LED block cipher algorithm rapid implementation method based on AMD processor

Abstract

The invention provides a rapid implementation method for an LED block cipher algorithm in an AMD series microprocessor environment aiming at the low-delay implementation problem of the LED block cipher on an advanced instruction processor supporting AVX2 and the like and the security problem of the LED block cipher, and the purpose of improving the encryption and decryption efficiency of data is achieved through the method. According to the method, under the condition that the encryption process of the algorithm is not changed, the plaintext is processed in parallel by using the bit slicing technology and the SIMD technology, the calculation performance of the algorithm is improved through the bit slicing of the data, and the encryption rate is further improved through the preprocessing of the data. According to the method disclosed by the invention, the capability of resisting side channel attacks of the algorithm is also improved on the premise of ensuring that the encryption efficiency is improved.

Description

Technical Field

[0001] The invention belongs to the field of information security, and in particular is a fast implementation method of an LED block cipher algorithm based on an AMD processor. Background Art

[0002] The lightweight cryptographic algorithm LED was proposed by Guo Jian in CHES-2011. It is an AES-like block cipher with an SPN structure. Its block length is 64 bits, and the key length is 64 bits and 128 bits. The state matrix of the algorithm is GF(2 4 ) on a 4×4 matrix. Its design goal is to provide an efficient and secure encryption scheme in a resource-constrained environment and minimize the consumption of computing resources. Existing implementations of the LED cryptographic algorithm mostly use a table lookup method. However, the replacement table size of the table lookup method is large, resulting in frequent exchange of data in the CPU table between the memory and the cache during the table lookup operation, which leads to a large table lookup delay and is not conducive to efficient parallel encryption and decryption of multiple groups of messages. In addition, the table lookup method cannot resist cache-timing side channel attacks, which limits the performance and security of the LED cryptographic algorithm. Although the LED cryptographic algorithm has significant advantages in design, how to achieve its efficient encryption in practical applications remains a challenge. Therefore, studying the fast implementation method of the LED cryptographic algorithm can not only improve the overall performance of the system, but also further enhance the endurance of the device, which is of great significance for practical applications.

[0003] The concept of bit slicing was first proposed by Biham in 1997. It was initially used to quickly implement the DES algorithm. On a 64-bit platform, 64 groups of DES messages were encrypted and decrypted in parallel. While implementing parallel encryption, the logical expression of the S-box was optimized. About 100 instructions were needed to implement an S-box. After Intel launched the SSE (Streaming SIMD Extensions) instruction set in 1996, the use of bit slicing in combination with multiple instruction sets became more and more widespread. The combination of the two technologies can make encryption and decryption of cryptographic algorithms more efficient. In specific implementations, the number of plaintext groups is usually closely related to the registers of the instruction set in the processor.

[0004] 2018 Lang Huan [1] et al. used SIMD instructions under the X86 architecture and used C language to call the AVX2 instruction interface, and gave two different SM4 efficient implementation methods. [2]An improved bit slicing method, namely fixed slicing, is proposed to implement AES on ARM and RISC-V platforms. This method reduces the logical operation steps of the linear layer to improve the overall implementation efficiency, providing a new method for subsequent slicing research. In 2020, Zhang Xiaocong et al. [3] A fast software optimization implementation method for SM4 is proposed using bit slicing technology. In 2021, Hyunjun Kim et al. [4] The SPEEDY algorithm is implemented using bit slicing technology. Due to the application of slicing technology, the defect of the SPEEDY algorithm's low performance at the software level is improved, and it can be operated very efficiently in software and can be applied to microcontrollers. In 2022, Wang Lei et al. [5] The AVX512 instruction set and bit slicing technology of SIMD technology are used to realize the parallel encryption and decryption of 512 groups of SM4 group messages. In 2024, Chen Chen et al. [6] The improved bit slicing method is used to implement parallel encryption and decryption of 64 groups of data of the SM4 algorithm. The theoretical encryption and decryption speed of this method reaches 4.1 clock cycles per byte. After testing, the encryption rate reaches 11162Mbps on the AMD Ryzen 7 5800H platform.

[0005] References:

[0006] [1] Lang Huan, Zhang Lei, Wu Wenling, Fast software implementation technology of SM4[J], Journal of University of Chinese Academy of Sciences, 2018, 35(2):180–187;

[0007] [2]Adomnicai A,Peyrin T.Fixslicing AES-like ciphers:New bitsliced ​​AESspeed records on ARM-Cortex Mand RISC-V[J].IACR Transactions on CryptographicHardware and Embedded Systems, 2021(1):402–425;

[0008] [3] Zhang Xiaocong, Guo Hua, Zhang Xiyong, Wang Chuang, Liu Jianwei, Fast software implementation of SM4 algorithm[J], Journal of Cryptography, 2020, 7(6):799-811;

[0009] [4] Kim H, et al. SPEEDY on cortex–M3: Efficient software implementation of SPEEDY on ARM cortex–M3[C] / / International Conference on InformationSecurity and Cryptology. Cham: Springer International Publishing, 2021: 434-444;

[0010] [5] Wang Lei, Gong Zheng, Liu Zhe, Chen Jinhai, Hao Jinfu, Fast software implementation of SM4 algorithm based on tower domain[J], Journal of Cryptography, 2022, 9(6): 1081-1098;

[0011] [6]Chen C, Guo H, Liu YH, Gong ZR, Zhang Y Summary of the invention

[0012] The purpose of the present invention is to use slicing technology and SIMD technology to implement parallel acceleration of the LED lightweight block cipher algorithm, use the parallel characteristics of the instruction set to increase the ability of the algorithm to process data in parallel, and use the powerful AVX2 instruction set to further optimize the various components of the algorithm, reduce the number of logic gates in the algorithm, and improve the efficiency of the algorithm. The LED block cipher algorithm implementation method of the present invention is concise and efficient, and is suitable for various platforms that support SIMD instructions.

