Lightweight authentication encryption and decryption device and method thereof

Abstract

The application discloses a kind of lightweight authentication encryption decryption device and method thereof.The device includes encryption circuit, decryption circuit, authentication output module and permutation network module, wherein the encryption circuit includes first initialization module, first associated data processing module, plaintext processing module and first finalization module connected in sequence;The decryption circuit includes second initialization module, second associated data processing module, ciphertext processing module and second finalization module connected in sequence;Plaintext processing module is connected with ciphertext processing module, and first finalization module, second finalization module is connected with authentication output module respectively;Each module in encryption circuit and decryption circuit calls permutation network module.The hardware device and the implementation method of the application can efficiently and securely perform encryption and decryption tasks of plaintext of any length on the basis of saving hardware resources, and have certain hardware protection capability in resisting side-channel attacks.

Description

TECHNICAL FIELD

[0001] The application relates to an improvement and implementation of a lightweight authentication encryption and decryption device based on a hardware circuit and a method thereof, and belongs to the fields of digital signal processing and cryptography of FPGA. BACKGROUND

[0002] A lightweight encryption algorithm is a new encryption technology developed on the basis of traditional encryption algorithms. With the rapid development of emerging technologies such as the Internet of Things and smart homes, a large number of devices need to transmit and store data, and these devices usually have limited computing power and storage resources. Therefore, when traditional encryption algorithms run on these devices, they will occupy a large amount of computing resources and storage space, leading to a decrease in device performance and even the inability to implement encryption. The design of lightweight encryption algorithms is to solve this problem. It optimizes the complexity and parameters of the algorithm, so that the encryption algorithm can run quickly and efficiently on limited computing resources and storage space, achieving a balance between security and usability. Therefore, lightweight encryption algorithms have broad application prospects in the fields of the Internet of Things and smart homes, and are of great significance for protecting the security and privacy of device data.

[0003] Most of the currently common lightweight encryption algorithms can be divided into three categories: the first category is based on the Feistel structure, such as LBlock, SIMON, and LBlock algorithm reduces the number of S-boxes used, and has smaller hardware implementation area; and SIMON algorithm has multiple block lengths and strong flexibility. The second category is based on the SPN structure, such as PRESENT and Rectangle, PRESENT algorithm is the earliest to be proposed, and has simple design but too many execution rounds; and Rectangle algorithm adds the concept of bit slicing, and has good software performance on microcontrollers. The third category is based on the complex structure, such as ASCON (S. Khan, W. K. Lee, and S. O. Hwang, “Scalable and efficient hardware architectures for authenticated encryption in IoT applications.” IEEE Internet of Things Journal, 8(14), pp. 11260-11275, 2021), which can be implemented by bit slicing and is more friendly to hardware and software implementation.

[0004] Among the above-mentioned algorithms, the ASCON algorithm has the function of authentication encryption and has a great advantage in throughput. In general, it is superior to other algorithms in terms of hardware and software performance. However, the algorithm occupies a large area in hardware implementation, and the throughput needs to be further optimized. SUMMARY

[0005] In order to optimize the area, power consumption, security and performance of the encryption algorithm implementation hardware, the application provides a lightweight authentication encryption and decryption device and a method thereof, which ensures that high encryption efficiency can be achieved in a limited resource scenario.

[0006] The technical scheme adopted by the application is as follows:

[0007] A lightweight authentication encryption and decryption device, which comprises an encryption circuit, a decryption circuit, an authentication output module and a permutation network module, wherein the encryption circuit comprises a first initialization module, a first associated data processing module, a plaintext processing module and a first finalization module connected in sequence; the decryption circuit comprises a second initialization module, a second associated data processing module, a ciphertext processing module and a second finalization module connected in sequence; the plaintext processing module is connected with the ciphertext processing module, and the first finalization module and the second finalization module are connected with the authentication output module respectively; each module in the encryption circuit and the decryption circuit calls the permutation network module.

