Lightweight authentication encryption and decryption device and method thereof

Abstract

The invention discloses a lightweight authentication encryption and decryption device and a method thereof. The device comprises an encryption circuit, a decryption circuit, an authentication output module and a replacement network module, wherein the encryption circuit comprises a first initialization module, a first associated data processing module, a plaintext processing module and a first final module which are connected in sequence; the decryption circuit comprises a second initialization module, a second associated data processing module, a ciphertext processing module and a second final module which are connected in sequence; the plaintext processing module is connected with the ciphertext processing module, and the first final module and the second final module are respectively connected with the authentication output module; and each module in the encryption circuit and the decryption circuit calls a replacement network module. According to the hardware device and the implementation method thereof, encryption and decryption tasks of the plaintext with any length can be efficiently and safely executed on the basis of saving hardware resources, and a certain hardware protection capability is achieved in the aspect of resisting side channel attacks.

Description

Technical Field

[0001] The invention relates to a lightweight authentication encryption and decryption device based on hardware circuit and the improvement and implementation of a method thereof, and belongs to the field of digital signal processing of FPGA and the field of cryptography. Background Art

[0002] Lightweight encryption algorithm is a new encryption technology developed on the basis of traditional encryption algorithm. With the rapid development of emerging technologies such as the Internet of Things and smart home, a large number of devices need to transmit and store data, and these devices usually have limited computing power and storage resources. Therefore, when traditional encryption algorithms run on these devices, they will take up a lot of computing resources and storage space, resulting in a decline in device performance or even the inability to achieve encryption. The original intention of the design of lightweight encryption algorithm is to solve this problem. It optimizes the complexity and parameters of the algorithm so that the encryption algorithm can run quickly and efficiently on limited computing resources and storage space, achieving a balance between security and usability. Therefore, lightweight encryption algorithm has broad application prospects in the fields of the Internet of Things, smart home, etc., and is of great significance for protecting the security and privacy of device data.

[0003] At present, most of the common lightweight encryption algorithms can be divided into three categories: the first category is based on the Feistel structure, such as LBlock and SIMON. The LBlock algorithm reduces the number of S-boxes used, and its hardware implementation area is smaller; while the SIMON algorithm has a variety of packet lengths and is very flexible. The second category is based on the SPN structure, such as PRESENT and Rectangle. The PRESENT algorithm was proposed the earliest and has a simple design, but it has too many execution rounds; the Rectangle algorithm incorporates the concept of bit slicing, and has good software performance on microcontrollers. The third category is based on a duplex structure, such as ASCON (S. Khan, WK Lee, and SOHwang, "Scalable and efficient hardware architectures for authenticated encryption in IoT applications." IEEE Internet of Things Journal, 8 (14), pp. 11260-11275, 2021), which can be implemented using bit slicing, which is more friendly to hardware and software implementation.

[0004] Among the algorithms mentioned above, the ASCON algorithm has authentication and encryption functions and has a greater advantage in throughput. Overall, it is superior to other algorithms in both hardware and software performance. However, the algorithm occupies a large area in hardware implementation, and the throughput needs to be further optimized. Summary of the invention

[0005] In order to optimize the area, power consumption, security and performance of the encryption algorithm hardware, the present invention provides a lightweight authentication encryption and decryption device and method thereof to ensure that it can achieve higher encryption efficiency in a limited resource scenario.

[0006] The technical solution adopted by the present invention is as follows:

[0007] A lightweight authentication encryption and decryption device comprises an encryption circuit, a decryption circuit, an authentication output module and a replacement network module, wherein the encryption circuit comprises a first initialization module, a first associated data processing module, a plaintext processing module and a first finalization module connected in sequence; the decryption circuit comprises a second initialization module, a second associated data processing module, a ciphertext processing module and a second finalization module connected in sequence; the plaintext processing module is connected to the ciphertext processing module, and the first finalization module and the second finalization module are respectively connected to the authentication output module; each module in the encryption circuit and the decryption circuit calls the replacement network module.

