corresponding behavioral-level description hardware code. BRIEF DESCRIPTION OF THE DRAWINGS

[0163] The embodiments and drawings are provided for the purpose of explaining the present invention and are not to be construed as unduly limiting the present invention. It should be noted that when coloring is required to distinguish between odd-numbered wheel modules, even-numbered wheel modules, and arithmetic components, the coloring principle is that the odd-numbered wheel components or modules as a whole are colored blue or purple, the arithmetic components must be colored purple, and the even-numbered wheel modules and their decomposed components are colored red.

[0164] Figure 1 .Example 1 of the present invention - Structure diagram (including block cipher of MDS matrix transformation)

[0165] Figure 2 .EWES Example P Component and P -1 Component Definition

[0166] Figure 3 .Principle description of EWES embodiment X components

[0167] Figure 4 .EWES Implementation of SX -1 Component Definition

[0168] Figure 5 SX element definition of .EWES embodiment

[0169] Figure 6 .EWES Example 1: 2-round state machine calculation circuit

[0170] Figure 7 A more general form of the X structure of Example 3

[0171] Figure 8 .S-box layer design example

[0172] Figure 9 .6 ways to connect wheel keys, S odd and arithmetic units

[0173] Figure 10 More complex connection between wheel key, S odd and operator DETAILED DESCRIPTION

[0174] To guide readers through the detailed description more quickly and efficiently, we've organized the key content and examples index below. The glossary includes "recommendation that S even ≠ S odd," "odd round," "entry and exit operators," and "X-structured components." Other key points include "Self-Assessment and Declaration of the Novelty of the Invention."

[0175] Example 1. Research on block ciphers including MDS matrix and its extension

[0176] Example 2. EWES (AES and SM4 Competitor)

[0177] Example 3. Example of combining a certain X component with a multiplication instruction

[0178] Example 4. Example of DES S-box substitution table and corresponding quasi-MDS matrix

[0179] Example 5. Example of constructing X component based on ARX structure

[0180] Example 6. Horizontal and vertical design of the operator

[0181] Example 7.X -1 S-odd and S-even in logic design

[0182] Explanation of terms:

[0183] 1. "Recommendation S even ≠ S odd"

[0184] Special terms used to define the scope of protection of the present invention and explain the third invention point. The scope is defined as all parts where Seven ≠ Sodd and all parts where Seven = Sodd. The scope of protection for Seven = Sodd primarily excludes the structure and derivatives of the background art LBT, as detailed in the "Self-Assessment and Declaration of the Novelty of the Present Invention" below.

[0185] Statement of the range of Seven=Sodd:

[0186] Protection range elimination background technology LBT structure: the S odd is "S box layer -> involution MDS matrix -> S -1 Box layer", the operator is and

[0187] It is generally believed that Sodd must be designed to have strong diffusion logic. A typical example is Example 4: DES S-box substitution table and involution quasi-MDS matrix. The main structure is: 1. Seven = Sodd, where Sodd is equal to the involution quasi-MDS matrix or MDS matrix. As stated in the Summary of the Invention, the quasi-MDS matrix has full diffusion capability but fewer branches than the MDS matrix. 2. The operator is a substitution table controlled by the wheel key. The selected substitution table, i.e., the corresponding S-box, provides a nonlinear obfuscation effect.

[0188] Statements for the range Seven ≠ Sodd:

[0189] The third inventive point of this invention is that, as previously mentioned, because S even ≠ S odd, there are many more S even options available. More importantly, the selection of S even and S odd does not need to be limited to full diffusion wheel designs and involutive MDS matrix elements. The use of X-structured components to construct S even and S odd is particularly recommended. This is primarily due to the fact that S even or S odd can be constructed without the need for involutive elements.

[0190] 2. Odd-numbered wheels of the present invention

[0191] Essential technical features of the present invention. As defined in the Summary of the Invention section, the odd-numbered round is a series structure consisting of three components, which are decomposed in the encryption direction into an entry operator, S odd, and an exit operator. It is also defined that the entry operator and the exit operator are designed to be inverse operations of each other, and S odd is a self-inverse logical transformation.

[0192] The meaning of "a series structure comprising three components" is not limited to three components. The following is an example of a series structure consisting of five components, described by the formula of an odd number of rounds of ☆☆2, Px -1 (Sqi(rkeyi+Px(st))-rkeyi+1), where Px and Px -1 It is a pair of reversible transformations. Therefore, the description of the three components is only a statement of the main idea and the simplest special case. In fact, there are more derivative design schemes. These derivative design schemes include, in Example 6, "the output of the entry operator and the exit operator" according to the vertical decomposition and horizontal decomposition, and the docking with S-odd logic on the basis of the vertical decomposition and horizontal decomposition; Example 7. Design demonstration of S-odd and S-even logic transformation. In short, the odd wheel is a reversible series structure, including but not limited to three components; all derivative designs are in line with the main idea of ​​the second invention point. The derivative expression of the main idea of ​​the second invention point is to allow more entry operator elements and more exit operator elements, wherein more entry operator elements and more exit operator elements are actually inverse operation relationships with each other, and the basic principle of the docking of S-odd logic with the operator elements is that the entry operator elements and the exit operator elements are designed according to the cancellation principle; thereby achieving the overall effect, the logic circuit of the odd wheel remains unchanged, and the encryption and decryption mode switching can be achieved by simply using the wheel key in reverse.