[0013] The technical solution for achieving the purpose of the present invention is:

[0014] The present invention is a fast implementation method of the LED block cipher algorithm based on an AMD microprocessor, which mainly includes three steps: data preprocessing arrangement, round function encryption, and inverse processing of data arrangement. The data is arranged through preprocessing and inverse processing to achieve a slicing effect, and the data is parallel optimized using an instruction set in the processing step. At the same time, a SAT-based search method is used to optimize the implementation of the S box during the encryption processing step. In order to achieve a better balance between search results and search efficiency, the search method proposes a coding scheme using a local optimal solution, which further reduces logical operations and significantly improves the encryption speed of the algorithm.

[0015] The LED block cipher algorithm includes: plaintext initialization module, key arrangement module, round constant arrangement module, round key addition module, round constant addition module, S-box operation module, row shift module, column confusion module, and data inverse arrangement module.

[0016] The method of the present invention optimizes the algorithm data arrangement operation, uses 256-bit width instructions to implement encryption, and increases the number of data packets encrypted at a single time; on the other hand, uses SAT to search for local solutions, thereby obtaining an S-box implementation method with a smaller number of logic gates.

[0017] The present invention provides a method for quickly implementing an LED block cipher algorithm based on an AMD microprocessor, which specifically comprises the following steps:

[0018] (1) Plaintext initialization module, which organizes and stores plaintext data:

[0019] A 256-bit register is used to process and store data. The packet length of the LED block cipher algorithm is 64 bits. In order to better perform slicing processing, eight 256-bit registers Vm = (Vm0, Vm1, ..., Vm7) are used, where Vm i =(Vm i,0 ,Vm i,1 …,Vm i,255 ) is a 256-bit register, where 0≤i≤7, and 32 64-bit grouped data are stored in the register;

[0020] Specific storage method:

[0021] Construct a matrix M = (M 0，0 , M 0，1 , M 0，2 , M 0，3 ......M 31，62 , M 31，63 ), the dimension of the matrix is ​​32×64, where M a，b Represents a bit variable, (M a，0 , M a，1 , M a，2 , ..., M a，63 ) represents the a-th row of the matrix M, which is also the a-th plaintext group, 0≤a≤31, 0≤b≤63;

[0022] First, decompose M into M1=(M *，0 , M *，1 , M *，2 , M *，3 ......M *，31 ) and M2=(M *，32 , M *，33 , M*，34 , M *，35 ......M *，63 ), where M *,b represents the b-th column of the matrix M. Therefore, M1 is the matrix consisting of the first 32 columns of M, and M2 is the matrix consisting of the last 32 columns of M.

[0023] Then, define a matrix N1 with a dimension of 256×4=(N1 *,0 , N1 *,1 , N1 *,2 , N1 *,3 ), put the 4*w+ith column of M1 into N1 in order *,i , 0≤w≤7, 0≤i≤3;

[0024] Finally, the i-th column in matrix N1 is placed into register Vm i In the example, 0≤i≤3, thus completing the separation and storage of the matrix M1. Then, the same process is performed on the matrix M2, and the remaining 32×32 bits of plaintext data are placed in registers Vm4, Vm5, Vm6, and Vm7. At this point, the arrangement and storage of the plaintext data are completed.

[0025] (2) Key scheduling module, which schedules and stores keys:

[0026] The arrangement and storage of keys is essentially the same as that of plaintext data. First, a 32×64 matrix K is defined, and the 64-bit key data is expanded. The expanded key data is placed in each row of the matrix K.

[0027] Then, the 32×64-bit key data is processed according to the processing steps of the plaintext in step (1), and the key is stored in the form of K=(K 0，0 , K 0，1 , K 0，2 , K 0，3 ......K 0，63 ;……;K 31，0 , K 31，1 , K 31，2 , K 31， 3......K 31，63 ), where K a，b is the bth bit in the key; select 8 256-bit registers Km=(Km0, Km1, ..., Km7) to store the key, and decompose K into, K1=(K *，0 , K *，1 , K *，2 , K *，3 ......K *，31 ) and K2=(K *，32 , K*，33 , K *，34 , K *，35 ......K *，63 ), where K *,b represents the b-th column of matrix K. Therefore, K1 is the matrix consisting of the first 32 columns of K, and K2 is the matrix consisting of the last 32 columns of K.

[0028] Then, define a matrix N2 with a dimension of 256×4 = (N2 *,0 , N2 *,1 , N2 *,2 , N2 *,3 ), put the 4*w+ith column of K1 into N2 in order *,i , 0≤w≤7, 0≤i≤3;

[0029] Finally, the i-th column in matrix N2 is placed in register Km i In, 0≤i≤3;

[0030] Thus, the separate storage of matrix K1 is completed, and then the same process is performed on matrix K2, and the remaining 32×32 bits of key data are placed in registers Km4, Km5, Km6, and Km7. At this point, the arrangement and storage of the key data are completed.