[0008] Furthermore, the authentication output module is used to compare the authentication tags output by the encryption circuit and the decryption circuit. If the authentication tags are consistent, the authentication output module outputs the plain text content obtained by the decryption circuit; if they are inconsistent, no output is performed.

[0009] The present invention also provides an implementation method using the above-mentioned lightweight authentication encryption and decryption device, and the implementation process of the encryption circuit is as follows: after the external signal is input into the encryption circuit, the first initialization module first initializes the state variable according to the key, the fixed random number, and the algorithm parameter, and then inputs it into the first associated data processing module together with the associated data. The first associated data processing module further randomizes the state variable using the block associated data XOR operation and P transformation. After that, the plaintext processing module starts the plaintext encryption link, sequentially XORs a plaintext block with the state variable to generate a ciphertext block, then applies the P transformation to update the state variable, and repeats the above-mentioned plaintext block encryption process until all plaintext blocks are encrypted. Finally, the state variable and the key are input into the first finalization module to generate an authentication tag, and outputs the ciphertext, the ciphertext valid flag, the ciphertext output completion signal and the authentication tag;

[0010] The implementation process of the decryption circuit is as follows: after the external signal is input into the decryption circuit, it is processed by the second initialization module and the second associated data processing module in sequence, and then according to the ciphertext, ciphertext valid flag, and ciphertext output completion signal output by the encryption circuit, it is processed by the ciphertext data processing module and the second finalization module in sequence to output the plaintext, the plaintext valid flag, and the authentication tag.

[0011] Furthermore, during the initialization process, the first initialization module and the second initialization module concatenate the initial vector IV, the key K and the random number N as the initial value of the state variable, and then perform XOR with the zero-padded key after 12 rounds of permutation to complete the update of the state variable.

[0012] Furthermore, the first associated data processing module and the second associated data processing module use the externally input associated data to update the state variables in sequence. Specifically, the upper 64 bits of the state variable are XORed with the externally input 64-bit associated data block as the new state variable and 6 rounds of permutation are performed. This process is repeated until all associated data are processed, and finally the lowest bit of the state variable is inverted to complete the state update.

[0013] Furthermore, the plaintext processing module uses the state variables to encrypt the externally input plaintext in sequence. Specifically, the externally input 64-bit plaintext block is XORed with the high 64 bits of the state variable to obtain a corresponding 64-bit ciphertext block, and then the state variable is permuted for 6 rounds to achieve the update of the state variable. The encryption and state variable permutation process is repeated until the last plaintext block, when only the XOR operation is performed to generate the ciphertext block, and no permutation operation is performed.

[0014] Furthermore, the ciphertext processing module uses the state variable to decrypt the external input ciphertext in sequence. Specifically, the input 64-bit ciphertext block is XORed with the high 64 bits of the state variable to obtain the corresponding 64-bit plaintext block, and then the state variable is permuted for 6 rounds to achieve the update of the state variable. The decryption and state variable permutation process is repeated until the last ciphertext block. Since the last ciphertext block may be trimmed, it is necessary to XOR the corresponding bits of the high 64 bits of the state variable with it to generate the last plaintext block, and XOR the high 64 bits of the state variable with the last plaintext block after padding to complete the update of the state variable.

[0015] Furthermore, the first finalization module and the second finalization module are used to generate an authentication tag, perform 12 rounds of permutation after XORing the state variable with the key padded with zeros at the front and back, complete the update of the state variable, and finally take the high 128 bits of the state variable and the high 128 bits of the key to XOR and obtain the authentication tag.

[0016] Furthermore, the permutation network module is used to implement P transformation and update the state variable S through a finite state machine; the permutation network module completes a round of permutation including a round constant addition process, an S-box replacement process and a linear diffusion layer process.

[0017] Furthermore, during the S-box replacement process, a certain delay operation is randomly inserted in the column-by-column parallel replacement process.

[0018] Compared with the prior art, the advantages of the present invention are:

[0019] (1) The replacement network module in the device of the present invention uses a lookup table to improve the computing efficiency of the module. Since the module is the core module of the device, the overall computing efficiency and computing speed of the operating system are greatly improved.