[0193] 3. Input ALU and Output ALU

[0194] The two indispensable components of the odd wheel; the connection relationship with S odd and the working principle of the operator are described in the second invention point of the invention content. and "+" and "-", "*" and " / " can also select the wheel key control selection substitution table operation mode; the definition of the substitution table role is controlled by the wheel key to select an S box or S -1 Box, the entry operator is S box, and the corresponding exit operator is S -1 Box. Example 4 gives an embodiment of the S-box based on the DES algorithm; the embodiment of "+" and "-" is IBM's MARS algorithm. It should be noted that the entry operator and the exit operator are not limited to a formal definition, but actually embody the main idea of ​​cooperative cancellation. More specifically, they can be decomposed vertically and horizontally; see Example 6 "The output of the entry operator and the exit operator" for details, which implements the connection with the S-odd logic based on the vertical decomposition and horizontal decomposition. Regardless of vertical decomposition or horizontal decomposition, the basic principle is that they can be cancelled, and ultimately the whole can be cancelled, thereby achieving the self-reversibility of the odd rounds, and ultimately achieving the self-reversibility of the entire block cipher.

[0195] 4.X structural components

[0196] Embodiment Invention point. Method for constructing S odd or S even components. Definition of X structure, X({l, r})={F -1 (r), F(l)}. The language description is defined as the definition of the X structure logical transformation is that the nonlinear transformation F of the left input is placed on the right, and the nonlinear transformation F of the right input is placed on the right. -1 On the left, the main conclusions and effects related to the X structural component.

[0197] 1. The X structural component is self-inverted (involutive), where F -1 No need to restrict to self-inversion (i.e. F = F -1 ).

[0198] Prove that: X(X({l,r}))={l,r}, that is, the involution property.

[0199] Proof: X(X({l,r}))=X({F -1 (r),F(l)})

[0200] ={F -1 (F(l)),F(F -1 (r))}={l,r}.

[0201] 2. In some cases, F and F -1 It can be executed in parallel, such as a superscalar CPU, where table lookup and operation are performed in parallel through instruction pairing.

[0202] It should be noted that the above definitions of left and right are based on F and F -1The input and output of the entity information may differ by one bit permutation; for example Figure 3 and Figure 7 The logic circuits are exactly the same, with no essential difference.

[0203] Self-assessment and declaration of novelty of the invention:

[0204] To assess the novelty of the invention, the inventors searched public literature to the best of their ability for self-reversible block ciphers. When Seven = Sodd, certain technical feature combinations of the LBT in the background patent CN107707343 are consistent with some of the technical features of the present invention. Although the 16-round design of the LBT does not conform to the technical feature of ending with an odd number of rounds, the inventors declare that they have eliminated the relevant LBT scenarios. They declare that the following technical feature combinations are voluntarily abandoned.

[0205] 1. Encryption starts from the first round and ends at an odd round; the inverse operator is and

[0206] 2. Limit S even = S odd, where S even is S layer -> involutive MDS matrix -> S -1 layer.

[0207] The following is the inventor's technical analysis of a background patent, which serves as a counterpoint to the technical advantages of the third invention point of this invention. Paragraph

[0034] of patent CN107707343 states: "The diffusion speed of the round function of the LBT cipher algorithm is twice that of the round function of the AES cipher algorithm. In terms of resistance to differential and linear attacks, the number of active S-boxes in this cipher round function structure is twice that of the AES cipher round function structure." Does a single round use two layers of S-boxes and consume the computational delay of two layers of S-boxes? The inventor believes that in terms of design effectiveness, the LBT cipher and the present invention's limitation of S even = S odd necessitate the design of complex logic functions to achieve full diffusion in a single round. This limitation is both an advantage and a disadvantage. The advantage is that the diffusion and obfuscation effects of a single round must be very high performance, while the accompanying disadvantage is that the complex single-round logic is not friendly to engineering implementation.

[0208] Example 1. Research on block ciphers including MDS matrix and their replacement extension

[0209] Summary of the invention☆**1 has described embodiment 3.1, the design principle and main parameters of the overall structure can be compared Figure 1 It's a known fact that the MDS matrix can achieve full symbol diffusion with a single MDS (Maximum Distance Coding Matrix) transformation, providing the maximum branch contribution. Therefore, it's the most suitable demonstration of the principles of the present invention. By replacing components or elements, we can gain a deeper understanding of the design principles and related technical effects of the overall structure of the present invention.

[0210] 3.1 Reference Figure 1 , the block cipher including the MDS matrix is defined as follows:

[0211] 1) The self-inverse structure at the start of odd rounds and the alternation between even rounds and odd rounds,

[0212] The encryption starts from the 1st round, and the encryption ends at the 3rd round or the 5th round;

[0213] 2) The logical transformation and connection relationship in odd rounds are that the input is (st, rkeyi, rkeyi+1),

[0214] The output

[0215] S_odd

[0216] or

[0217] S_odd(st + rkeyi) - rkeyi+1;

[0218] Among them, S_odd is the S-component transformation, and the definition of S-component transformation() is 16 juxtaposed involutory S-boxes; the definition of color is as described above, and the blue solid box represents S_odd, and the blue solid box represents S_even;

[0219] 3) The logical transformation in even rounds is that the input is (st), and the output

[0220] MDS -1 (S-component transformation(MDS(st)));

[0221] Among them, MDS() is the MDS matrix transformation of the 16-byte X 16-byte specification.

