Stream cipher implementation method based on FSR and fourth-order CA

Abstract

The invention discloses a stream cipher implementation method based on an FSR and a fourth-order CA. The method comprises the steps of designing a stream cipher algorithm structure, designing parts of an LFSR and an NFSR, setting a CA rule of register updating, designing a key stream generation function, initializing an algorithm, generating a key stream and encrypting and decrypting the algorithm. The register is updated by using a CA rule, and each internal status bit in each stage of algorithm operation is a bitwise feedback bit; in the initial loading stage, an initial key and an initial vector are used for loading the LFSR and the NFSR, and residual bits of the LFSR are expanded and filled by using the initial key; 32 rounds of iteration are used in the key stream initialization stage, and a key and a vector are fully mixed in an internal state of a register. Good differential characteristics and nonlinearity are provided for the cryptographic algorithm by combining a fourth-order CA rule with the design of a register, and differential analysis, fault attack and the like can be effectively resisted by using a key expansion filling LFSR in an initialization stage.

Description

Technical Field

[0001] The invention belongs to the field of information security encryption and decryption algorithms, in particular to a stream cipher implementation method based on FSR and fourth-order CA. Background Art

[0002] Stream cipher algorithm is an important type of symmetric cryptographic algorithm with the characteristics of high encryption and decryption efficiency, simple implementation, and high flexibility. It is well suited to software and hardware environments and is easy to implement. Therefore, it is of practical significance to study new stream cipher design methods.

[0003] The execution of a stream cipher usually consists of two phases: the initialization phase and the key stream generation phase. In the initialization phase, the key (KEY) and the initialization vector (IV) are first loaded into the internal state of the cryptographic algorithm, and the update function is iteratively called multiple times during the initialization cycle to update the internal state, so that the KEY and IV are fully mixed in the internal state of the cryptographic algorithm; in the key stream generation phase, pseudo-random key stream bits are generated from the highly diffused internal state by calling the output function, and the internal state is further updated using the update function.

[0004] Common stream cipher design structures include stream ciphers based on linear feedback shift register (LFSR), stream ciphers based on nonlinear feedback shift register (NFSR), stream ciphers based on fourth-order cellular automata (CA), and stream ciphers based on block cipher working modes and structures. LFSR-based stream ciphers use LFSR combined with finite state machine (FSM) to generate key stream sequences. The most widely used stream cipher of this type is the SNOW 3G algorithm for mobile communications in the 3GPP standard. NFSR-based stream ciphers use NFSR and key stream generation functions to generate key stream sequences. NFSR provides good nonlinearity for the generated sequence. Typical NFSR stream cipher algorithms include Grain v1 and Trivium. CA-based stream ciphers generate key stream sequences by using corresponding rules. CA rules can often be used as pseudo-random number generators and true random number generators, and have good parallel characteristics. Such ciphers include CAR30 and CASTREAM. Among the above methods, the design of stream ciphers based on LFSR and NFSR is the most mature, and its related security analysis methods are also very complete. Among various analysis methods, cubic attacks pose a great threat to the above-mentioned stream ciphers. The CA rule can increase the difficulty for attackers to find legislative variables. Combining CA with LFSR and NFSR as building blocks of stream ciphers can provide good security, simple design and simple implementation. Summary of the invention

[0005] The purpose of the present invention is to use the good characteristics of CA in combination with registers (Leedback shift register, FSR) to provide a stream cipher algorithm with high security strength, simple design, flexible application to various platforms, and easy implementation. The algorithm uses an LFSR and an NFSR, and the LFSR and NFSR are updated using CA with specific rules. In the initialization stage, the output generated by the output function will be fed back to the LFSR and NFSR, and the LFSR affects the update of the NFSR. In the key stream generation stage, the LFSR and NFSR are continuously updated to ensure the good characteristics of the output function input.