[0031] (3) Round constant arrangement module, which arranges and stores round constants:

[0032] First, store the 64-bit round constants of the LED classic implementation method, and define r matrices C with dimensions of 32×64 r , r represents the number of steps, a total of 32 rounds of round constants are stored, and each round of round constants is expanded to a 32×64 matrix, C r =(C r 0，0 , C r 0，1 , C r 0，2 , C r 0，3 ......C r 0，63 ;……;C r 31，0 , C r 31，1 , C r 31，2 , C r 31，3 ......C r 31，63 ),in, Represents the round constant of the rth round, the bit data at the ath row and bth column in the matrix, 0≤r≤31, 0≤a≤31, 0≤b≤63;

[0033] Arrange the round constants according to step (2) and store the arranged round constants in 8 256-bit round constant registers. middle;

[0034] The specific operations are as follows:

[0035] C r Decompose into C r 1=(C r *，0 , C r *，1 , C r *，2 , C r *，3 ......C r *，31 ) and C r 2=(C r *，32 , C r *，33 , C r *，34 , C r *，35 ......C r *，63 ), where C r *,b Represents the matrix C r Therefore, C r 1 is C r The matrix composed of the first 32 columns of r 2 is C r The matrix consisting of the last 32 columns of ;

[0036] Then, define a matrix N3 with a dimension of 256×4=(N3 *,0 , N3 *,1 , N3 *,2 , N3 *,3 ), C r The 4*w+ith column of 1 is put into N3 in order *,i , 0≤w≤7, 0≤i≤3;

[0037] Finally, the i-th column in matrix N3 is placed into register , 0≤i≤3, thus completing the matrix C r 1, and then the matrix C r 2 Perform the same process and put the remaining 32×32 bits of data into the register middle.

[0038] (4) Round key adding module to encrypt the plaintext data:

[0039] The arranged plaintext data is stored in the 8×256-bit register Vm=(Vm0, Vm1, Vm2, Vm3, Vm4, Vm5, Vm6, Vm7), and the arranged round key is stored in the 8×256-bit register Km=(Km0, Km1, Km2, Km3, Km4, Km5, Km6, Km7). The data in the register are XORed. This can realize round key addition, 0≤i≤7, where Represents the bitwise exclusive-or operation.

[0040] The advantage of such encryption processing is that a total of 124 logic instructions are used for encryption processing in each round, which greatly reduces the number of logic operations required to implement the LED password algorithm.

[0041] (5) Wheel constant addition module, which performs addition processing on the wheel constant:

[0042] When processing round constant addition, select the round constant register according to the round number and set the round constant register With data register Vm i XOR processing The round constant addition process is completed after 32 iterations, 0≤r≤31, 0≤i≤7.

[0043] (6) S-box operation module, which performs logical operations on the S-box of the LED block cipher algorithm:

[0044] Let the S-box input of the LED block cipher algorithm be (Vm0, Vm1, Vm2, Vm3), and the output data be four 256-bit registers (Y0, Y1, Y2, Y3). The new S-box logical expression found by SAT is:

[0045]

[0046]

[0047]

[0048] Y0=Vm2&Vm0;

[0049]

[0050]

[0051] Y2=Vm3|Y0;

[0052]

[0053] Y1=Y0|Vm2;

[0054]

[0055]

[0056]

[0057] Finally, the data in registers (Y0, Y1, Y2, Y3) are assigned to registers (Vm0, Vm1, Vm2, Vm3) respectively. The logical operation method of registers (Vm4, Vm5, Vm6, Vm7) is the same as above. "&" represents the AND operation, "|" represents the OR operation, and "~" represents the inversion operation.

[0058] (7) Row shift module, which adjusts the bit position of the data in the register to implement the shift operation:

[0059] Use the instruction X(x)=_mm256_set_epi8(x) in the AVX2 instruction set for the first four registers storing plaintext data;

[0060] Vm i =_mm256_shuffle_epi8((Vm i ),(X(x))), 0≤i≤3, the last four registers are used by instruction

[0061] Y(y) = _mm256_set_epi8(y);

[0062] Vm i =_mm256_shuffle_epi8((Vm i ),(Y(y))), 4≤i≤7, x and y are 32 conversion parameters, and the corresponding bit position adjustment of the data in the register is performed to realize the shift operation.

[0063] (8) Column obfuscation module to diffuse and mix the plaintext information:

[0064] The bit slices of the internal state of the LED block cipher algorithm are represented by rows, so in the part where the column confusion matrix is ​​left-multiplied, a shift XOR operation is performed according to the position of each bit in the slice.

[0065] (9) Data reverse arrangement module, which performs reverse initialization processing on the ciphertext information:

[0066] After obtaining the final round of ciphertext information, the ciphertext information is inversely initialized, and the data in the Vm register is inversely processed according to the operation in the plaintext initialization module in step (1), thereby obtaining the ciphertext data corresponding to the plaintext bit data. The above is the complete encryption process of the plaintext information.

[0067] The beneficial effects of the method of the present invention are:

[0068] (1) Security advantages: Bit slicing technology can improve the algorithm's anti-attack ability by processing multiple data blocks in parallel in the processor, especially in resisting side channel attacks. Bit slicing technology divides data into smaller units for operation, which increases the difficulty for attackers to recover key information. SIMD technology allows multiple data units to be processed in one operation, reducing the frequency and duration of operations, thereby reducing fluctuations in energy consumption and reducing the possibility of information leakage.

[0069] (2) Achieving cost advantages: Through bit slicing technology, the algorithm can better adapt to the parallel architecture of the hardware, reducing the number of logic gates required and the consumption of hardware resources. This means that when implemented on low-power devices, the cost of hardware design and manufacturing can be reduced. The use of SIMD technology makes the algorithm more efficient when processing big data, and more data can be processed per clock cycle, reducing the total computing time and thus reducing energy consumption.