[0222] 3.2 The embodiment replaces the S-component transformation with the X-structure component form

[0223] Use 8 S-boxes of the AES algorithm (equivalent to plus the S-boxes of the linear affine transformation module) and 8 S -1 boxes to construct the S-component transformation. The X-structure component is defined as follows: the 8 bytes on the left pass through 8 S-boxes in parallel and the results are placed on the right, and the 8 bytes on the right pass through 8 S -1 boxes in parallel and the results are placed on the left.

[0224] Obviously, the whole is involutory (self-inverse) after being replaced, but there is no involutory S-box element.

[0225] Here, more demonstrations of the S-box layer design are added. Figure 8 The S-box layer is involutory, which includes 2 types of S-boxes. One is the S-box of the AES algorithm, and the other is the X -1 operation on the 256-element field; so it is also possible to construct the S layer based on Figure 8 the idea. It should be noted that, Figure 8Another design idea embodied is that an involutive overall transformation component can be constructed with non-involutive elements by adopting an X structure.

[0226] 3.3 Example Replace S_odd with PL -1 (S_even(PL()))

[0227] S_odd(st)=PL -1 (S_even(PL())), where PL is a matrix transformation of bit or byte permutation or an instruction operation of related permutation (PL has no arithmetic operation), and where MDS(PL(MDS -1 (X))) must be a matrix transformation with full diffusion property or close to full diffusion property.

[0228] Considering the complexity of MDS, a non-degenerate PL can be found. Example 3.2 proves that there exists a design where S_odd and S_even only differ in the PL transformation; the inventor believes through simulation analysis that generally a qualified PL can be found if the linear diffusion ability of S_odd / S_even is strong.

[0229] 3.4 Example of Duality Property Design [[ID=二十]]

[0230] A design with exactly the same security as that of Example 3.1. Due to the natural property of the overall structure of the present invention, for a given overall structure of the present invention, there exists a dual design, which is essentially the interchange of S_even and S_odd.

[0231] S_odd(st)=MDS(S component transformation(MDS -1 (st)));

[0232] S_even(st)=S component transformation(st).

[0233] In terms of differential analysis and linear analysis, only the content between S-box layers is analyzed, so the security of Examples 3.1 and 3.4 is exactly the same.

[0234] Example 2. EWES (Competitors of AES and SM4) [[ID=三七]]

[0235] 2.1 Introduction

[0236] AES and SM4 are industrial standards for block ciphers. The inventors believe that the main disadvantage of AES is the inconsistency between encryption and decryption logic, and the main disadvantage of SM4 is that the low-diffusion design with 32 rounds results in poor low-latency performance, especially CBC encryption performance in hardware. Because the design concept is economic wiring and economic instruction set (economic wire & economic instruction set), the competitor is named EWES according to the English abbreviation. Two specifications are now disclosed: EWES-128-7-1024 is 8 groups of 128-bit wheel keys / 7 rounds / nominal 128-bit security; EWES-128-7-256 is 2 groups of 128-bit wheel keys / 7 rounds / nominal 80-bit security. Key extension to wheel keys does not belong to the content of this invention, so it is directly stated from the wheel keys. The difference between EWES-128-7-256 and EWES-128-7-1024 is that two groups of keys are copied into eight groups in sequence during the key usage phase. Therefore, only EWES-128-7-1024 is described below.

[0237] 2.2 The EWES standard is defined in a structured language, described in hardware module format, with no order restriction on numbering.

[0238] EWES-128-7-1024 Standard Definition

[0239] Packet width 16 bytes;

[0240] 1. At the end of the 7th round, 8 sets of wheel passwords are recorded as rkey0-rkey7;

[0241] 2. Odd rounds: input st, output

[0242] S Qi

[0243] Where, S(t)=P -1 (X(P(t)));

[0244] 3. Even round: input st, output X(st);

[0245] 4. The called linear diffusion component P: is defined based on the 64-bit modulo 2 addition instruction and the circular shift instruction, with input {l, r}. The intermediate steps of the definition are:

[0246] This module controls, Figure 2 .EWES Example P Component and P -1 Definition of the component;

[0247] 5. Called X component: define X({l,r})={Sx -1(r),Sx(l)}, where Sx -1 The (r) element is the sp structure transformation. More specifically, the p transformation part is a linear combination of 9 64-bit cyclic shifts. The 9 left shift parameters are 2, 0, 8, 16, 24, 32, 40, 48, and 56. The middle of the linear combination is passed through 8 juxtaposed S -1 Box, S -1 Defined by the following S-box;

[0248] The above X components and their components are broken down and compared. Figure 3 .X component principle description; Figure 4 SX of .EWES -1 Component definition; Figure 5 , SX component definition of EWES;

[0249] 6. The called S-box: based on the inverse element of the GF256 field, the lookup table output table of 0x00-0xff;

[0250]

[0251]

[0252] 7.P -1 () module and Sx() module refer to the above P() and Sx -1 The definition of () is not repeated here; the design of the S-box and the recommended tower domain expression are omitted in this article.