[0020] (2) In the replacement network module of the present invention, the three sub-processes are controlled by a finite state machine rather than a pure combinational logic implementation. This reduces the consumption of hardware resources while maintaining a high throughput. In addition, since this module needs to be called repeatedly in actual applications, the overall computing efficiency and hardware resource consumption of the operating system are greatly improved.

[0021] (3) In order to solve the problem that the existing ASCON algorithm implements the encryption process in which the four steps of initialization, associated data processing, plaintext encryption, and finalization are performed sequentially without feedback control in between, the device of the present invention improves the throughput of the device and the utilization rate of each module through the pipeline design between modules, and efficiently realizes the encryption and decryption process.

[0022] (4) The implementation method of the present invention adopts data-level parallel computing, which improves the computing speed of the encryption and decryption process compared with the original method.

[0023] (5) The implementation method of the present invention introduces a random processing scheme, which randomly inserts a certain delay during the S-box replacement execution process, so that the temporal distribution of the side channel information during the replacement process is more random. Therefore, it has a certain protection capability against side channel attacks, improves the security of hardware encryption, and reduces the possibility of being cracked by side channel attacks.

[0024] (6) The present invention can safely and efficiently implement encryption tasks of any length, thus achieving a wider range of application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 Schematic diagram of the circuit structure of the device of the present invention;

[0026] Figure 2 It is a structural schematic diagram of the encryption circuit in the device of the present invention;

[0027] Figure 3 It is a structural schematic diagram of the decryption circuit in the device of the present invention;

[0028] Figure 4 It is a schematic diagram of the implementation process of the network module replacement function in the device of the present invention. DETAILED DESCRIPTION

[0029] Figure 1The hardware circuit diagram of the authentication encryption and decryption device of the present invention is shown in the figure, which includes external input clock signal, preparation signal, key, fixed random number, basic algorithm parameters, associated data, plaintext of arbitrary length (total length is arbitrary, but the input length can be fixed each time, such as 64 bits) and plaintext valid flag. All input signals are input to the encryption circuit, and all input signals except plaintext and plaintext valid flag are input to the decryption circuit. After the external signal is input into the encryption circuit, it passes through the first initialization module, the first associated data processing module, the plaintext processing module and the first finalization module in sequence. First, the first initialization module initializes the state variable according to the key, the fixed random number and the basic algorithm parameter, and then inputs the state variable together with the associated data into the first associated data processing module. The first associated data processing module uses the block associated data XOR operation and the permutation network module to perform multiple rounds of Permutation operations (hereinafter referred to as P transformation) to further randomize the state variable. After that, the plaintext processing module starts the plaintext encryption link, and sequentially XORs a plaintext block with the state variable to generate a ciphertext block, and then applies multiple rounds of P transformation to update the state variable, repeating the above plaintext block encryption process until all plaintext blocks are encrypted. Finally, the state variable and the key are input into the first finalization module to generate an authentication tag, realizing the entire encryption process, and outputting the ciphertext, the ciphertext valid flag, the ciphertext output completion signal and the authentication tag.

[0030] After the external signal is input into the decryption circuit, it is processed by the second initialization module and the second associated data processing module in sequence, and then, according to the ciphertext, ciphertext valid flag, and ciphertext output completion signal output by the encryption circuit, it is processed by the ciphertext data processing module and the second finalization module in sequence, and the plaintext, the plaintext valid flag, and the authentication tag are output. After the decryption process is completed, the authentication output module compares the authentication tags output by the encryption and decryption circuits. According to the authentication result, if the authentication is successful (that is, the authentication tags output by the encryption and decryption circuits are the same), the authentication success signal, the plaintext, and the plaintext valid flag are output; if the authentication fails, the authentication failure signal is output, and the plaintext and the plaintext valid flag are both set to zero.

