Data processing method and device, processor, chip and electronic equipment

Abstract

The embodiment of the invention provides a data processing method and device, a processor, a chip and electronic equipment, and the method comprises the steps: obtaining the input data of a cryptographic algorithm, the cryptographic algorithm being any one of a plurality of cryptographic algorithms; determining intermediate data of a cryptographic algorithm according to the input data as transformation input data of data confusion transformation; mapping the transformation input data from an original finite field of data confusion transformation to a target composite field, the target composite field being a composite field which takes a binary finite field as a sub-field and is subjected to multi-level nested expansion; wherein the original finite field of the data confusion transformation is any one of a plurality of original finite fields; in the target composite domain, calculating the transformation input data mapped to the target composite domain to obtain transformation output data; and determining output data of a cryptographic algorithm according to the transformation output data. According to the embodiment of the invention, resource overhead involved in data processing by a cryptographic algorithm can be reduced.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data processing technology, and specifically to a data processing method, device, processor, chip and electronic device. Background Art

[0002] Data can be encrypted and decrypted using cryptographic algorithms to ensure data security. In the process of processing data using cryptographic algorithms, data obfuscation transformation can be performed on intermediate data to increase the unpredictability of the intermediate data and improve the security of the cryptographic algorithm. In other words, in the cryptographic operation performed by the cryptographic algorithm, the intermediate data of the cryptographic operation can be obfuscated to increase the obfuscation of the data through data obfuscation transformation, thereby increasing the difficulty for attackers to understand and predict the data, thereby enhancing the anti-attack ability of the cryptographic algorithm. In this context, how to provide an improved data processing solution to reduce resource overhead in the process of processing data using cryptographic algorithms has become a technical problem that technicians in this field urgently need to solve. Summary of the invention

[0003] In view of this, embodiments of the present application provide a data processing method, device, processor, chip and electronic device to reduce resource overhead in the process of processing data using a cryptographic algorithm.

[0004] To achieve the above objectives, the embodiments of the present application provide the following technical solutions.

[0005] In a first aspect, an embodiment of the present application provides a data processing method, including:

[0006] Obtaining input data of a cryptographic algorithm, wherein the cryptographic algorithm is any one of a plurality of cryptographic algorithms;

[0007] Determine the intermediate data of the cryptographic algorithm according to the input data as the transformed input data of the data obfuscation transformation;

[0008] Mapping the transformed input data from the original finite field of the data obfuscation transformation to a target composite field, where the target composite field is a composite field with a binary finite field as a subfield and multi-level nested expansion; wherein the original finite field of the data obfuscation transformation is any original finite field among multiple original finite fields;

[0009] In the target composite domain, operating the transformed input data mapped to the target composite domain to obtain transformed output data;

[0010] Based on the transformed output data, output data of the cryptographic algorithm is determined.

[0011] In a second aspect, an embodiment of the present application provides a data processing device, including:

[0012] An input data acquisition module, used to acquire input data of a cryptographic algorithm, wherein the cryptographic algorithm is any one of a plurality of cryptographic algorithms;

[0013] A transformation input data determination module, used to determine the intermediate data of the cryptographic algorithm according to the input data as the transformation input data of the data obfuscation transformation;

[0014] A mapping module, used for mapping the transformed input data from the original finite field of the data obfuscation transformation to a target composite field, wherein the target composite field is a composite field with a binary finite field as a subfield and multi-level nested expansion; wherein the original finite field of the data obfuscation transformation is any original finite field among a plurality of original finite fields;

[0015] A calculation module, used for calculating, in the target composite domain, the transformed input data mapped to the target composite domain to obtain transformed output data;

[0016] The output data determination module is used to determine the output data of the cryptographic algorithm according to the transformed output data.

[0017] In a third aspect, an embodiment of the present application provides a processor, comprising the data processing device as described in the second aspect above.

[0018] In a fourth aspect, an embodiment of the present application provides a chip, comprising the data processing device as described in the second aspect above, or the processor as described in the third aspect above.

[0019] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising the chip described in the fourth aspect above.

[0020] In the process of processing data using a cryptographic algorithm, the embodiments of the present application can increase the security of the cryptographic algorithm through data obfuscation transformation, thereby improving the security protection of the data. Specifically, the intermediate data of the cryptographic algorithm can be determined according to the input data of the cryptographic algorithm as the transformed input data of the data obfuscation transformation; the transformed input data is mapped from the original finite field of the data obfuscation transformation to the target composite domain, and the target composite domain is a composite domain with a binary finite field as a subdomain and multi-level nested expansion; thereby, in the target composite domain, the transformed input data mapped to the target composite domain is subjected to data obfuscation transformation to obtain the transformed output data of the data obfuscation transformation; further, according to the transformed output data, the output data of the cryptographic algorithm is determined, the processing of the input data by the cryptographic algorithm is completed, and the output data of the cryptographic algorithm is obtained.