[0253] 2.3 Test vectors for components and elements

[0254] Sx -1 (64'h0706050403020100)={S -1 (1c)_S -1 (18)_S -1 (14)_S -1 (10)_S -1 (0c)_S -1 (08)_S -1 (04)_S -1 (00)}=64'h6bdc13daea945d23;

[0255] X(128'h0706050403020100_0b0b0a0a09090808)=128'h7dfdcb0b38f8ce4e_6bdc13daea945d23;

[0256] P(128'h 0411100001040014 0011100001000010)=128'h 40;

[0257] 2.4EWES-128—7-256 Test Vectors

[0258] {Rkey1, rkey0} copies {Rkey3, rkey2}, {Rkey5, rkey4}, {Rkey7, rkey6}, where {Rkey1, rkey0} =

[0259] 0xd7404121f8b8f23af34f1e3f1796967a_9d4b00e365727ad013d044f4f0ad8b6a.

[0260] Plaintext: 0x 0000000000000000 0000000000000000

[0261] Encryption 1: 0x 70545b8d3ccc6509 25772368a4e1ff56

[0262] Encryption 2nd time: 0x 102bdd3e4d0b8206 770e9be805a61d43

[0263] 2.5X64 platform performance

[0264] Drawing on the AES big table lookup implementation, the SX(l) element of EWES also looks up the big table; but while looking up the big table, the RORX instruction implements Sx in parallel. -1 The linear part of the (r) element, the RORX instruction and the table lookup operation of SX(l) benefit from instruction pairing. In the dual-path state, the P component and P -1 Components can also benefit from greater and better instruction pairing. The following test results demonstrate that a well-designed X component can benefit from instruction-level parallelism. More specifically, a 12.5C / B ratio is the result of good instruction pairing. The above analysis and measured performance support the technical effectiveness of the block ciphers described in ☆5 and ☆4, where the block cipher F is limited to an SP structure design.

[0265] Test platform and test plan

[0266] Intel i7-4770 @ 3.4GB RAM, 16GB RAM; Windows 7 64-bit operating system, gcc version 4.8.1 or higher, compiled with -O4. The millisecond output of GetTickCount() is used as the numerator of MByte / S, and the output of the rdtsc instruction is used as the numerator of C / B. This document defines C / B as the CPU clock consumption per byte processed. The benchmark AES-128 source code is OpenSSL version 1.1. Continuous single-pass encryption corresponds to peak CBC encryption performance, while dual-pass encryption metrics correspond to peak CBC decryption, ECB, and CTR performance. The number of consecutive tests is 1G block encryptions or 1G byte encryptions.

[0267] EWES performance and AES-128 performance

[0268]

[0269] To sum up, as long as the compiler is excellent, no competitor has claimed to exceed the 10.0C / B performance of AES for single-channel encryption (CBC encryption performance); EWES's single-channel performance is very close to AES's performance, and EWES's two-channel performance is basically equal to AES's single-channel performance.

[0270] 2.6 8-bit performance

[0271] AT89c51 / Development Software Keil-uVision2 / Physical Hardware Verification. Timing is based on 1 / 32 second interrupts.

[0272] EWES-7-256C / BB / S measured time

[0273] 2 16 Single-channel encryption 162.00 12345 84.93 seconds

[0274] The ATmega16 is a high-performance chip with a 16M crystal oscillator. The development environment is Atmel Studio 6.2, using C embedded assembly programming. Software simulation is used to obtain the CPU clock frequency. For comparison, AES-128 single-channel encryption achieved a performance of 143.00 C / B.

[0275] 1-pass encryption EWES-7-1024 129.75C / B 123.31KB / S2076clk

[0276] 2.7 Hardware Wiring Design and Performance

[0277] The following analysis results, derived from the synthesizer output, demonstrate the specific implementation effect of ☆3's restriction on multiplexing the same nonlinear logic in S-even and S-odd. It can be shown that the amount of area saved / the amount of code space is approximately equal to the area of ​​the nonlinear logic that can be reused. For the EWES circuit implementation, it can be assumed that the proportion of circuit area reused in the 1-beat, 1-round mode is 63.38% (1016 / 1603); taking S-odd as a unit, the ratio of the constructed multiplexing mode circuit to S-odd is 106.3% (1603 / 1508). The closer the former and the latter are to 1, the better. In summary, in the EWES 1-beat, 1-round mode, the area ratio of the multiplexing mode circuit to the X component is 63.38%, and the area of ​​the multiplexing mode circuit in the 1-beat, 1-round mode is 106.3% of that of the S-odd mode. The circuit area analysis of the above embodiment demonstrates that multiplexing the same nonlinear logic in S-even and S-odd is feasible, and the area consumption of the 1-beat, 1-round mode is essentially equivalent to the maximum area of ​​either S-even or S-odd.

[0278] #1.1 shot 2 rounds mode

[0279] The specific circuit design is Figure 6 , EWES embodiment - 1 beat 2 rounds state machine calculation circuit. Figure 6 It can be proved that EWES has a completely consistent design in encryption and decryption logic, and only 4 steps are needed for each encryption and decryption. Figure 6 The called application scenario is called through a coprocessor set instruction; the instructions include setting three registers, recovering the ciphertext result, and updating the intermediate result to the main register.

[0280] Hardware: EP2C5T144C8, synthesizer: Quartus II Version 9.0, encryption: 4 beats per time.