[0031] Since the four links of initialization, associated data processing, encryption / decryption, and finalization are carried out in sequence in the software implementation of the ASCON algorithm without feedback control in the middle, that is, the previous link is not affected by the subsequent link during operation, the hardware device has a pipeline design for these four links. In the case of no pipeline design, once the encrypted information is input, it passes through the initialization module, associated data processing module, encryption module and finalization module in sequence. Only one module is in working state at a time, and the other modules are in idle state. The overall utilization rate of the device is not high and the throughput rate is limited. After the pipeline design, after the module completes the information transmission, it immediately starts to process the next piece of information. For example, after the device completes the initialization of the first encryption, it can immediately perform the initialization of the second encryption. In the case of a large number of encryption tasks, this design ensures that the four modules are in working state at every moment, which improves the utilization rate and throughput rate of the device.

[0032] Example 1

[0033] The encryption circuit structure and basic working mode of the device of this embodiment are as follows Figure 2In the encryption circuit, the clock signal clk, the preparation signal AEAD_ready, the key key, the fixed random number nonce and the basic algorithm parameter IV_krab are input into the first initialization module; the first initialization module calls the permutation network module to complete the initialization and complication of the state variable, and outputs the state variable S and the initialization completion signal initialization_done to the first associated data processing module; after receiving the state variable S, the initialization completion signal and the associated data AD and other signals, the first associated data processing module fills the associated data block, and then uses the filled associated data to perform an XOR operation with the state variable, and then calls the permutation network module to update the state variable to make it further complicated, and repeats the above process until all the associated data participate in the operation. After the above process is completed, the state variable is XORed with the constant 1, and the state variable S and the associated data processing completion signal P_AD_done are output to the plaintext processing module; after the plaintext processing module receives the output state variable S, the associated data processing completion signal P_AD_done, the plaintext data PT, and the plaintext data valid flag PT_valid, it fills the plaintext data block, and then uses the filled plaintext data block to XOR with the state variable to generate the corresponding ciphertext data block, and then calls the permutation network module to update the state variable, and repeats the above process until all plaintext data blocks are involved in the operation. The last ciphertext data block needs to be trimmed to ensure that the output ciphertext and plaintext length are the same. The plaintext processing module outputs the state variable S updated by the first associated data processing module and the plaintext processing completion signal P_PT_done to the first finalization module, and outputs the plaintext processing completion signal P_PT_done, the ciphertext CT, and the ciphertext valid flag CT_valid to the decryption circuit; after receiving the plaintext processing completion signal P_PT_done, the ciphertext CT, the ciphertext valid flag CT_valid and the key key, the first finalization module updates the state variable using the key and the permutation network module, and outputs the high 128-bit data of the state variable S as the encrypted authentication tag T_cipher to the authentication output module.

[0034] In the specific implementation of this embodiment, during the initialization process, the first initialization module concatenates a 64-bit initial vector IV (a constant 80400c6c0600000000 in the ASCON-128 algorithm), a 128-bit key K, and a 128-bit random number N as the initial value of the state variable, and then performs XOR with the zero-padded key after 12 rounds of permutation to complete the update of the state variable.

[0035] The first associated data processing module uses the externally input associated data to update the state variables in sequence. In implementation, the high 64 bits of the state variable are XORed with the externally input 64-bit associated data block as the new state variable and subjected to 6 rounds of permutation. This process is repeated until all associated data are processed, and finally the lowest bit of the state variable is inverted to complete the state update.

[0036] The plaintext processing module uses the state variables to encrypt the externally input plaintext in sequence. In implementation, the externally input 64-bit plaintext block is XORed with the high 64 bits of the state variable to obtain the corresponding 64-bit ciphertext block, and then the state variable is permuted for 6 rounds to achieve the update of the state variable. The above encryption and state variable permutation process is repeated until the last plaintext block, when only the XOR operation is performed to generate the ciphertext block, and no permutation operation is performed.

[0037] The first finalization module is used to generate an authentication tag, perform 12 rounds of permutation after XORing the state variable with the key padded with zeros at the front and back, complete the update of the state variable, and finally take the high 128 bits of the state variable and the high 128 bits of the key XOR to obtain the authentication tag.