[0070] (3) Advantages in performance: Bit slicing technology speeds up data processing through parallel processing, especially on multi-core processors, it can achieve extremely high parallelism, greatly improving computing performance. Instruction set technology makes full use of the wide data channel capability of the processor and can process multiple data in the same clock cycle. At the same time, in the original implementation of the S-box, 12 XOR operations, 2 OR operations, and 3 AND operations were used, while this patent uses 10 XOR operations, 2 OR operations, and 2 AND operations, which has a 23.5% improvement in the performance of the S-box. The method of the present invention significantly improves the throughput of data processing and shortens the overall encryption time. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 It is a structural diagram of the algorithm initialization stage in the method of the present invention;

[0072] Figure 2 The figure is an overall flow chart of the LED block cipher algorithm optimized by the method of the present invention. DETAILED DESCRIPTION

[0073] The contents of the present invention are further described below in conjunction with the embodiments and drawings, but the present invention is not limited thereto.

[0074] Example

[0075] A fast implementation method of the LED block cipher algorithm based on AMD microprocessor. The hardware environment of the algorithm is processor: AMD Ryzen 7 6800H with Radeon Graphics 3.20GHz, memory: 16GB, and the compiler used is Visual Studio 2022. Figure 1-2 , the method comprises the following steps:

[0076] (1) Plaintext initialization module, which organizes and stores plaintext data:

[0077] Use 8 256-bit registers Vm=(Vm0, Vm1, ..., Vm7), where Vm i =(Vm i,0 ,Vm i,1 …,Vm i,255 ) is a 256-bit register, 0≤i≤7, and 32 64-bit grouped data are stored in the register;

[0078] Specific storage methods, such as Figure 1 As shown:

[0079] Construct a matrix M = (M 0，0 , M 0，1 , M 0，2 , M 0，3 ......M 31，62 , M 31，63 ), the dimension of the matrix is ​​32×64, where M a，b Represents a bit variable, (M a，0 , M a，1 , M a,2 , ..., M a,63 ) represents the a-th row of the matrix M, which is also the a-th plaintext group, 0≤a≤31, 0≤b≤63;

[0080] Reference Figure 1 , Table 1,

[0081]

[0082] The plaintext data is stored in Vm. First, the data in the plaintext matrix M is stored row by row in register Vm = (Vm0, Vm1, ..., Vm7). i，b+64*j =M 4i+j，b , then, the data in two adjacent registers in Vm are operated as follows:

[0083] Let t = (t0, t1, t2, t3, t4, t5, t6, t7), t i =(t i,0 , t i,1…, t i,255 ) is a 256-bit register, where 0 ≤ i ≤ 7, 0 ≤ j ≤ 3, 0 ≤ b ≤ 63;

[0084] t 2i = and(Vm 2i , p), t 2i+1 = slli(and(Vm 2i , p), z); Vm 2i = srli(and(Vm 2i+1 , p), z);

[0085] Vm 2i+1 = and(Vm 2i+1 , p); Vm 2i = xor(t 2i , Vm 2i ); Vm 2i+1 = xor(t 2i+1 , Vm 2i+1 ); t 2i = Vm 2i ;

[0086] Vm 2i = unpacklo(Vm 2i , Vm 2i+1 ); Vm 2i+1 = unpackhi(t 2i , Vm 2i+1 ); t 2i = Vm 2i ; Vm 2i = Vm 2i+1 ;

[0087] Vm 2i+1 = t 2i ; t 2i = Vm 2i ; Vm 2i = unpacklo(Vm 2i , Vm 2i+1 ); Vm 2i+1 = unpackhi(t 2i , Vm 2i+1 ); t 2i = Vm 2i ; Vm 2i = Vm 2i+1 ; Vm 2i+1 = t 2i, 0≤i≤3, the AVX2 instructions used are defined as: slli(x,z)=_mm256_slli_epi16((x),(z)), srli(x,z)=_mm256_srli_epi16((x),(z)), xor(x,y)=_mm256_xor_si256((x),(y)),

[0088] unpackhi(x,y)=_mm256_unpackhi_epi8((x),(y))、

[0089] unpacklo(x,y)=_mm256_unpacklo_epi8((x),(y))、

[0090] and(x,p)=_mm256_and_si256((x),(p)), where x and y represent 256-bit registers, z represents a decimal adjustment parameter, and p is a 32-bit hexadecimal parameter;

[0091] Define a matrix N1 with a dimension of 256×8 = (N1 *,0 , N1 *,1 , N1 *,2 , N1 *,3 , N1 *,4 , N1 *,5 , N1 *,6 ,

[0092] N1 *,7 ) where N1 *,b represents the b-th column of matrix N1,

[0093] Use the mask to extract the same index bits of the 8 registers in Vm and store them in the matrix N1 respectively. *,0 ,

[0094] N1 *,1 , N1 *,2 , N1 *,3 , N1 *,4 , N1 *,5 , N1 *,6 , N1 *,7 The specific operations are as follows:

[0095] N1 *,0 =xor(xor(and(Vm0,mask(0x88)),srli(and(Vm1,mask(0x88)),

[0096] 1)),xor(srli(and(Vm2,mask(0x88)),2),srli(and(Vm3,mask(0x88)),3)))

[0097] N1 *,1 =xor(xor(slli(and(Vm0,mask(0x44)),1),and(Vm1,mask(0x44))),

[0098] xor(srli(and(Vm2,mask(0x44)),1),srli(and(Vm3 mask(0x44)),2)))

[0099] N1 *,2 =xor(xor(slli(and(Vm0,mask(0x22)),2),slli(and(Vm1,mask(0x22)),1)),

[0100] xor(and(Vm2,mask(0x22)),srli(and(Vm3,mask(0x22)),1)))