[0008] Further, the authentication output module is used for comparing the authentication tags output by the encryption circuit and the decryption circuit, and if the authentication tags are consistent, the authentication output module outputs the plaintext content obtained by the decryption circuit; if the authentication tags are inconsistent, no output is performed.

[0009] The application also provides an implementation method of the lightweight authentication encryption and decryption device, and the implementation process of the encryption circuit is as follows: after an external signal is input into the encryption circuit, the first initialization module initializes a state variable according to a key, a fixed random number and algorithm parameters, and then the state variable is input into the first associated data processing module together with associated data; the first associated data processing module uses block associated data XOR operation and P transformation to further randomize the state variable; then the plaintext processing module starts the plaintext encryption link, and a plaintext block is XORed with the state variable to generate a ciphertext block, and then P transformation is applied to update the state variable; the above plaintext block encryption process is repeated until all plaintext blocks are encrypted; finally, the state variable and the key are input into the first finalization module to generate an authentication tag, and the ciphertext, a ciphertext valid flag bit, a ciphertext output completion signal and the authentication tag are output.

[0010] The implementation process of the decryption circuit is as follows: after an external signal is input into the decryption circuit, the signal is processed by the second initialization module and the second associated data processing module in sequence; then, according to the ciphertext, the ciphertext valid flag bit and the ciphertext output completion signal output by the encryption circuit, the signal is processed by the ciphertext data processing module and the second finalization module in sequence, and the plaintext, a plaintext valid flag bit and the authentication tag are output.

[0011] Further, the first initialization module and the second initialization module splice the initial vector IV, the key K and the random number N as the initial value of the state variable during the initialization process, and then update the state variable after 12 rounds of permutation and XOR operation with the zero-padded key.

[0012] Further, the first associated data processing module and the second associated data processing module update the state variable in turn using the externally input associated data, specifically, XOR the high 64 bits of the state variable with the 64-bit associated data block to obtain the new state variable and perform 6 rounds of permutation, and repeat the process until all associated data are processed, and finally take the least significant bit of the state variable to complete the state update.

[0013] Further, the plaintext processing module uses the state variable to encrypt the externally input plaintext in turn, specifically, XOR the 64-bit plaintext block with the high 64 bits of the state variable to obtain the corresponding 64-bit ciphertext block, and then perform 6 rounds of permutation on the state variable to update the state variable, and repeat the encryption and state variable permutation process until the last plaintext block, only XOR operation is performed to generate the ciphertext block, and no permutation operation is performed.

[0014] Further, the ciphertext processing module uses the state variable to decrypt the externally input ciphertext in turn, specifically, XOR the 64-bit ciphertext block with the high 64 bits of the state variable to obtain the corresponding 64-bit plaintext block, and then perform 6 rounds of permutation on the state variable to update the state variable, and repeat the decryption and state variable permutation process until the last ciphertext block, since the last ciphertext block may be cropped, the corresponding bit of the high 64 bits of the state variable is XORed with it to generate the last plaintext block, and the high 64 bits of the state variable are XORed with the padded last plaintext block to complete the update of the state variable.

[0015] Further, the first finalization module and the second finalization module are used to generate an authentication tag, XOR the state variable with the zero-padded key, perform 12 rounds of permutation to update the state variable, and finally XOR the high 128 bits of the state variable with the high 128 bits of the key to obtain the authentication tag.

[0016] Further, the permutation network module is used to implement the P transformation and update the state variable S through a finite state machine; one round of permutation completed by the permutation network module includes a round constant addition process, an S-box replacement process and a linear diffusion layer process.

[0017] Further, in the S-box replacement process, a certain delay operation is randomly inserted in the column-by-column parallel replacement process.

[0018] Compared with the prior art, the present application has the following advantages:

[0019] (1) The permutation network module in the device uses a lookup table to improve the operation efficiency of the module, and since the module is the core module of the device, the overall operation efficiency and operation speed of the running system are greatly improved.