[0038] Example 2

[0039] The decryption circuit structure and basic working mode of the device of this embodiment are as follows Figure 3In the decryption circuit, the clock signal clk, the preparation signal AEAD_ready, the key key, the fixed random number nonce and the basic algorithm parameter IV_krab are input into the second initialization module; the second initialization module calls the permutation network module to complete the initialization and complication of the state variable, and outputs the state variable S and the initialization completion signal initialization_done to the second associated data processing module; after receiving the output state variable S, the initialization completion signal initialization_done and the associated data AD, the second associated data processing module fills the associated data block, then uses the filled associated data to perform an XOR operation with the state variable, then calls the permutation network module to update the state variable, and repeats the above process until all the associated data participate in the operation. After the above process is completed, the state variable is XORed with the constant 1, and the updated state variable S and the associated data processing completion signal P_AD_done are output to the ciphertext processing module; after receiving the updated state variable S, the associated data processing completion signal P_AD_done, the ciphertext data CT and the ciphertext data valid flag CT_valid from the second associated data processing module, the ciphertext processing module fills the ciphertext data block, and then uses the filled ciphertext data block and the state variable XOR to generate the corresponding plaintext data block, and then calls the replacement network module to update the state variable, and repeats the above process until all ciphertext data blocks participate in the operation. The last plaintext data block needs to be trimmed to ensure that the output plaintext and the original text have the same length. The ciphertext processing module outputs the updated state variable S and the ciphertext processing completion signal P_CT_done to the second finalization module, and outputs the plaintext PT and the plaintext valid flag PT_valid to the second finalization module; after receiving the above signals and the key key, the second finalization module uses the key and the permutation network module to update the state variable, and outputs the high 128-bit data of the state variable S as the decryption authentication label T_decipher to the authentication output module. The authentication output module compares the encryption authentication label T_cipher and the decryption authentication label T_decipher. If the two are the same, it is considered that the authentication is successful, and the authentication success signal AEAD_success is pulled high, and the plaintext PT and the plaintext valid flag PT_valid are output. If they are inconsistent, the authentication failure signal AEAD_fail is pulled high, and the output plaintext PT and the plaintext valid flag are both set to zero.

[0040] In the specific implementation of this embodiment, the processes of the second initialization module, the second associated data processing module, and the second finalization module are the same as those of Embodiment 1. The ciphertext processing module uses the state variable to decrypt the external input ciphertext in sequence. In implementation, the input 64-bit ciphertext block is XORed with the high 64 bits of the state variable to obtain the corresponding 64-bit plaintext block, and then the state variable is permuted for 6 rounds to achieve the update of the state variable. The above decryption and state variable permutation process are repeated until the last ciphertext block. Since the last ciphertext block may be trimmed, it is necessary to XOR the corresponding bits of the high 64 bits of the state variable with it to generate the last plaintext block, and XOR the high 64 bits of the state variable with the last plaintext block after padding to complete the update of the state variable.

[0041] Example 3

[0042] This embodiment describes the substitution network module in the device of the present invention. The substitution network module is used to update the state variable S (taking 320 bits as an example). The implementation process of the substitution network module includes round constant addition, S box (Substitution layer) and linear diffusion layer (Linear layer with diffusion functions). Figure 4 As shown. Round constant addition is achieved by XORing the middle 64 bits of the state variable S with a constant Cr (determined by the number of rounds); S-box is a common nonlinear unit in symmetric key algorithms. In specific implementation, the 320-bit state variable S is divided into 64 5-bit numbers, and the original 5-bit number is used as input and replaced according to the specified replacement table to obtain a new 5-bit number as the result, thereby achieving obfuscation of the original data; when implementing the linear diffusion layer, the 320-bit state variable S is divided into 5 64-bit blocks, and each bit block is XORed with the result after two cyclic right shifts as the updated bit block.

[0043] The specific implementation method of the replacement process provided in this embodiment is as follows:

[0044] First, the 320-bit state variable S is divided into five 64-bit blocks;

[0045] S=x0∥x1∥x2∥x3∥x4

[0046] The symbol ∥ indicates splicing.