[0101] N1 *,3 =xor(xor(slli(and(Vm0,mask(0x11)),3),slli(and(Vm1,mask(0x11)),2)),

[0102] xor(slli(and(Vm2,mask(0x11)),1),and(Vm3,mask(0x11))))

[0103] N1 *,4 =xor(xor(and(Vm4,mask(0x88)),srli(and(Vm5,mask(0x88)),1)),

[0104] xor(srli(and(Vm6,mask(0x88)),2),srli(and(Vm7,mask(0x88)),3)))

[0105] N1 *,5 =xor(xor(slli(and(Vm4,mask(0x44)),1),and(Vm5,mask(0x44))),

[0106] xor(srli(and(Vm6,mask(0x44)),1),srli(and(Vm7 mask(0x44)),2)))

[0107] N1 *,6 =xor(xor(slli(and(Vm4,mask(0x22)),2),slli(and(Vm5,mask(0x22)),1)),

[0108] xor(and(Vm6,mask(0x22)),srli(and(Vm7,mask(0x22)),1)))

[0109] N1 *,7 =xor(xor(slli(and(Vm4,mask(0x11)),3),slli(and(Vm5,mask(0x11)),2)),

[0110] xor(slli(and(Vm6,mask(0x11)),1),and(Vm7,mask(0x11)))),

[0111] Finally, N1 *,i The data in the Vm is stored back i Register, namely Vm i =N1 *,i , 0≤i≤7;

[0112] (2) Key scheduling module, which schedules and stores keys:

[0113] The key arrangement and storage work is essentially the same as the plaintext data operation steps in step (1). Define a 32×64 matrix K, expand the 64-bit key data, and put the expanded key data into each row of the matrix K;

[0114] Then, the 32×64-bit key data is processed according to the processing steps of the plaintext in step (1), and the key is stored in the form of K=(K 0，0 , K 0，1 , K 0，2 , K 0，3 ......K 0，63 ;……;K 31，0 , K 31，1 , K 31，2 , K 31， 3......K 31，63 ), where K a，b is the bth bit in the key;

[0115] Select 8 256-bit registers Km=(Km0, Km1, ..., Km7) to store the key;

[0116] First, the data in the matrix K is stored row by row in register Km. i，b+64*j =K 4i+j，b , then, the data in two adjacent registers are operated as follows:

[0117] Let h = (h0, h1, h2, h3, h4, h5, h6, h7), h i =(h i,0 ,h i,1 …,h i,255 ) is a 256-bit register, where 0≤i≤7, 0≤j≤3, 0≤b≤63. The AVX2 instructions used are: slli(x,z)=_mm256_slli_epi16((x),(z)), srli(x,z)=_mm256_srli_epi16((x),(z)), xor(x,y)=_mm256_xor_si256((x),(y)),

[0118] unpackhi(x,y)=_mm256_unpackhi_epi8((x),(y))、

[0119] unpacklo(x,y)=_mm256_unpacklo_epi8((x),(y))、

[0120] and(x,p)=_mm256_and_si256((x),(p)), where x and y represent 256-bit registers, z represents a decimal adjustment parameter, and p is a 32-bit hexadecimal parameter;

[0121] h 2i =and(Km 2i ,p),h 2i+1 =slli(and(Km 2i ,p),z);Km 2i =srli(and(Km 2i+1 ,p),z);

[0122] Km 2i+1 =and(Km 2i+1 ,p); Km 2i =xor(h 2i ,Km 2i );Km 2i+1 =xor(h 2i+1 ,Km 2i+1 );h 2i =Km 2i ;

[0123] Km 2i = unpacklo(Km2i ,Km 2i+1 );Km 2i+1 =unpackhi(h 2i ,Km 2i+1 );h 2i =Km 2i ;

[0124] Km 2i =Km 2i+1 ; Km 2i+1 =h 2i ;h 2i =Km 2i ; Km 2i = unpacklo(Km 2i ,Km 2i+1 );

[0125] Km 2i+1 =unpackhi(t 2i ,Km 2i+1 );h 2i =Km 2i ; Km 2i =Km 2i+1 ; Km 2i+1 =h 2i , 0≤i≤3;

[0126] Define a matrix N2 with a dimension of 256×8 = (N2 *,0 , N2 *,1 , N2 *,2 , N2 *,3 , N2 *,4 , N2 *,5 , N2 *,6 , N2 *,7 ) where N2 *,b represents the b-th column of matrix N2;

[0127] Use the mask to extract the same index bits in the 8 registers Km. The specific operation is the same as in step (1), and the data is stored in the matrix N2;

[0128] Finally, N2 *,i The data in Km is stored back i Register, i.e. Km i =N2 *,i , 0≤i≤7, so far, the expansion and storage of key data are completed.

[0129] (3) Round constant arrangement module, which arranges and stores round constants:

[0130] The round constant operation is the same as step (2). Define r matrices C with dimensions of 32×64r , r represents the number of steps, a total of 32 rounds of round constants are stored, and each round of round constants is expanded to a 32×64 matrix, C r =(C r 0，0 , C r 0，1 , C r 0，2 , C r 0， 3......C r 0，63 ;……;C r 31，0 , C r 31，1 , C r 31，2 , C r 31，3 ......C r 31，63 ),in, The bit data representing the round constant of the rth round in the ath row and the bth column of the matrix (0≤r≤31, 0≤a≤31, 0≤b≤63);

[0131] Follow step (2) to arrange the round constants and store the arranged round constants in eight 256-bit round constant registers. middle;