[0020] (2) In the permutation network module of the application, three sub-processes are controlled by a finite state machine instead of pure combinational logic, which reduces hardware resource consumption while maintaining high throughput, and since this module needs to be called repeatedly in practical applications, the overall operation efficiency and hardware resource consumption of the running system are greatly improved.

[0021] (3) In view of the problem that the existing ASCON algorithm realizes the encryption process in four steps of initialization, correlation data processing, plaintext encryption and finalization without feedback control, the device improves the throughput of the device and the utilization rate of each module through the pipelining design between modules, and efficiently realizes the encryption and decryption process.

[0022] (4) The implementation method of the application adopts data-level parallel computing, which improves the operation speed of the encryption and decryption process compared with the original method.

[0023] (5) The implementation method of the application introduces a random processing scheme, which randomly inserts a certain delay in the S-box replacement execution process, so that the distribution of side channel information in time during the replacement process is more random, thus having certain protection ability against side channel attacks, improving the security of hardware encryption, and reducing the possibility of being cracked by side channel attacks.

[0024] (6) The application can safely and efficiently realize encryption tasks of any length and obtain a wider application scenario. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 is a schematic diagram of the circuit structure of the device of the application;

[0026] Figure 2 is a schematic diagram of the structure of the encryption circuit in the device of the application;

[0027] Figure 3 is a schematic diagram of the structure of the decryption circuit in the device of the application;

[0028] Figure 4 is a schematic diagram of the function implementation process of the permutation network module in the device of the application. DETAILED DESCRIPTION

[0029] Figure 1The hardware circuit schematic of the authentication encryption and decryption device of the present application is shown in the figure. The external input clock signal, the preliminary signal, the key, the fixed random number, the basic algorithm parameter, the associated data, the plaintext of arbitrary length (the total length is arbitrary, but the length of each input can be fixed, such as 64 bits) and the plaintext valid flag bit are all input to the encryption circuit, and the input signals of the plaintext and the plaintext valid flag bit are all input to the decryption circuit. After the external signal is input to the encryption circuit, it successively passes through the first initialization module, the first associated data processing module, the plaintext processing module and the first finalization module. First, the first initialization module initializes the state variable according to the key, the fixed random number and the basic algorithm parameter, and then inputs the associated data to the first associated data processing module. The first associated data processing module uses the block associated data XOR operation and the permutation network module to perform multiple rounds of Permutation operation (hereinafter referred to as P transformation) to further randomize the state variable. Then, the plaintext processing module starts the plaintext encryption link, successively XORs a plaintext block with the state variable to generate a ciphertext block, and then applies multiple rounds of P transformation to update the state variable. The above plaintext block encryption process is repeated until all plaintext blocks are encrypted. Finally, the state variable and the key are input to the first finalization module to generate an authentication tag, realize the entire encryption process, and output the ciphertext, the ciphertext valid flag bit, the ciphertext output completion signal and the authentication tag.

[0030] After the external signal is input to the decryption circuit, it successively passes through the processing of the second initialization module and the second associated data processing module. Then, according to the ciphertext, the ciphertext valid flag bit and the ciphertext output completion signal output by the encryption circuit, it successively passes through the processing of the ciphertext data processing module and the second finalization module, and outputs the plaintext, the plaintext valid flag bit and the authentication tag. After the decryption process is completed, the authentication output module compares the authentication tags output by the encryption and decryption circuits. According to the authentication result, if the authentication is successful (i.e. the authentication tags output by the encryption and decryption circuits are the same), the authentication success signal, the plaintext and the plaintext valid flag bit are output. If the authentication fails, the authentication failure signal is output, and the plaintext and the plaintext valid flag bit are both set to zero.