[0006] The technical solution for achieving the purpose of the present invention is:

[0007] The stream cipher implementation method based on FSR and fourth-order CA includes the following steps:

[0008] (1) Design the structure of the stream cipher algorithm and determine the components of the algorithm;

[0009] First, two series-connected FSRs are used as the internal state driving part of the algorithm, that is, the cascade structure of LFSR and NFSR is adopted;

[0010] The linear feedback shift register provides good statistical characteristics. The present invention uses a 128-bit LFSR as the linear part of the password and uses a 4th-order linear CA rule to update the units of the linear block. The state of the LFSR is from high to low from left to right.

[0011] The nonlinear feedback shift register provides good nonlinear characteristics, which well supplements the defect of nonlinearity of LFSR-type cryptographic algorithms. The present invention uses a 128-bit NFSR as the nonlinear part of the cipher, and uses a 4th-order nonlinear CA rule vector to update the unit of the linear block. The state of the LFSR is from high to low from left to right;

[0012] Secondly, the update rules of LFSR and NFSR are designed. Different from other types of registers that have corresponding update functions and feedback functions, the registers included in this implementation method have their own CA rules. LFSR uses linear CA to update the internal state, and NFSR uses nonlinear CA to update the internal state.

[0013] Finally, an output function with good statistical properties is designed. The output function of the algorithm accepts elements from two registers to output bits. In the initialization phase, the output bits participate in the update of LFSR and NFSR. The selection of LFSR at different stages affects the internal state update of NFSR.

[0014] (2) Design the initialization process of the stream cipher algorithm based on the CA rule;

[0015] After the components of the stream cipher algorithm are determined, they need to go through an initialization process. During the initialization phase, the output bits of the output function are always involved in the state update of the two FSRs. The algorithm initialization process is divided into four steps:

[0016] In the first step, the initial key and vector are loaded into two FSRs, and the rest of the LFSR is filled with the initial key extension;

[0017] The second step is to make each bit of LFSR and NFSR satisfy the corresponding CA rule and set the extension bit of LFSR and NFSR;

[0018] In the third step, the key bits generated in the initialization phase are XORed into the LFSR and NFSR;

[0019] In the fourth step, the algorithm performs 32 initial iterations;

[0020] In the initialization phase, the initial key and initial vector are loaded into the register. After loading, the key is extended to the LFSR. This step is considered to accelerate the confusion of the key and iv in the internal state on the one hand, and to prevent differential analysis and fault attacks on the other hand. In this phase, the key is XORed into two registers, and no key stream is generated in the first 32 clock cycles of the algorithm;

[0021] (3) Key stream generation function

[0022] After the algorithm initialization process, the algorithm enters the key stream generation stage. At this time, the output of the output function is the key bit, and the output bit no longer participates in the update of the LFSR and NFSR states. Each round of iteration generates a 1-bit key, and the output bits of multiple iterations constitute the key stream. Based on the algorithm security, the maximum length of the key stream generated by a single key initial value is limited to 2 64 ;

[0023] The key stream generation function h(x) is a fourth-order balanced nonlinear function that accepts 16-bit inputs from the LFSR and NFSR and mixes the states of the two registers to further enhance the nonlinear nature, good correlation, and statistical properties of the key stream.

[0024] (4) Algorithm encryption and decryption process;

[0025] When encrypting data, a key stream is generated based on the size of the plaintext, and is XORed with the plaintext bit by bit to generate ciphertext; when decrypting, the key stream is XORed with the ciphertext bit by bit to restore the plaintext.

[0026] The beneficial effects of the present invention are:

[0027] (1) The method of the present invention uses a feedback shift register combined with a CA rule to improve the linearity and nonlinearity of the internal states corresponding to the LFSR and NFSR. The key stream initialization phase uses 32 rounds of iterations. The LFSR and NFSR use a 4th-order CA bit-by-bit feedback update so that the key and iv can be fully confused in the internal state.

[0028] (2) The method of the present invention uses key expansion to fill the remaining bits of the LFSR during the internal state loading stage. Compared with other CA-based stream ciphers that use the Grain cipher algorithm to load the internal state (loading 31 bits of 1 and 1 bit of 0 in the last 32 bits of the LFSR), it ensures that a large number of consecutive 1s will not appear in the internal state, thereby ensuring that the algorithm can resist fault attacks and further improving the random characteristics of the output sequence.