[0132] First, the matrix C r The data in is stored in register Cm by row r middle, Then Cm r The data in two adjacent registers are operated as follows: let e = (e0, e1, e2, e3, e4, e5, e6, e7), e i＝ (e i,0 , e i,1 …, e i,255 ) is a 256-bit register, where 0≤i≤7, 0≤j≤3, 0≤b≤63, 0≤r≤31;

[0133] The AVX2 instructions used are: slli(x,z)=_mm256_slli_epi16((x),(z)), srli(x,z)=_mm256_srli_epi16((x),(z)), xor(x,y)=_mm256_xor_si256((x),(y)), unpackhi(x,y)=_mm256_unpackhi_epi8((x),(y)),

[0134] unpacklo(x,y)=_mm256_unpacklo_epi8((x),(y))、

[0135] and(x,p)=_mm256_and_si256((x),(p)), where x and y represent 256-bit registers, z represents a decimal adjustment parameter, and p is a 32-bit hexadecimal parameter;

[0136]

[0137]

[0138]

[0139]

[0140]

[0141] Define a matrix N3 with a dimension of 256×8 = (N3 *,0 , N3 *,1 , N3 *,2 , N3 *,3 , N3 *,4 , N3 *,5 , N3 *,6 , N3 *,7 ) where N3 *,b represents the b-th column of matrix N3;

[0142] Use mask to modify 8 registers Cm r The same index bit is extracted, and the specific operation is consistent with the method in step (2), and the data is stored in the matrix N3;

[0143] Finally, N3 *,i The data in the Register, that is At this point, the expansion and storage of wheel constants have been completed.

[0144] (4) Round key adding module to encrypt the plaintext data:

[0145] Initialize the Vm output in the plain text module in step (1) i and (2) Km output from the key scheduling module i Do XOR processing, Vm i =xor(Vm i ,Km i ), 0≤i≤7.

[0146] (5) Wheel constant addition module, which performs addition processing on the wheel constant:

[0147] Output from step (3) of the round constant arrangement module and (4) the output Vm in the round key addition module i Do XOR processing,

[0148] (6) S-box operation module, which performs logical operations on the S-box of the LED block cipher algorithm:

[0149] The definition of the AVX2 instruction used in the replacement operation of the S-box is:

[0150] xor(x,y)=_mm256_xor_si256((x),(y))、

[0151] and(x,y)=_mm256_and_si256((x),(y))、

[0152] or(x,y)=_mm256_or_si256((x),(y))、

[0153] mask(z)=_mm256_set1_epi8((z))、

[0154] Instructions such as andnot(x,y)=_mm256_andnot_si256((x),(y)) accelerate the implementation efficiency of the S-box. x and y are 256-bit registers, and z is a hexadecimal number. A more concise S-box implementation method is found through SAT search.

[0155] Let the S-box input of the LED block cipher algorithm be (Vm0, Vm1, Vm2, Vm3), and the output data be four 256-bit registers (Y0, Y1, Y2, Y3). The S-box logical expression found by SAT is:

[0156] Vm2 = xor(Vm2, Vm1);

[0157] Vm0=xor(Vm0,and(Vm1,Vm2));

[0158] Y3=xor(Vm3,Vm0);

[0159] Y0=and(Vm2,Vm0);

[0160] Vm2 = xor(Vm2, Y3);

[0161] Y0=xor(Y0,Vm1);

[0162] Y2=or(Vm3,)Y0;

[0163] Y0=xor(Y0,xor(Vm3,mask(0xff)));

[0164] Y1=or(Y0,Vm2);

[0165] Y1=xor(Vm0,Y1);

[0166] Y2=xor(Vm2,Y2);

[0167] Y0=xor(Y2,Y0);

[0168] Finally, the data in registers (Y0, Y1, Y2, Y3) are assigned to registers (Vm0, Vm1, Vm2, Vm3), and the logical operation method of registers (Vm4, Vm5, Vm6, Vm7) is the same as above.

[0169] (7) Row shift module, which adjusts the bit position of the data in the register to implement the shift operation: the data after the S-box replacement is placed in the register Vm i After that, the AVX2 instruction set in the AMD chip is used for the registers. The first four registers use the instruction, X(z1)=_mm256_set_epi8(z1);

[0170] Vm i =_mm256_shuffle_epi8((Vm i ),(X(z1))), 0≤i≤3, the last four registers are used by instruction

[0171] Y(z2)=_mm256_set_epi8(z2); Vm i =_mm256_shuffle_epi8((Vm i ),(Y(z2))),4≤i≤7,

[0172] z1 and z2 are 32 decimal adjustment parameters, which adjust the bit positions of the data in the register accordingly to implement the shift operation.

[0173] (8) Column obfuscation module to diffuse and mix the plaintext information:

[0174] The following operations are performed for the column confusion implementation of the LED algorithm: let register Tm = (Tm0, Tm1, Tm2, ​​Tm3, Tm4, Tm5, Tm6, Tm7), Em = (Em0, Em1, Em2, Em3), and the definition of AVX2 instructions is: xor(x,y) = _mm256_xor_si256((x), (y)), and(x,y) = _mm256_and_si256((x), (y)), P(p) = _mm256_set_epi8(p), srli(x,z) = _mm256_srli_si256((x), (z)), slli(x,z) = _mm256_slli_si256((x), (z)), where Tm i 、Em i , x, y represent 256-bit registers, z is a decimal adjustment parameter, and p is a 32-bit adjustment parameter. The specific steps are as follows:

[0175] Tm i =srli((Vm i ),(z));

[0176] Em0=xor(xor(Vm2,Tm0),xor(Vm5,Tm5));

[0177] Em1=xor(xor(xor(Vm0,Vm3),xor(Tm1,Vm6)),Tm6);