[0281] Theoretical C / B area fmax (estimated peak velocity)

[0282] 0.25 2722cell 24.48M 97.92MB / S

[0283] It includes three 128 registers with a total of 2722 cells, of which the odd-round and even-round logics are 1508 cells and 1016 cells respectively.

[0284] #2.1 shot 1 round mode

[0285] Hardware: EP2C5T144C8, synthesizer: Quartus II Version 9.0, encryption: 7 beats per time.

[0286] Theoretical C / B area fmax (estimated peak velocity)

[0287] 7 / 16 1773cell 34.79Mhz 83.144MB / S

[0288] It includes three 128 registers with a total of 1773 cells, of which the odd-round and even-round reusable logic are 1603 cells each.

[0289] 2.9 EWES Security Statement

[0290] Thanks to the AES designer for his wide-trace strategy. The P transform and S-box of EWES are also selected based on the number of branches and the number of active S-boxes. The first step is to construct the X() component. Obviously, X() has a little linear diffusion capability. The second step is to limit the number of 5 The P transformation with the optimal number of branches is selected. The third step is to select a low-area S-box, which completely destroys all low-weight differential paths. It should be noted that the linear layer of differential analysis and linear analysis is the encoding between the odd-round S-box layer and the even-round S-box layer. In terms of security, EWES's full diffusion capability and the number of differentially active S-boxes are superior to AES.

[0291] Main technical features of S-box: GF256 multiplication inverse element design, maximum differential advantage 2 -6 , maximum linear advantage 2 -3 .

[0292] The number of differentially active S-boxes is distributed as follows: 1, 10, 16, 23; according to the maximum differential technical characteristics of the S-box, 4 rounds provide 2 -138 The security of 3 rounds is also redundant; similarly, 3 rounds provide 2 -96 The security of the proposed algorithm is guaranteed by 4 rounds of redundancy. The distribution of the number of linearly active S-boxes and the linear evaluation results are omitted.

[0293] 2.10EWES instruction set design

[0294] Refer to the invention summary ☆9 to ☆10 and #1.1.1-beat 2-round mode. Key achievements: Designed for 128-bit instructions, for 1-beat 1-round or 2-round modes, AES requires 4 instructions, while EWES only requires 2. Designed for 64-bit instructions, the rest of EWES's logic is implemented using common 64-bit instructions, leaving only 2 dedicated instructions to accelerate the X component Sx. -1 The instructions for the (r) component and the Sx(l) component are estimated to improve performance by 250% on the x64 platform, with a single-channel encryption and decryption performance of 4.9C / B.

[0295] Example 3. Example of combining X component with multiplication instruction

[0296] Intel's 64-bit unsigned multiplication instructions are highly efficient, so the arithmetic unit and X-structure components of the present invention can be designed based on these unsigned 64-bit multiplication instructions, and they operate extremely efficiently on the X64 platform. The construction based on multiplication constants can be considered a type of ARX structure. Therefore, this embodiment primarily demonstrates that components based on the ARX structure principle, rather than the SP structure principle, are feasible for the overall structure of the present invention. This is a type of block cipher that is particularly software-friendly, especially for X64. It also demonstrates that the arithmetic unit construction can be a combination of multiple operations.

[0297] The following is the selection of 1 / 2 of the arithmetic unit, mainly designed for xorq and mulq instructions.

[0298] Definition: Input arithmetic unit 1 (rk, X) outputs out64;

[0299]

[0300] Definition: Output of operator 2 (rk, X) is out64;

[0301]

[0302] Definition: Input arithmetic unit 3 (rk, X) outputs out64;

[0303] Out64=(rk*X)mod2 64 ; Limit X to an odd number;

[0304] Definition: Output of operator 4 (rk, X) outputs out64;

[0305] Out64=(rk*X -1 )mod2 64 ; Limit X to an odd number;

[0306] Obviously, the input operator 1 and the output operator 2 are a pair of mutually inverse operators, and the input operator 3 and the output operator 4 are a pair of mutually inverse operators, which can cancel each other in calculation. -1 mod2 64 Yes, it exists, so the formal definition of multiplication and division is that they are inverse operations, and the actual operation is multiplication; this definition of division is actually the technique (technical means) for implementing multiplication, which is supported by most C language compilers and some algorithm optimization programming textbooks have been made public.

[0307] Because the X component can construct S even and S odd, the called X component,

[0308] X({l,r})={r*A,l*A -1}, where constant A = 0xcc33111155113311, constant A -1 =0x1A21B4412BA61DF1

[0309] Replace the X component of Example 2.EWES with X({l,r})={r*A,l*A -1}, thus defined as Example 3.1.

[0310] Definitions of Example 3.1:

[0311] The group width is 16 bytes, with 8 groups of wheel passwords, recorded as rkey0-rkey7;

[0312] 1. Encryption starts from round 1 and ends at round 7;

[0313] 2. Odd rounds: input st, output

[0314] S Qi

[0315] Where, S(t)=P -1 (X(P(t)));

[0316] 3. Even round: input st, output X(st);

[0317] 4. The called linear diffusion component P: is defined based on the 64-bit modulo 2 addition instruction and the circular shift instruction, with input {l, r}. The intermediate steps of the definition are:

[0318] 5. The called X component, X({l,r})={r*A,l*A -1}, where A = 0xcc33111155113311, A -1 =0x1A21B4412BA61DF1.