[0031] Since the four steps of initialization, correlation data processing, encryption / decryption and finalization in the software implementation of the ASCON algorithm are performed in sequence without feedback control in between, i.e. the former steps are not affected by the latter steps when running, the four steps are designed to be pipelined in the hardware device. Without pipelining, once the encrypted information is input, it is sequentially processed by the initialization module, the correlation data processing module, the encryption module and the finalization module, and only one module is in working state at a time while the rest are in idle state, so the overall utilization of the device is not high and the throughput is limited. After pipelining, the next piece of information is processed immediately after the module finishes the information transmission, e.g. after the initialization for the first encryption is completed, the initialization for the second encryption can be performed immediately. In the case of a large number of encryption tasks, this design ensures that the four modules are in working state at all times, improving the utilization and throughput of the device.

[0032] Example 1

[0033] The encryption circuit structure and basic working mode of the device of this example are as follows Figure 2In the encryption circuit, the clock signal clk, the preliminary signal AEAD_ready, the key key, the fixed random number nonce, and the basic algorithm parameter IV_krab are input into the first initialization module; the first initialization module calls the permutation network module to complete the initialization and complication of the state variable, and outputs the state variable S and the initialization completion signal initialization_done to the first associated data processing module; after the first associated data processing module receives the state variable S, the initialization completion signal, and the associated data AD and other signals, the associated data block is filled, and then the filled associated data and the state variable are subjected to an exclusive or operation, and then the permutation network module is called to update the state variable to further complicate it, and the above process is repeated until all the associated data are involved in the operation. After the above process is completed, the state variable is subjected to an exclusive or operation with the constant 1, and the state variable S and the associated data processing completion signal P_AD_done are output to the plaintext processing module; after the plaintext processing module receives the output state variable S, the associated data processing completion signal P_AD_done, the plaintext data PT, and the plaintext data valid flag bit PT_valid, the plaintext data block is filled, and then the filled plaintext data block and the state variable are subjected to an exclusive or operation to generate the corresponding ciphertext data block, and then the permutation network module is called to update the state variable, and the above process is repeated until all the plaintext data blocks are involved in the operation. The last ciphertext data block needs to be cropped to ensure that the output ciphertext and the plaintext have the same length. The plaintext processing module outputs the state variable S updated by the first associated data processing module, the plaintext processing completion signal P_PT_done to the first finalization module, and outputs the plaintext processing completion signal P_PT_done, the ciphertext CT, and the ciphertext valid flag bit CT_valid to the decryption circuit; after the first finalization module receives the plaintext processing completion signal P_PT_done, the ciphertext CT, the ciphertext valid flag bit CT_valid, and the key key, the state variable is updated by using the key and the permutation network module, and the high 128-bit data of the state variable S is output as the encryption authentication tag T_cipher to the authentication output module.

[0034] In the specific implementation of the embodiment, in the initialization process, the first initialization module splices the 64-bit initial vector IV (which is a constant 80400c6c0600000000 in the ASCON-128 algorithm), the 128-bit key K, and the 128-bit random number N as the initial value of the state variable, and then updates the state variable by performing exclusive or operation with the zero-padded key after 12 rounds of permutation.

[0035] The first associated data processing module uses the externally input associated data to update the state variable in turn. In implementation, the upper 64 bits of the state variable are XORed with the 64-bit associated data block externally input to obtain a new state variable and 6 rounds of permutation are performed. The process is repeated until all associated data is processed. Finally, the lowest bit of the state variable is inverted to complete the update of the state.

[0036] The plaintext processing module uses the state variable to encrypt the externally input plaintext in turn. In implementation, the 64-bit plaintext block externally input is XORed with the upper 64 bits of the state variable to obtain a corresponding 64-bit ciphertext block. Then, the state variable is permuted for 6 rounds to update the state variable. The above encryption and state variable permutation process is repeated until the last plaintext block, only the XOR operation is performed to generate the ciphertext block, and no permutation operation is performed.