[0029] (3) The output function h(x) is nonlinear and balanced. After 32 iterations, the output function contains 16 and 64 different input variables in the first and second iterations, respectively, and the algebraic degree is 4 and 8, respectively. As the output sequence continues to be output, the algebraic degree and nonlinearity increase accordingly, which can effectively resist algebraic attacks.

[0030] (4) Under the MS attack on CA-type stream ciphers, the required state space size is larger than the 2 required by the attack model. k (k is the size of the internal state), so it is impossible to combine the MS attack and the exhaustive attack to recover the internal state S of the cryptographic algorithm at any time, and the required complexity is greater than 2 128 Therefore, the method of the present invention can effectively deal with MS attacks.

[0031] (5) The algorithm is simple and highly secure. The use of FSR components and CA makes it easy to implement software and hardware. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a structural diagram of the algorithm initialization stage in the method of the present invention;

[0033] Figure 2 It is a structural diagram of the algorithm key stream generation stage in the method of the present invention;

[0034] Figure 3 It is the logical operation diagram of linear CA;

[0035] Figure 4 It is the logical operation diagram of nonlinear CA. DETAILED DESCRIPTION

[0036] The content of the present invention is further described below in conjunction with the drawings and embodiments, but the present invention is not limited thereto.

[0037] Example

[0038] The stream cipher implementation method based on FSR and fourth-order CA includes the following steps:

[0039] Step (1) designing the stream cipher algorithm structure and determining the components of the algorithm;

[0040] (1.1) Two series-connected FSRs are used as the internal state driving part of the algorithm, that is, the cascade structure of LFSR and NFSR is adopted, and the LFSR and NFSR components are designed. The two registers have simple structures and are easy to implement, providing a basic source sequence with good statistical characteristics. Both registers are 128 bits and are used as linear modules and nonlinear modules respectively. The two registers are connected in series, and the LFSR affects the internal state update of the NFSR.

[0041] Both LFSR and NFSR are 128-bit registers. Indicates that Indicates the i-th state bit of the LFSR at time t. The 128-bit NFSR is Indicates that Indicates the i-th state bit of NFSR at time t;

[0042] (1.2) LFSR uses linear rule CA to update the internal state, refer to Figure 3 NFSR uses nonlinear regular CA to update the internal state, referring to Figure 4 , the update rules of LFSR and NFSR are designed based on Rule 43350. The update CA rule of LFSR is expressed as:

[0043] The update CA rule of NFSR is expressed as: Among them l i ,n i represents the i-th bit of LFSR and NFSR, Represents the value of the i-th bit of LFSR and NFSR at time t, where 0≤t, 0≤i≤127;

[0044] The update of NFSR is affected by LFSR. The highest bit of LFSR At each stage of the algorithm, it is XORed to the low bit of NFSR, expressed as in It is the extension bit of NFSR. The extension bit exists to make every bit update in LFSR and NFSR satisfy the CA rule. In LFSR and NFSR, such extension bits have [l -2 ,l -1 ,l 128 ,n -2 ,n -1 ,n128 ];

[0045] The extension bits of LFSR and NFSR have a total of six bits, which are loaded and updated using the corresponding status bits of the register, expressed as:

[0046] l -2 = l 16 ^l 42 ^l 78 ; l -1 = l 24 ^l 56 ^l 89 ; l 128 = l 37 ^l 94 ^l 107 ;

[0047] n -2 =n 26 ^n 91 ^(n 68 &n 84 );n -1 =n 54 ^n 96 ^(n 40 &n 48 );n 128 =n 61 ^n 82 ^(n 11 &n 17 );

[0048] The 4th-order linear and 4th-order nonlinear rule groups based on the 4th-order CA rule Rule 43350 are used as the internal state update rules of LFSR and NFSR. The updated CA rules have been tested and can provide better random sequences than the original design and improve the security of the algorithm.