[0319] The performance of Example 3.1, the test platform is exactly the same as EWES, 685.89MByte / S, 4.9C / B.

[0320] Replace the left area of ​​the operator in Example 3.1 with a multiplication / division operator to obtain Example 3.2.

[0321] Definitions of Example 3.2:

[0322] The block width is 16 bytes, with 8 groups of wheel ciphers, recorded as rkey0-rkey7, where rkeyi are all odd numbers;

[0323] 1. Encryption starts from round 1 and ends at round 7;

[0324] 2. Odd rounds: input st, output

[0325] S Qi

[0326] Where, S(t)=P -1 (X(P(t))), Indicates the XOR operation of the left 64-bit area and the right 64-bit area modulo 2 64 multiplication, Indicates the XOR operation of the left 64-bit area and the right 64-bit area modulo 2 64 division;

[0327] 3. The definitions of the even-numbered rounds, the called linear diffusion component P, and the called X component are completely the same as those in Example 3.1.

[0328] It should be noted that the above tests are all implemented based on the mulq instruction. That is, although the definition of the inverse operator uses "*" and " / ", the actual implementation is a multiplication instruction, and the large integer modinv module is used to implement the multiplication inversion adjustment of the wheel key.

[0329] The performance of Example 3.1 and Example 3.2 is essentially the same. The x64 platform test environment is the same as that of Example 2, EWES. The measured performance of 3.1 is 4.9 C / B, 672 Mbyte / s; the measured performance of 3.2 is 5.05 C / B, which is 250% higher than the 12.5 C / B performance of EWES.

[0330] Example 4. DES S-box substitution table and involutive quasi-MDS matrix

[0331] This embodiment will prove that it is feasible to use an inverse operator with a two-dimensional substitution table structure; it will also prove that a quasi-MDS matrix with Seven=Sodd as the involution is also feasible, that is, when the operator can provide nonlinearity (confusion effect), Seven and Sodd only need to ensure a linear diffusion effect when constructing.

[0332] The DES standard defines a total of 8 6-input and 4-output substitution tables. This substitution table is considered as 32 4-input and 4-output S-box tables. Obviously, each of the 32 S -1 The box table exists. Below is the selection of the 4-input and 4-output arithmetic unit based on the DES standard S-box. The other input terminal is rk, which controls the selection of 32 S-boxes.

[0333] Definition: 4-bit input arithmetic unit (rk, X) outputs out4;

[0334] Out4 = S[rk][X], where rk is 5 bits;

[0335] Definition: 4-bit output arithmetic unit (rk, X) outputs out4;

[0336] Out4=S -1 [rk][X], where rk is 5 bits;

[0337] The block width is 16 bytes, with eight wheel ciphers, denoted as rkey0-rkey7, where rkeyi is an odd number. 16 bytes equals 32 4-bit symbols. Based on channel coding knowledge, no MDS code exists, so a quasi-MDS code is constructed. Quasi-MDS codes require that an error in each input symbol propagate to all other symbols, and that each output symbol is associated with all input symbols.

[0338] Quasi-MDS code matrix components with poor branch number performance:

[0339] MDS1(st) = "all 1 element matrix - identity matrix"; obviously, the number of branches is 4.

[0340] Quasi-MDS code matrix components with good branch number:

[0341] MDS2(st)=P -1 X(P(st)); where P is a random reversible matrix, and F of the X structure is a small random reversible matrix; obviously, MSD(st) is an involutive linear transformation, and the number of branches must be large.

[0342] Based on the design of the above-mentioned operator elements and quasi-MDS matrix elements, the following embodiments are constructed.

[0343] Definitions of Example 4.1

[0344] The packet width is 16 bytes, which is recorded as 32 4-bit symbols;

[0345] 8 sets of wheel passwords, recorded as rkey0-rkey7, each rkeyi is recorded as 32 5-bit symbols, and the access address of the symbol is recorded as rkeyi.rkj, where i is 0-7 and j is 0-31;

[0346] 1. Encryption starts from round 1 and ends at round 7;

[0347] 2. Sodd = Seven, Sodd is MDS1() or MDS2();

[0348] 3. The entry operator consists of 32 sub-operators, where the input of each sub-operator is Xj and rkj, and the output is S[rk][X], where S[rk][X] is equal to the 8 6-input and 4-output S-box tables of the DES standard;

[0349] 4. The output operator consists of 32 sub-operators, each of which has inputs Xj and rkj and outputs S -1 [rk][X], where S -1 Correspondingly, S[rk][X] is equal to the DES standard 8 6-input and 4-output S-box tables.

[0350] As can be seen from the above embodiment, the operator can provide a nonlinear obfuscation effect. When providing a nonlinear obfuscation effect, S even = S odd can be designed by linear transformation. This embodiment also shows that for the design of the operator or operator element using a two-dimensional substitution table structure, the number of bits of the wheel key involved in each operation may not be equal to S box / S -1 The bit length of the box.

[0351] Example 5. Example of constructing X component based on ARX structure

[0352] Ballet is a block cipher designed by Cui Tingting et al. in 2019. Its main features are an ARX structure / ARX instruction, no S-boxes, and complex linear layers, implemented solely by addition, XOR, and circular shift operations. Its main advantages are its software-friendly implementation on high-performance CPUs and its excellent diffusion performance based on the Lai-Massey structure. This example uses the encryption and decryption round transformations of Ballet-128 as components to construct the X component. The main purpose of this example is to demonstrate that a cipher conforming to the overall structure of the present invention can be constructed without S-box elements / operations; of course, Examples 3.1 and 3.2 can also be classified as examples of the generalized ARX structure / ARX instruction.