[0037] The first finalization module is used to generate an authentication tag. The state variable is XORed with the zero-padded key, 12 rounds of permutation are performed to update the state variable, and finally the upper 128 bits of the state variable are XORed with the upper 128 bits of the key to obtain the authentication tag.

[0038] Embodiment 2

[0039] The decryption circuit structure and the basic working mode of the device of this embodiment are as follows Figure 3The clock signal clk, the preliminary signal AEAD_ready, the key key, the fixed random number nonce and the basic algorithm parameter IV_krab are input into the second initialization module in the deciphering circuit; the second initialization module calls the permutation network module to complete the initialization and complication of the state variable, and outputs the state variable S and the initialization completion signal initialization_done to the second associated data processing module; after the second associated data processing module receives the output state variable S, the initialization completion signal initialization_done and the associated data AD, the associated data block is filled, then the filled associated data is used for exclusive or operation with the state variable, then the permutation network module is called to update the state variable, and the above process is repeated until all the associated data are involved in operation. After the above process is completed, the state variable is exclusive or with the constant 1, and the updated state variable S and the associated data processing completion signal P_AD_done are output to the ciphertext processing module; after the ciphertext processing module receives the updated state variable S of the second associated data processing module, the associated data processing completion signal P_AD_done, the ciphertext data CT and the ciphertext data valid flag bit CT_valid, the ciphertext data block is filled, then the filled ciphertext data block is used for exclusive or operation with the state variable to generate the corresponding plaintext data block, the permutation network module is called again to update the state variable, and the above process is repeated until all the ciphertext data blocks are involved in operation. The last plaintext data block needs to be trimmed to ensure that the output plaintext and the original text have the same length. The ciphertext processing module outputs the updated state variable S and the ciphertext processing completion signal P_CT_done to the second finalization module, and outputs the plaintext PT and the plaintext valid flag bit PT_valid to the second finalization module; after the second finalization module receives the above signals and the key key, the state variable is updated by using the key and the permutation network module, and the high 128-bit data of the state variable S is taken as the deciphering authentication tag T_decipher and output to the authentication output module; the authentication output module compares the encryption authentication tag T_cipher and the deciphering authentication tag T_decipher, if they are the same, it is considered that the authentication is successful, the authentication success signal AEAD_success is pulled, and the plaintext PT and the plaintext valid flag bit PT_valid are output, if they are not the same, the authentication failure signal AEAD_fail is pulled, and the plaintext PT and the plaintext valid flag bit are both set to zero.

[0040] In the specific implementation of the embodiment, the processes of the second initialization module, the second associated data processing module, and the second finalization module are the same as those of Embodiment 1. The ciphertext processing module uses a state variable to sequentially decrypt the externally input ciphertext. In implementation, the input 64-bit ciphertext block is XORed with the high 64 bits of the state variable to obtain a corresponding 64-bit plaintext block, and then the state variable is permuted for 6 rounds to update the state variable. The decryption and state variable permutation processes are repeated until the last ciphertext block. Since the last ciphertext block can be cropped, the corresponding bits of the high 64 bits of the state variable are XORed to generate the last plaintext block, and the high 64 bits of the state variable are XORed with the padded last plaintext block to complete the update of the state variable.

[0041] Embodiment 3

[0042] This embodiment illustrates the permutation network module in the device of the application. The permutation network module is used to update the state variable S (for example, 320 bits). One round of implementation of the permutation network module includes round constant addition, a substitution layer, and a linear layer with diffusion functions, as shown in the following table. Figure 4 Round constant addition is an XOR operation between the middle 64 bits of the state variable S and a constant Cr (determined by the execution round number). The substitution layer is a common nonlinear unit in a symmetric key algorithm. In implementation, the 320-bit state variable S is divided into 64 5-bit numbers. The original 5-bit number is taken as input, a replacement table is used for replacement to obtain a new 5-bit number as a result, so as to realize confusion of the original data. The linear layer with diffusion functions is implemented by dividing the 320-bit state variable S into 5 64-bit blocks. Each bit block is XORed with the result of twice cyclic right shift as an updated bit block.