[0047] A round of permutation is completed by sequentially implementing round constant addition, S-box replacement, and linear diffusion layer;

[0048] The round constant addition process XORs the last 8 bits of x2 with an 8-bit constant Cr, thereby updating x2;

[0049]

[0050] Among them, the symbol Stands for exclusive OR.

[0051] The selection of Cr is determined according to the number of loop rounds i and the total number of P process loops (the total number of P process loops in initialization and finalization is 12, and the total number of P process loops in associated data processing and plaintext / ciphertext data processing is 6). For details, refer to Table 1. The i-th row indicates that the P process loops to the i-th round at this time. According to the total number of P process loops, the constant Cr required at this time is found and XORed with x2.

[0052] Table 1 Constant Cr used in round i during PC process

[0053]

[0054]

[0055] The S-box replacement is to divide the state variable S into 64 groups vertically with 5 bits as a unit, and use the lookup table LUT (a hardware resource in FPGA that can quickly implement different logic functions with less resource occupation) to perform the S-box replacement operation (S-Box) according to Table 2. All numbers in the table are hexadecimal numbers, where the data in x0 and x4 are the highest and lowest bits, respectively. For example, assuming that the first group of the 64 groups is the binary number 00000 (hexadecimal number 0), refer to the above table and replace it with the binary number 00100 (hexadecimal number 4). If the first group is the binary number 11010 (hexadecimal number 1A), it will be replaced with the binary number 00001 (hexadecimal number 1), and so on.

[0056] Table 2 S box replacement table

[0057]

[0058] To combat side channel attacks, the device of the present invention introduces random processing into the P process. Specifically, when implementing S-box replacement, a certain delay operation is randomly inserted into the original column-by-column parallel replacement process, so that when the device is running, the core P process has a certain randomness in terms of running time and power consumption characteristics, thereby improving the protection capability against side channel attacks in terms of timing and power consumption.

[0059] The linear diffusion layer is transformed according to the following rules;

[0060]

[0061] The symbol 》 represents a circular right shift.

[0062] In the permutation network module, the above-mentioned round constant addition, S-box replacement, and linear diffusion layer are executed in sequence. One round of permutation is completed once this process is completed. Each permutation network executes 12 rounds in initialization and finalization, and each permutation network executes 6 rounds in associated data processing and plaintext and ciphertext data processing.

[0063] Each module of the device of the present invention uses the state variable S as an intermediate variable to perform logical operations with related data (such as associated data, plaintext data and ciphertext data) to realize the encryption and decryption process. At the same time, the state variable S improves the complexity of its own encryption based on the permutation network module and reduces the possibility of being cracked. In specific implementation, the permutation network module uses a finite state machine to save hardware resource loss, optimize timing performance, and introduce pipeline design and lookup table to improve the system operation speed.

[0064] According to software (vivado 2018.3) analysis, the encryption circuit of the present invention can achieve a maximum throughput of 1028.12 Mbps and a maximum clock frequency of 481.93 MHz on a Zynq-UltraScale+ FPGA (ZCU102 development board). The number of occupied lookup tables (LUTs) is 4581, and the throughput per unit area can reach 0.224 Mbps / LUTs.

Claims

1. A lightweight authentication encryption and decryption device, It is characterized in that The device includes an encryption circuit, a decryption circuit, an authentication output module and a replacement network module, wherein the encryption circuit includes a first initialization module, a first associated data processing module, a plaintext processing module and a first finalization module which are connected in sequence; the decryption circuit includes a second initialization module, a second associated data processing module, a ciphertext processing module and a second finalization module which are connected in sequence; the plaintext processing module is connected to the ciphertext processing module, and the first finalization module and the second finalization module are respectively connected to the authentication output module; each module in the encryption circuit and the decryption circuit calls the replacement network module.