[0353] ARX-256 embodiment definition: A self-reversible block cipher-256 based on the Ballet-128 round transformation element, i.e., a block cipher length of 256 bits. The main components and connection relationships are defined as follows:

[0354] The inverse operator is and or "+" and "-";

[0355] Define Sst = P -1 XP(st), where P can be designed using XOR and cyclic shift operations based on the principles of EWES. The main design idea is to exchange information on the left and right sides of the X component;

[0356] Define S(st)=X(st);

[0357] Where, X({l,r})={Baller_F(l,RC),Baller_F-1(l,RC),};

[0358] Baller_F is the 4-round transformation of the Ballet-128 encryption algorithm. -1 It is the 4-round transformation of the Ballet-128 decryption algorithm. RC is the round constant, which is equivalent to the 4 fixed groups of Ballet-128 round keys.

[0359] In summary, the ARX-256 embodiment based on the Ballet-128 round transformation conforms to the overall structure of the present invention and is therefore self-reversible. In addition, it can be inferred that the ARX-256 embodiment does not have S-boxes, addition, XOR, and circular shift operations.

[0360] Example 6: Horizontal and vertical design of the operator

[0361] Example 3.2 is and More generally, the operator component can be decomposed into one or more combinations of smaller operator elements in the horizontal direction; the types of operator elements include, and The "+" and "-", "*" and " / " operators can also select a replacement table controlled by the round key. Therefore, in theory, there are many options for horizontal design.

[0362] The following describes the vertical design. As stated in the Summary of the Invention section, it includes a "series structure of three components." The actual design is not limited to three components; a related demonstration is a series connection of five components / elements. In terms of vertical design, the operator or operator element can be connected to the overall S-odd logic multiple times. First, the connection between the entry and exit operators and the S-odd is not limited to the entry operator being the first in the series structure and the exit operator being the last in the series structure. Figure 9 Demonstrated 6 connection methods, all of which can achieve the cancellation effect. Figure 9 More general promotion Figure 10 The derived connection method of two pairs of operators, where Figure 10 The "?1" and "?-1", "?2" and "?-2" reflect the design concept of cancellation. It should be noted that Figure 9 and Figure 10 "P-odd", "S-odd" and "P-odd" -1 The three components together constitute the S-odd logic conversion component of the present invention.

[0363] In short, the basic principle of the horizontal and vertical design of the operator is to construct odd rounds based on the design idea of ​​cancellation, first realize the self-reversibility of the odd rounds, and thus ensure the self-reversibility of the entire block cipher.

[0364] Example 7.X -1 S-odd and S-even in logic design

[0365] X -1 Refers to the multiplication inverse operation of the large domain, because X -1 Full diffusion can be achieved, so theoretically there is no need to construct P transformation. -1 The nonlinear advantage and linear advantage of the wheel are very small, so 5 wheels are enough to provide extremely high safety.

[0366] The block cipher based on the overall structure of the present invention has a length of 16 bytes and a total number of 5 rounds. The inlet operator and the outlet operator are modulo 2 addition, and S odd and S even are both X -1 Logic Design. Only the construction of Seven and Sodd components is discussed and evaluated below.

[0367] 7.1 X when S even = S odd -1

[0368] S 奇 is x -1 modp(x), where p(x) is an irreducible polynomial.

[0369] For example

[0370] Clearly, full diffusion is possible, essentially meeting the design requirements of a block cipher. From a security perspective, the expression is extremely simple, leaving it vulnerable to algebraic analysis attacks. In other words, while differential performance is excellent, algebraic analysis security may be significantly flawed.

[0371] 7.2 The first type of X when S even ≠ S odd -1 design

[0372] The length of the block cipher is 16 bytes, where

[0373] S 奇 for The record format has the low bit on the right, that is, the rightmost bit is 1.

[0374] S 偶 for The record format has the low bit on the left, that is, the leftmost bit is item 1.

[0375] 7.3 The second type of X when S even ≠ S odd -1 design

[0376] The length of the block cipher is 16 bytes, where

[0377] S 奇 for The record format has the low bit on the right, that is, the rightmost bit is 1;

[0378] S 偶 for The record format has the low bit on the left, that is, the leftmost bit is item 1.

[0379] Although 7.3 and 7.1 are essentially the same in form, simply adding a bit permutation can yield a very complex linear expression, which helps resist algebraic attacks. This example demonstrates that the design that restricts Seven ≠ Sodd is superior. This example also proves that even if Seven = Sodd, it is acceptable in some cases. It also proves that Seven and Sodd can be separated by only a permutation and inverse permutation.