[0043] The specific implementation method of the permutation process provided in this embodiment is as follows:

[0044] First, the 320-bit state variable S is divided into 5 64-bit blocks.

[0045] S = x0∥x1∥x2∥x3∥x4

[0046] The symbol ∥ represents splicing.

[0047] One round of permutation is completed by sequentially implementing round constant addition, substitution layer replacement, and a linear layer with diffusion functions.

[0048] In the round constant addition process, the last 8 bits of x2 are XORed with an 8-bit constant Cr, so as to update x2.

[0049]

[0050] wherein the symbol represents XOR.

[0051] The selection of Cr is determined according to the cycle round i, the total number of P process cycles (the total number of P process cycles in initialization and finalization is 12, and the total number of P process cycles in associated data processing and plaintext / ciphertext data processing is 6), and specifically, referring to Table 1, the i-th row represents that the P process is cycled to the i-th round, and according to the total number of P process cycles, the constant Cr required at this time is found and XORed with x2.

[0052] Table 1 Constant Cr used in the i-th round of the Pc process

[0053]

[0054]

[0055] The S-box substitution is to divide the state variable S into 64 groups vertically with 5 bits as a unit, and perform S-box substitution operation (S-Box) using a lookup table LUT (a kind of hardware resource in FPGA, which can quickly realize different logic functions by occupying less resource) according to Table 2, all numbers in the table are hexadecimal numbers, wherein the data in x0 and x4 are the highest bit and the lowest bit respectively. For example, assuming that the first group of 64 groups is binary number 00000 (hexadecimal number 0), referring to the above table, it is replaced by binary number 00100 (hexadecimal number 4), if the first group is binary number 11010 (hexadecimal number 1A), it is replaced by binary number 00001 (hexadecimal number 1), and so on.

[0056] Table 2 S-box substitution table

[0057]

[0058] For side channel attacks, the device of the application introduces random processing in the P process. Specifically, when implementing S-box substitution, a certain delay operation is randomly inserted in the original column parallel replacement process, so that the core P process of the device has a certain randomness in running time and power consumption characteristics when running, thereby improving the protection capability against side channel attacks in terms of timing and power consumption.

[0059] The linear diffusion layer is transformed according to the following rules;

[0060]

[0061] wherein the symbol » represents cyclic right shift.

[0062] In the permutation network module, the round constant addition, the S-box substitution and the linear diffusion layer are sequentially executed, one round of the process is completed, and 12 rounds of permutation are executed in initialization and finalization, 6 rounds of permutation are executed in association data processing and plaintext and ciphertext data processing.

[0063] Each module of the device uses the state variable S as an intermediate variable to perform logical operations on relevant data (such as association data, plaintext data and ciphertext data), so as to realize the encryption and decryption process. Meanwhile, the state variable S improves the complexity of its own encryption based on the permutation network module, and reduces the possibility of being cracked. In specific implementation, the permutation network module saves the hardware resource loss through the finite state machine, optimizes the timing performance, and introduces the pipeline design and the lookup table to improve the system operation speed.

[0064] According to the software (vivado 2018.3) analysis, the maximum throughput of the encryption circuit in the application can reach 1028.12 Mbps, the maximum frequency can reach 481.93 Mhz, the number of lookup tables (LUTs) occupied is 4581, and the throughput per unit area can reach 0.224 Mbps / LUTs.