[0178] Em2=xor(xor(xor(Vm0,Vm3),xor(Tm2,Vm7)),xor(xor(Vm4,Tm3),Tm0));

[0179] Em3=xor(xor(Vm1,Tm3),xor(Vm4,Tm4));

[0180] Vm0=xor(xor(Tm2,Vm4,xor(Tm5,Em1));

[0181] Vm1=xor(xor(xor(Tm0,Tm3),xor(Vm5,Tm6)),Em2);

[0182] Vm2=xor(xor(xor(Tm0,Tm1),xor(Vm6,Tm7)),xor(xor(Tm4,Em3),Em0));

[0183] Vm3=xor(xor(Tm1,Vm7),xor(Tm4,Em0));

[0184] Tm0=xor(xor(Vm6,Tm4),xor(Em1,Vm1));

[0185] Tm1=xor(xor(xor(Vm4,Vm7),xor(Tm5,Em2)),Vm2);

[0186] Tm2=xor(xor(xor(Vm4,Vm5),xor(Tm6,Em3)),xor(xor(Em0,Vm3),Vm0));

[0187] Tm3=xor(xor(Vm1,Tm3),xor(Vm4,Tm4));

[0188] Vm4=xor(xor(Tm6,Em0),xor(Vm0,Tm1));

[0189] Vm5=xor(xor(xor(Tm4,Tm7),xor(Em1,Vm2)),Tm2);

[0190] Vm6=xor(xor(xor(Tm4,Tm5),xor(Em2,Vm3)),xor(xor(Vm0,Tm3),Tm0));

[0191] Vm7=xor(xor(Tm5,Em3),xor(Vm0,Tm0));

[0192] Vm0=xor(and(Em0,P(p)),slli(Vm0,z)); Vm1=xor(and(Em1,P(p)),slli(Vm1,z));

[0193] Vm2=xor(and(Em2,P(p)),slli(Vm2,z)); Vm3=xor(and(Em3,P(p)),slli(Vm3,z));

[0194] Vm4=xor(and(Tm0,P(p)),slli(Vm4,z)); Vm5=xor(and(Tm1,P(p)),slli(Vm5,z));

[0195] Vm6=xor(and(Tm2,P(p)),slli(Vm6,z)); Vm7=xor(and(Tm3,P(p)),slli(Vm7,z)).

[0196] (9) Data reverse arrangement module, which performs reverse initialization processing on the ciphertext information:

[0197] According to the above module operation sequence, the plaintext information is encrypted to complete a round of data encryption results. After 32 rounds of iteration, the encrypted ciphertext information can be obtained. Finally, the ciphertext information is reversely initialized to reverse the operations in the plaintext initialization module, thereby obtaining the ciphertext data corresponding to the plaintext bit data.

[0198] Reference Figure 2 , which is the overall optimization concept of the present invention. In the embedded device of the microprocessor under the AMD processor, the LED optimization implementation algorithm described in the present invention reduces a lot of operations based on the slicing technology, reduces the implementation cost compared with the original algorithm, and improves the implementation speed of data encryption and decryption. By testing the throughput of the optimized LED algorithm, the experimental results show that the encryption efficiency of the LED algorithm optimized by using bit slicing technology, AVX2 instructions and S-box is about 1.25 times higher than that of the unoptimized LED algorithm.