[0380] The above description is merely a preferred embodiment of the present application and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the concept of this application. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A block cipher working method with a self-reversible structure, comprising a plurality of groups of wheel keys, characterized in that: The overall structure is a self-inverting structure that starts with an odd-numbered round and alternates between an even-numbered round and an odd-numbered round. The overall structure is defined as follows: The encryption starts at round 1 and ends at an odd-numbered round. The odd-numbered round structure and its components are a series structure including three components; the components from input to output in the encryption direction are decomposed into an entry operator, an S-odd and an exit operator, wherein the entry operator and the exit operator are designed to be inverse operation logic to each other, and the S-odd is a self-inverse logic transformation; The connection relationship of the components of the odd-numbered wheel is as follows: the input end of the entry operator is connected to a certain set of wheel keys, the input end of the exit operator is connected to a certain set of wheel keys, the input of the S odd is connected to the output end of the entry operator, and the output of the S odd is connected to another input end of the exit operator; The even-numbered round is a self-inverted logical transformation, denoted as Seven; The relationship between the Seven and the Sodd is, "recommended Seven≠Sodd"; specifically, the limited scope of "recommended Seven≠Sodd" is a special term, and "recommended Seven≠Sodd" is the entire Seven≠Sodd and the Seven=Sodd part.

2. The block cipher working method according to claim 1, characterized in that: The inlet operator and the outlet operator both adopt a modulo 2 addition operator; The relationship between the Seven and the Sodd is Seven≠Sodd.

3. The block cipher working method according to claim 1 or 2, characterized in that: The S even and the S odd multiplex the same nonlinear logic design.

4. The block cipher working method according to claim 3, characterized in that: The nonlinear logic design is an X-structured logic transformation; Among them, the X structure logical transformation is the nonlinear transformation F of the left input placed on the right, and the nonlinear transformation F of the right input -1 Place on the left.

5. The block cipher working method according to claim 4, characterized in that: The length of the block cipher working method is 8 bytes, 16 bytes or 32 bytes; The number of ending rounds of the block cipher working method is N, where N is an odd number not less than 5; The F is an SP structure, wherein S is an S-box designed with inverse elements on a 256-domain, and P is a linear diffusion component.

6. The block cipher working method according to claim 5, characterized in that: The packet length is 16 bytes. The number of differential branches of the block cipher working method is at least 10.

7. The block cipher working method according to claim 6, characterized in that: The final round is the 7th round; 8 sets of wheel passwords, recorded as rkey0-rkey7; Odd round: input st, output S odd (rkeyi⊕st)⊕rkeyi+1, Where, S(t)=P -1 (X(P(t))); Even round: input st, output X(st); The called linear diffusion component P() is defined based on the 64-bit modulo 2 addition instruction and the rotate shift instruction. The input is {l,r}. The intermediate steps of the calculation are {l⊕r,r}->{l,r<<<14}->{l,r⊕l}->{l<<<44,r}->{l⊕r,r}->{l,r<<<8}->{l,r⊕l}->{l<<<24,r}->{l⊕r,r}; The X() component is the logical transformation of the X structure; The called X() component: define X({l,r}) = {Sx -1 (r),Sx(l)}, where Sx -1 The (r) element is a nonlinear transformation of the SP structure. The P transformation part is a linear combination of 9 64-bit cyclic shifts. The 9 left shift parameters are 2, 0, 8, 16, 24, 32, 40, 48, and 56 respectively. The intermediate result of the linear combination is passed through 8 juxtaposed S -1 Box, the S -1 The box is defined by the following S box; the table output of 0x00-0xff is Among them, P -1 () module refers to the P() module definition, and the Sx() module refers to the Sx -1 ()Module definition.

8. A method for operating a block cipher-based working mode, wherein the working mode is a confidentiality mode, an authentication working mode, or an authentication encryption working mode, characterized in that: The block cipher working method called by the working mode applies the block cipher working method with a self-inverse structure as described in any one of claims 1 to 7.

9. A method for constructing an instruction set, characterized in that: When the defined instructions are executed by a processor, the S-odd logical transformation and / or the S-even logical transformation described in any one of claims 1 to 7 are implemented, wherein the "or" situation means that one of the S-even logical transformation and the S-odd logical transformation is selected, and the other logical transformation can be quickly calculated by combining existing general instructions; The input operator and the output operator are “⊕” and “⊕”, “+” and “-” or “*” and “ / ”.

10. The instruction set construction method according to claim 9, characterized in that: The inlet operator and the outlet operator both adopt a modulo 2 addition operator; Among them, the instructions being constructed are two AUL type instructions, and the mnemonics of the operands are %xmmx, %xmmy, %xmmz. Define odd round function instruction, fun_odd(%xmmx, %xmmy, %xmmz) %xmmz←Sod(%xmmx⊕%xmmz)))⊕%xmmy; Define odd and even round function instructions, fun_odd_env (%xmmx, %xmmy, %xmmz) %xmmz←Seven(fun_odd(%xmmx,%xmmy,%xmmz)); The entity call mode of operand %xmmz includes at least one of the following: Implicit call, 3-operand call, coprocessor module call.

11. An IP core product, the IP core comprising hardware code, netlist or layout, characterized in that: When the IP core is executed, the S-odd logic conversion function and the S-even logic conversion function described in any one of claims 1 to 7 are realized. Or, implement the block cipher working method of the self-invertible structure described in any one of claims 1 to 7.

12. A CPU chip, characterized in that: The CPU chip is capable of executing the S-odd logic transformation and the S-even logic transformation described in any one of claims 1 to 7.

13. An information processing device, characterized in that: The information processing device executes the self-inverse block cipher operation method according to any one of claims 1 to 7.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed, the self-invertible block cipher working method according to any one of claims 1 to 7 is implemented.

Images