2. A lightweight authentication encryption and decryption device according to claim 1, It is characterized in that The authentication output module is used to compare the authentication tags output by the encryption circuit and the decryption circuit. If the authentication tags are consistent, the authentication output module outputs the plain text content obtained by the decryption circuit; if they are inconsistent, no output is performed.

3. Using a method for implementing a lightweight authentication encryption and decryption device as claimed in claim 1, It is characterized in that The implementation process of the encryption circuit is: After the external signal is input into the encryption circuit, the first initialization module initializes the state variable according to the key, the fixed random number and the algorithm parameter, and then inputs the state variable together with the associated data into the first associated data processing module. The first associated data processing module uses the block associated data XOR operation and the permutation network module to perform the P transformation to further randomize the state variable. After that, the plaintext processing module starts the plaintext encryption link, sequentially XORs a plaintext block with the state variable to generate a ciphertext block, then applies the P transformation to update the state variable, repeats the above plaintext block encryption process until all plaintext blocks are encrypted, and finally inputs the state variable and the key into the first finalization module to generate an authentication tag, and outputs the ciphertext, the ciphertext valid flag, the ciphertext output completion signal and the authentication tag; The implementation process of the decryption circuit is: After the external signal is input into the decryption circuit, it is processed by the second initialization module and the second associated data processing module in sequence. Then, according to the ciphertext, ciphertext valid flag, and ciphertext output completion signal output by the encryption circuit, it is processed by the ciphertext data processing module and the second finalization module in sequence to output the plaintext, the plaintext valid flag, and the authentication tag.

4. The implementation method according to claim 3, It is characterized in that During the initialization process, the first initialization module and the second initialization module concatenate the initial vector IV, the key K and the random number N as the initial value of the state variable, and then perform XOR with the zero-filled key after 12 rounds of permutation to complete the update of the state variable.

5. The implementation method according to claim 3, It is characterized in that The first associated data processing module and the second associated data processing module use the externally input associated data to update the state variables in sequence. Specifically, the high 64 bits of the state variable are XORed with the externally input 64-bit associated data block as the new state variable and 6 rounds of permutation are performed. This process is repeated until all associated data are processed, and finally the lowest bit of the state variable is inverted to complete the state update.

6. The implementation method according to claim 3, It is characterized in that The plaintext processing module uses the state variable to encrypt the externally input plaintext in sequence. Specifically, the externally input 64-bit plaintext block is XORed with the high 64 bits of the state variable to obtain the corresponding 64-bit ciphertext block, and then the state variable is permuted for 6 rounds to achieve the update of the state variable. The encryption and state variable permutation process is repeated until the last plaintext block, when only the XOR operation is performed to generate the ciphertext block, and no permutation operation is performed.

7. The implementation method according to claim 3, It is characterized in that The ciphertext processing module uses the state variable to decrypt the external input ciphertext in sequence. Specifically, the input 64-bit ciphertext block is XORed with the high 64 bits of the state variable to obtain the corresponding 64-bit plaintext block, and then the state variable is permuted for 6 rounds to achieve the update of the state variable. The decryption and state variable permutation process is repeated until the last ciphertext block. Since the last ciphertext block may be trimmed, it is necessary to XOR the corresponding bits of the high 64 bits of the state variable with it to generate the last plaintext block, and XOR the high 64 bits of the state variable with the last plaintext block after padding to complete the update of the state variable.

8. The implementation method according to claim 3, It is characterized in that The first finalization module and the second finalization module are used to generate an authentication tag, perform 12 rounds of permutation after XORing the state variable with the key padded with zeros at the front and back, complete the update of the state variable, and finally take the high 128 bits of the state variable and the high 128 bits of the key XOR to obtain the authentication tag.

9. The implementation method according to claim 3, It is characterized in that The permutation network module is used to implement P transformation and update the state variable S through a finite state machine; the permutation network module completes a round of permutation including a round constant addition process, an S-box replacement process and a linear diffusion layer process.

10. The implementation method according to claim 9, It is characterized in that During the S-box replacement process, a certain delay operation is randomly inserted in the column-by-column parallel replacement process.

Images