Claims

1. A fast implementation method of LED block cipher algorithm based on AMD microprocessor, characterized in that: The specific steps include: (1) Plaintext initialization module, which organizes and stores plaintext data: A 256-bit register is used to process and store data. The packet length of the LED block cipher algorithm is 64 bits. In order to better perform slicing processing, eight 256-bit registers Vm = (Vm0, Vm1, ..., Vm7) are used, where Vm i =(Vm i,0 ,Vm i,1 …,Vm i,255 ) is a 256-bit register, where 0≤i≤7, and 32 64-bit grouped data are stored in the register; Specific storage method: Construct a matrix M = (M 0，0 , M 0，1 , M 0，2 , M 0，3 ......M 31，62 , M 31，63 ), the dimension of the matrix is ​​32×64, where M a，b Represents a bit variable, (M a，0 , M a，1 , M a，2 , ..., M a，63 ) represents the a-th row of the matrix M, which is also the a-th plaintext group, 0≤a≤31, 0≤b≤63; First, decompose M into M1=(M *，0 , M *，1 , M *，2 , M *，3 ......M *，31 ) and M2=(M *，32 , M *，33 , M *，34 , M *，35 ......M *，63 ), where M *,b represents the b-th column of the matrix M. Therefore, M1 is the matrix consisting of the first 32 columns of M, and M2 is the matrix consisting of the last 32 columns of M. Then, define a matrix N1 with a dimension of 256×4=(N1 *,0 , N1 *,1 , N1 *,2 , N1 *,3 ), put the 4*w+ith column of M1 into N1 in order *,i , 0≤w≤7, 0≤i≤3; Finally, the i-th column in matrix N1 is placed into register Vm i , 0≤i≤3, thus completing the separation and storage of the matrix M1, and then performing the same process on the matrix M2, putting the remaining 32×32 bits of plaintext data into registers Vm4, Vm5, Vm6, and Vm7. At this point, the arrangement and storage of the plaintext data is completed; (2) Key scheduling module, which schedules and stores keys: The arrangement and storage of keys is essentially the same as that of plaintext data. First, a 32×64 matrix K is defined, and the 64-bit key data is expanded. The expanded key data is placed in each row of the matrix K. Then, the 32×64-bit key data is processed according to the plaintext processing steps in step (1), and the key storage format is K=(K 0，0 , K 0，1 , K 0，2 , K 0，3 ......K 0，63 ;……;K 31，0 , K 31，1 , K 31，2 , K 31，3 ......K 31，63 ), where K a，b is the bth bit in the key; Select 8 256-bit registers Km=(Km0, Km1, ..., Km7) to store the key, and decompose K into: K1=(K *，0 , K *，1 , K *，2 , K *，3 ......K *，31 ) and K2=(K *，32 , K *，33 , K *，34 , K *，35 ......K *，63 ), where K *,b represents the b-th column of matrix K. Therefore, K1 is the matrix consisting of the first 32 columns of K, and K2 is the matrix consisting of the last 32 columns of K. Then, define a matrix N2 with a dimension of 256×4 = (N2 *,0 , N2 *,1 , N2 *,2 , N2 *,3 ), put the 4*w+ith column of K1 into N2 in order *,i , 0≤w≤7, 0≤i≤3; Finally, the i-th column in matrix N2 is placed in register Km i In, 0≤i≤3; Thus, the separation and storage of matrix K1 is completed, and then the matrix K2 is processed in the same way, and the remaining 32×32 bits of key data are placed in registers Km4, Km5, Km6, and Km7. At this point, the arrangement and storage of key data are completed; (3) Round constant arrangement module, which arranges and stores round constants: First, store the 64-bit round constants of the LED classic implementation method, and define r matrices C with dimensions of 32×64 r , r represents the number of steps, a total of 32 rounds of round constants are stored, and each round of round constants is expanded to a 32×64 matrix, C r =(C r 0，0 , C r 0，1 , C r 0，2 , C r 0，3 ......C r 0，63 ;……;C r 31，0 , C r 31，1 , C r 31，2 , C r 31 , 3......C r 31，63 ),in, Represents the round constant of the rth round, the bit data at the ath row and bth column in the matrix, 0≤r≤31, 0≤a≤31, 0≤b≤63; According to step (2), the round constants are arranged and stored in eight 256-bit round constant registers. middle; The specific operations are as follows: C r Decompose into C r 1=(C r *，0 , C r *，1 , C r *，2 , C r *，3 ......C r *，31 ) and C r 2=(C r *，32 , C r *，33 , C r *，34 , C r *，35 ......C r *，63 ), where C r *,b Represents the matrix C r Therefore, C r 1 is C r The matrix consisting of the first 32 columns of r 2 is C r The matrix consisting of the last 32 columns of ; Then, define a matrix N3 with a dimension of 256×4=(N3 *,0 , N3 *,1 , N3 *,2 , N3 *,3 ), C r The 4*w+ith column of 1 is put into N3 in order *i , 0≤w≤7, 0≤i≤3; Finally, the i-th column in matrix N3 is placed into register , 0≤i≤3, thus completing the matrix C r 1, and then the matrix C r 2 Perform the same process and put the remaining 32×32 bits of data into the register middle; (4) Round key adding module to encrypt the plaintext data: The sliced ​​plaintext data is encrypted, and the arranged plaintext data is stored in the 8×256-bit register Vm=(Vm0, Vm1, Vm2, Vm3, Vm4, Vm5, Vm6, Vm7), and the arranged round key is stored in the 8×256-bit register Km=(Km0, Km1, Km2, Km3, Km4, Km5, Km6, Km7). The data in the register is XORed with Vm i =Vm i ⊕Km i The round key addition can be realized, 0≤i≤7, where "⊕" represents the bitwise XOR operation; (5) Wheel constant addition module, which performs addition processing on the wheel constant: When processing round constant addition, select the round constant register according to the round number and set the round constant register With data register Vm i XOR processing After 32 iterations, the round constant addition process is completed, 0≤r≤31, 0≤i≤7; (6) S-box operation module, which performs logical operations on the S-box of the LED block cipher algorithm: Let the S-box input of the LED block cipher algorithm be (Vm0, Vm1, Vm2, Vm3), and the output data be four 256-bit registers (Y0, Y1, Y2, Y3). The new S-box logical expression found by SAT is: Y0=Vm2&Vm0; Y2=Vm3|Y0; Y1=Y0|Vm2; Finally, the data in registers (Y0, Y1, Y2, Y3) are assigned to registers (Vm0, Vm1, Vm2, Vm3) respectively. The logical operation method of registers (Vm4, Vm5, Vm6, Vm7) is the same as above, "&" represents the AND operation, "|" represents the OR operation, and "~" represents the inversion operation; (7) Row shift module, which performs corresponding bit position adjustment on the data in the register to implement the shift operation: for the first four registers storing plaintext data, the instruction X(x)=_mm256_set_epi8(x) in the AVX2 instruction set is used; Vm i =_mm256_shuffle_epi8((Vm i ),(X(x))), 0≤i≤3, the last four registers are set using instruction Y(y)=_mm256_set_epi8(y); Vm i =_mm256_shuffle_epi8((Vm i ),(Y(y))), 4≤i≤7, x, y are 32 conversion parameters, and the corresponding bit position adjustment of the data in the register is performed to implement the shift operation; (8) Column obfuscation module to diffuse and mix the plaintext information: The bit slices of the internal state of the LED block cipher algorithm are represented by rows, so in the part where the column confusion matrix is ​​left-multiplied, a shift XOR operation is performed according to the position of each bit in the slice; (9) Data reverse arrangement module, which performs reverse initialization processing on the ciphertext information: After obtaining the final round of ciphertext information, the ciphertext information is inversely initialized, and the data in the Vm register is inversely processed according to the operation in the plaintext initialization module in step (1), thereby obtaining the ciphertext data corresponding to the plaintext bit data.

Images