[0049] (1.3) Design output functions with good statistical properties;

[0050] The key stream generation function h(x) is a fourth-order balanced nonlinear function. The output function uses the 16 state bits in the LFSR and NFSR as input, and outputs a single bit as the key bit output after mixing linear and nonlinear operations. Note: t is the key stream bit output by the algorithm at time t, t≥32, and the output function is:

[0051] z t =h(x)=x0^x1^(x2&x3)^(x4&x5)^(x6&x7&x8)^(x9&x 10 &x 11 )^(x 12 &x13 &x 14 &x 15 ), x0,...,x 15 The corresponding variable is l 127 ,n 127 ,l0,n5,n 79 ,l 81 ,l 11 ,l 30 ,n 21 ,l 47 ,n 43 ,n 64 ,n 73 ,n 102 ,l 85 ,l 112 ,

[0052] Among them l i Indicates the selected LFSR state bit, n i Indicates the selected NFSR status bit.

[0053] Step (2) Design the initialization process of the stream cipher algorithm based on the CA rule, refer to Figure 1 , the specific process is as follows:

[0054] (2.1) Read the 128-bit initial key K = k0, k1, k2, ..., k 126 ,k 127 and 96-bit initial vector IV = iv0, iv1, iv2, ..., iv 94 ,iv 95 ;

[0055] Load the 128-bit initial key and the 96-bit initial vector into the NFSR and LFSR. For the 128-bit LFSR, use the following filling rule: 32≤i≤127,l i =iv i32 , for a 128-bit NFSR, the following filling rule is used: 0≤i≤127,n i =key i ;

[0056] For the remaining 32 bits of the internal state of the LFSR, the initial key is used for expansion filling. The specific rule is 0≤i≤31,l i =key i ^key i+32 ;

[0057] (2.2) During the initialization phase, except for the lowest bit, all other internal status bits of LFSR and NFSR follow the corresponding CA rules:

[0058]

[0059]

[0060] (2.3) In the initialization phase, the output bits of the key stream output function h(x) are XORed to the LFSR and NFSR. The specific steps are as follows:

[0061] (2.3.1) Take the 16 variables from LFSR and NFSR as the input variables of the output function h(x): Generate the key stream using the rules defined in (2.2);

[0062] (2.3.2) In the initialization phase, the output function only receives the input sequence from the LFSR and NFSR without generating any output. The generated key stream participates in the update of the LFSR and NFSR until the end of the initialization phase: 1≤t≤32,l0=f(l0)^h(x),n0=s(n0)^h(x)^l 127 ;

[0063] (2.4) The initial iteration variable t = 0, and the number of initial iteration rounds is set to 32 rounds. After 32 rounds of iteration, the initial key involved in key expansion will be fully mixed into the LFSR;

[0064] The algorithm performs t=32 rounds of iterations, during which the output function participates in two NFSR state update processes, ends the iteration, and completes the initialization.

[0065] Before initialization begins, the 128-bit initial key is loaded into the 128-bit NFSR, the 96-bit initialization vector is loaded into the high 96 bits of the LFSR, and the remaining 32 bits of the LFSR are loaded through key expansion. The register state after expansion is better able to resist differential analysis than the design of Grain-type stream ciphers that load the remaining 32 bits as 1. For stream ciphers with designed CA, the Grain-type stream cipher loading method is used. After the initialization rounds, since the remaining 32 bits are loaded as 1, there will be a large number of consecutive 1s in the registers during the initialization phase, which is prone to fault attacks.

[0066] Step (3) Key stream generation phase: After the initialization phase, after each round of updating LFRS and NFSR, 16 variables are selected from the internal states of LFRS and NFSR as input variables of the output function h(x), and the key stream z = h(x) is generated using the defined function. Figure 2 , the specific process is as follows:

[0067] (3.1) Let the length of plaintext be p;

[0068] (3.2) Update LFSR and NFSR. At this time, the output bit of the output function no longer participates in the update of LFSR and NFSR;

[0069] (3.3) Output function output z t , at this time z t That is the key bit;

[0070] (3.4) t = t + 1, p = p - 1, if p ≠ 0, go to step (3.2);

[0071] If p = 0, the iteration ends and z is t The key stream z is obtained by sorting them in order of generation time.