[0021] The scheme provided by the embodiment of the present application can be applied to any of a variety of cryptographic algorithms, and in the case of using data obfuscation transformation to increase the security of the cryptographic algorithm, the original finite field of the data obfuscation transformation can be any of a plurality of original finite fields, so that the embodiment of the present application supports mapping the transformed input data from any of a plurality of original finite fields to a target composite field, so that the data obfuscation transformation of any cryptographic algorithm in any original finite field can reuse the operation of the target composite field, so as to improve the reusability of the data obfuscation transformation and reduce the resource overhead of the data obfuscation transformation. At the same time, the target composite field is a composite field with a binary finite field as a subfield and multi-level nested expansion, and the binary finite field is a finite field containing two elements, so the operation of the binary finite field as a subfield in the target composite field is relatively simplified (for example, operations involving two elements), so that the data obfuscation transformation of any cryptographic algorithm in any original finite field (for example, the S-box operation or affine transformation of any cryptographic algorithm) is uniformly mapped to the target composite field for operation, which can not only realize operation reuse, but also simplify the operation, thereby reducing the delay and area overhead of the critical path and reducing the resource overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0023] Figure 1 An example diagram of S-box reuse for multiple cryptographic algorithms.

[0024] Figure 2 A flowchart of a data processing method provided in an embodiment of the present application.

[0025] Figure 3A This is an example diagram of processing without basis transformation.

[0026] Figure 3B This is an example diagram of the basis transformation process.

[0027] Figure 4 A flowchart for setting a mapping relationship provided in an embodiment of the present application.

[0028] Figure 5A Another flowchart for setting a mapping relationship provided in an embodiment of the present application.

[0029] Figure 5B is GF(2 8 ) to GF(((2 2 ) 2 )2 ) is an example diagram of determining the mapping matrix.

[0030] Fig. 6A Another flowchart for setting a mapping relationship provided in an embodiment of the present application.

[0031] Figure 6B is GF((2 4 ) 2 ) to GF(((2 2 ) 2 ) 2 ) is an example diagram for determining the mapping matrix.

[0032] Figure 7 This is an example diagram of a data processing device provided in an embodiment of the present application.

[0033] Figure 8 This is an example diagram of a circuit implementation of a data processing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0035] Cryptographic algorithms are mainly divided into symmetric cryptographic algorithms and asymmetric cryptographic algorithms. Among them, symmetric cryptographic algorithms use the same key to encrypt and decrypt data, such as AES (Advanced Encryption Standard) algorithm, SM4 algorithm, Camellia (Camellia) algorithm, etc.; further, the symmetric block cipher algorithm in the symmetric cryptographic algorithm can group the input data (such as plain text) of the cryptographic algorithm, so as to independently encrypt each group, and the symmetric block cipher algorithm can be applied to the above-mentioned examples of AES algorithm, SM4 algorithm, Camellia algorithm, etc. Asymmetric cryptographic algorithms use a pair of keys, wherein one key in the pair of keys is used for encryption and the other key is used for decryption, such as RSA (Rivest-Shamir-Adleman) algorithm, ECC (Elliptic Curve Cryptography) algorithm, etc.

[0036] During the cryptographic operation process performed by a cryptographic algorithm (especially a symmetric block cipher algorithm), data obfuscation transformation can transform the intermediate data, thereby increasing the unpredictability of the intermediate data and improving the security of the cryptographic algorithm. Data obfuscation transformation can be implemented through nonlinear substitution or linear obfuscation. For example, nonlinear substitution can be implemented through S-box (Substitution box), and linear obfuscation can be implemented through affine transformation.

[0037] The S-box can act on the intermediate steps of the cryptographic operation to perform nonlinear transformation on the intermediate data of the cryptographic operation. For example, the S-box can realize the nonlinear replacement of the S-box input data to the S-box output data, so that in the intermediate steps of the cryptographic operation, the intermediate data of the cryptographic operation is used as the S-box input data of the S-box, and the nonlinear transformation of the intermediate data can be realized. The S-box can improve the nonlinear characteristics of the data during the cryptographic operation, increase the unpredictability of the cryptographic algorithm, and reduce the success rate of various cryptographic attacks, for example, resist linear attacks, increase the difficulty of differential attacks, etc., thereby enhancing the security of the cryptographic algorithm.