Claims

1. An implementation method of a lightweight authentication encryption and decryption device, the device comprising an encryption circuit, a decryption circuit, an authentication output module and a permutation network module, wherein the encryption circuit comprises a first initialization module, a first associated data processing module, a plaintext processing module and a first finalization module connected in sequence; the decryption circuit comprises a second initialization module, a second associated data processing module, a ciphertext processing module and a second finalization module connected in sequence; the plaintext processing module is connected with the ciphertext processing module, and the first finalization module and the second finalization module are respectively connected with the authentication output module; each module in the encryption circuit and the decryption circuit calls the permutation network module; characterized in that, The implementation process of the encryption circuit is as follows: After the external signal is input into the encryption circuit, the first initialization module first initializes the state variable according to the key, the fixed random number and the algorithm parameter, and then inputs the state variable and the associated data into the first associated data processing module. The first associated data processing module uses the block associated data XOR operation and the permutation network module to perform P transformation on the state variable for further randomization. Then, the plaintext processing module starts the plaintext encryption link, and sequentially performs XOR operation on a plaintext block and the state variable to generate a ciphertext block. Then, the P transformation is applied to update the state variable. The above plaintext block encryption process is repeated until all plaintext blocks are encrypted. Finally, the state variable and the key are input into the first finalization module to generate an authentication tag, and the ciphertext, the ciphertext validity flag, the ciphertext output completion signal and the authentication tag are output; wherein the plaintext processing module uses the state variable to sequentially encrypt the externally input plaintext. Specifically, the 64-bit plaintext block externally input is XORed with the high 64 bits of the state variable to obtain a corresponding 64-bit ciphertext block. Then, the state variable is permuted for 6 rounds to update the state variable. The encryption and state variable permutation processes are repeated until the last plaintext block, only the XOR operation is performed to generate the ciphertext block, and the permutation operation is no longer performed; the permutation network module is used to implement the P transformation, and the state variable S is updated through a finite state machine; one round of permutation completed by the permutation network module includes a round constant addition process, an S-box replacement process and a linear diffusion layer process; in the column parallel replacement process in the S-box replacement process, a certain delay operation is randomly inserted; The implementation process of the decryption circuit is as follows: After the external signal is input into the decryption circuit, the second initialization module and the second associated data processing module are sequentially processed. Then, according to the ciphertext, the ciphertext validity flag and the ciphertext output completion signal output by the encryption circuit, the ciphertext data processing module and the second finalization module are sequentially processed to output the plaintext, the plaintext validity flag and the authentication tag; wherein the ciphertext data processing module uses the state variable to sequentially decrypt the externally input ciphertext. Specifically, the input 64-bit ciphertext block is XORed with the high 64 bits of the state variable to obtain a corresponding 64-bit plaintext block. Then, the state variable is permuted for 6 rounds to update the state variable. The decryption and state variable permutation processes are repeated until the last ciphertext block. Since the last ciphertext block may be cropped, the corresponding bits of the high 64 bits of the state variable are XORed to generate the last plaintext block. The high 64 bits of the state variable are XORed with the padded last plaintext block to complete the update of the state variable.

2. The implementation method of claim 1, wherein, In the initialization process, the first initialization module and the second initialization module splice the initial vector IV, the key K and the random number N as the initial value of the state variable, and then XOR the key after 12 rounds of permutation to complete the update of the state variable.

3. The implementation method of claim 1, wherein, The first and second associated data processing modules use the externally input associated data to sequentially update the state variables. Specifically, the upper 64 bits of the state variable are XORed with the externally input 64-bit associated data block to form the new state variable and undergo six rounds of permutation. This process is repeated until all associated data are processed. Finally, the lowest bit of the state variable is inverted to complete the state update.

4. The implementation method of claim 1, wherein, The authentication output module is used to compare the authentication tags output by the encryption circuit and the decryption circuit. If the authentication tags are consistent, the authentication output module outputs the plain text content obtained by the decryption circuit; if they are inconsistent, no output is made.

5. The implementation method of claim 1, wherein, The first finalization module and the second finalization module are used to generate an authentication tag, perform 12 rounds of permutation after XORing the state variable with the key padded with zeros, complete the update of the state variable, and finally take the high 128 bits of the state variable and the high 128 bits of the key to obtain the authentication tag.

Images