[0072] Step (4) algorithm encryption and decryption process, the specific process is as follows:

[0073] (4.1) Regarding the encryption implementation of the algorithm, the specific process is as follows;

[0074] (4.1.1) Input plaintext m, the plaintext length is p;

[0075] (4.1.2) XOR the plaintext m with the key stream z bit by bit to obtain the ciphertext c, that is, each bit in the ciphertext is operated as c i is the ith bit of the ciphertext, m i is the i-th bit of the plaintext, z i is the i-th bit of the key stream;

[0076] (4.2) Regarding the decryption implementation of the algorithm, the specific process is as follows;

[0077] (4.2.1) Input ciphertext c;

[0078] (4.2.2) XOR the ciphertext c with the key stream z bit by bit to obtain the plaintext m, that is, the operation of each bit in the ciphertext is

[0079] The method of the present invention is based on CA, LFSR and NFSR, uses LFSR and NFSR as generators of random sequences, uses CA (linear CA and nonlinear CA) with different rules for two registers to update the registers, expands the key to LFSR in the initialization phase, and can better complete the mixed diffusion of key and IV in the initialization phase compared with other CA cryptographic algorithms. The output function accepts values ​​from the two registers to generate a key stream of a certain length, effectively resists fault attacks and cubic attacks, and improves the security of the algorithm.

Claims

1. A stream cipher implementation method based on FSR and fourth-order CA, characterized in that: The steps include: (1) Design the structure of the stream cipher algorithm and determine the components of the algorithm; First, two FSRs connected in series are used as the internal state driving part of the algorithm; Secondly, we design two FSR update rules, including linear CA and nonlinear CA; Finally, design an output function with good statistical properties; (2) Design the initialization process of the stream cipher algorithm based on the CA rule; After the components of the stream cipher algorithm are determined, they need to go through an initialization process. During the initialization phase, the output bits of the output function are always involved in the state update of the two FSRs. The algorithm initialization process is divided into four steps: In the first step, the initial key and vector are loaded into two FSRs, and the rest of the LFSR is filled with the initial key extension; The second step is to make each bit of LFSR and NFSR satisfy the corresponding CA rule and set the extension bit of LFSR and NFSR; In the third step, the key bits generated in the initialization phase are XORed into the LFSR and NFSR; In the fourth step, the algorithm performs 32 initial iterations; (3) Key stream generation stage; After the algorithm initialization process, the algorithm enters the key stream generation stage. At this time, the output of the output function is the key bit, and the output bit no longer participates in the update of the LFSR and NFSR states. Each round of iteration generates a 1-bit key, and the output bits of multiple iterations constitute the key stream. Based on the algorithm security, the maximum length of the key stream generated by a single key initial value is limited to 2 64 ; (4) Algorithm encryption and decryption process; When the algorithm is used for encryption and decryption, the sender generates a key stream of the same length as the plaintext according to the algorithm, uses the key stream to XOR the bit by bit with the plaintext to obtain the ciphertext, and sends the ciphertext to the receiver through the communication channel; after receiving the ciphertext, the receiver generates a key stream of the same length as the ciphertext according to the algorithm based on the negotiated key and initial value, and uses the key stream to XOR the bit by bit with the ciphertext to obtain the plaintext.

2. The method for implementing a stream cipher based on FSR and fourth-order CA according to claim 1, characterized in that: Step (1) designs the overall structure of the stream cipher algorithm and determines the components of the algorithm. The specific process is as follows: (1.1) Using LFSR and NFSR cascade as the internal state driving part of the algorithm; Both LFSR and NFSR are 128-bit registers. Indicates that Indicates the i-th state bit of the LFSR at time t. The 128-bit NFSR is Indicates that Indicates the i-th state bit of NFSR at time t; (1.2) LFSR uses linear CA to update the internal state, and NFSR uses nonlinear CA to update the internal state. The update rules of LFSR and NFSR are designed based on Rule 43350. The update CA rule of LFSR is expressed as: The update CA rule of NFSR is expressed as: Among them l i ,n i represents the i-th bit of LFSR and NFSR, Represents the value of the i-th bit of LFSR and NFSR at time t, where 0≤t, 0≤i≤127; For LFSR and NFSR updated using CA rules, it is necessary to ensure that each bit update satisfies the corresponding CA rules. 127 ,n0,n 127 ) corresponding to the extension bit: l -2 ＝l 16 ^l 42 ^l 78 ；l -1 ＝l 24 ^l 56 ^l 89 ；l 128 ＝l 37 ^l 94 ^l 107 ； n -2 =n 26 ^n 91 ^(n 68 &n 84 );n -1 =n 54 ^n 96 ^(n 40 &n 48 );n 128 =n 61 ^n 82 ^(n 11 &n 17 ); (1.3) Design output functions with good statistical properties; The key stream generation function h(x) is a fourth-order balanced nonlinear function. The output function uses the 16 state bits in the LFSR and NFSR as input, and outputs a single bit as the key bit output after mixing linear and nonlinear operations. Note: t is the key stream bit output by the algorithm at time t, t≥32, and the output function is: z t =h(x)=x0^x1^(x2&x3)^(x4&x5)^(x6&x7&x8)^(x9&x 10 &x 11 )^(x 12 &x 13 &x 14 &x 15 ), x0,...,x 15 The corresponding variable is l 127 ,n 127 ,l0,n5,n 79 ,l 81 ,l 11 ,l 30 ,n 21 ,l 47 ,n 43 ,n 64 ,n 73 ,n 102 ,l 85 ,l 112 , where l i Indicates the selected LFSR state bit, n i Indicates the selected NFSR status bit.

3. The method for implementing a stream cipher based on FSR and fourth-order CA according to claim 1, characterized in that: The specific process of designing the algorithm initialization process based on FSR and CA rules in step (2) is as follows: (2.1) Load the 128-bit initial key and the 96-bit initial vector into the NFSR and LFSR. For the remaining 32-bit internal state of the LFSR, use the initial key for extended filling. The LFSR and NFSR use the following filling rules: LFSR:0≤i≤31,l i =key i ^key i+32 ;32≤i≤127,l i =iv i-32 4 NFSR:0≤i≤127,n i =key i ; (2.2) During the initialization phase, except for the lowest bit, all other internal status bits of LFSR and NFSR follow the corresponding CA rules: LFSR: NFSR: (2.3) In the initialization phase, the output of the key stream output function h(x) is XORed to l0, n0, and participates in the internal state update of LFSR and NFSR: 1≤t≤32, l0=f(l0)^h(x), n0=s(n0)^h(x)^l 127 ; (2.4) The algorithm performs t = 32 iterations, during which the output function participates in two NFSR state update processes.

4. The method for implementing a stream cipher based on FSR and fourth-order CA according to claim 1, characterized in that: In the key stream generation process described in step (3), after the initialization phase is completed, after each round of updating of LFRS and NFSR, 16 variables are selected from the internal states of LFRS and NFSR as input variables of the output function h(x), and the key stream z=h(x) is generated using the defined function. The specific process is as follows: (3.1) Let the length of plaintext be p; (3.2) Update LFSR and NFSR. At this time, the output bit of the output function no longer participates in the update of LFSR and NFSR; (3.3) Output function output z t , at this time z t That is the key bit; (3.4) t = t + 1, p = p - 1, if p ≠ 0, go to step (3.2); If p = 0, the iteration ends and z is t The key stream z is obtained by sorting them in order of generation time.

5. The method for implementing a stream cipher based on FSR and fourth-order CA according to claim 1, characterized in that: The specific process of the algorithm encryption and decryption process in step (4) is as follows: (4.1) Regarding the encryption implementation of the algorithm, the specific process is as follows; (4.1.1) Input plaintext m, the plaintext length is p; (4.1.2) XOR the plaintext m with the key stream z bit by bit to obtain the ciphertext c, that is, each bit in the ciphertext is operated as c i is the ith bit of the ciphertext, m i is the i-th bit of the plaintext, z i is the i-th bit of the key stream; (4.2) Regarding the decryption implementation of the algorithm, the specific process is as follows; (4.2.1) Input ciphertext c; (4.2.2) XOR the ciphertext c with the key stream z bit by bit to obtain the plaintext m, that is, the operation of each bit in the ciphertext is

Images