[0038] Affine transformation can be applied to the intermediate steps of cryptographic operations to perform linear transformation and vector addition operations on the intermediate data of cryptographic operations, thereby increasing the obfuscation and diffusion of the data, thereby increasing the unpredictability of the cryptographic algorithm and reducing the success rate of various cryptographic attacks. For example, affine transformation can be composed of linear transformation and vector addition operations, such as matrix multiplication of affine transformation input data with the affine transformation matrix, and then vector addition operations with the affine transformation vector.

[0039] Further, the affine transformation can be implemented by the cryptographic algorithm acceleration instructions integrated in the instruction set of the processor, and the cryptographic algorithm acceleration instructions can be used to accelerate the cryptographic algorithm executed by the processor, especially the operation involving the Galois Field (GF), and use the affine transformation to perform linear obfuscation of the data during the acceleration process. For example, the cryptographic algorithm acceleration instructions with affine transformation are such as GFNI (Galois Field New Instructions) instructions. Further, the cryptographic algorithm acceleration instructions such as GFNI instructions can accelerate the S-box calculation of the cryptographic algorithm. Further, the cryptographic algorithm acceleration instructions such as GFNI instructions can provide finite field operations that support accelerated cryptographic algorithms, such as finite field operations such as multiplication inversion and polynomial multiplication.

[0040] When implemented using hardware circuits, different types of cryptographic algorithms require different data obfuscation transformations. This results in the need to implement different data obfuscation transformation circuits separately when a cryptographic operation system supports multiple types of cryptographic algorithms, increasing the area overhead of the hardware circuits.

[0041] Taking S-box operation as an example, when implemented using hardware circuits, different types of cryptographic algorithms require the use of different S-boxes, which results in the need to use multiple different S-boxes when a cryptographic operation system supports multiple types of cryptographic algorithms, increasing the area overhead of the hardware circuit.

[0042] For example, in the case of hardware circuit implementation, the S-box can be divided into two types: one is implemented by a look-up table (LUT) and the other is implemented by a function operation circuit unit (eg, a multiplication inversion circuit unit).

[0043] Taking the implementation of S-boxes through lookup tables as an example, the lookup table can be used as a mapping table between S-box input data and S-box output data, so that each S-box input data input to the S-box can be mapped to the corresponding S-box output data through the mapping table of the S-box, so that the nonlinear replacement of the S-box can be implemented by lookup tables without complicated calculation processes, thereby improving the execution speed of the cryptographic algorithm. In this case, if a cryptographic operation system supports multiple types of cryptographic algorithms, since different types of cryptographic algorithms require the use of different S-boxes, and different S-boxes require the definition of different lookup tables, this will cause the cryptographic operation system to need to use multiple lookup tables (such as the lookup tables of the S-boxes of multiple types of cryptographic algorithms), which increases the area overhead of the hardware circuit.

[0044] For example, the AES algorithm, SM4 algorithm, and Camellia algorithm are used as examples. The S-box of the AES algorithm is based on the finite field GF(2 8 ) and an additional affine transformation, the S-box lookup table of the AES algorithm is implemented as 256×8 bits, that is, 256 entries and each entry is 8 bits, each entry corresponds to the S-box output data of the S-box;

[0045] The S-box of the SM4 algorithm can be defined by a nonlinear transformation function, which involves the replacement of S-box input data and S-box output data, and XOR operations with fixed parameters, etc.; the lookup table of the S-box of the SM4 algorithm can be implemented as a 256×8-bit lookup table, but the S-box design based on the SM4 algorithm is different from that of the AES algorithm (for example, the lookup table of the S-box of the SM4 algorithm reflects the replacement of S-box input data and S-box output data performed by the nonlinear function of the SM4 algorithm), so the S-box lookup table of the SM4 algorithm is different from the S-box lookup table of the AES algorithm.

[0046] The Camellia algorithm uses multiple S-boxes (for example, two S-boxes, one S-box implements the replacement of 8-bit input bytes to 8-bit output bytes), and the lookup table of each S-box of the Camellia algorithm is implemented as a 256×8-bit lookup table.

[0047] The S-box designs of the AES algorithm, SM4 algorithm, and Camellia algorithm are different, so the lookup tables of the S-boxes of the AES algorithm, SM4 algorithm, and Camellia algorithm are also different. If a cryptographic operation system supports the AES algorithm, SM4 algorithm, and Camellia algorithm, it is necessary to define the lookup tables of the S-boxes of the AES algorithm, SM4 algorithm, and Camellia algorithm at the same time. This involves defining multiple lookup tables in a cryptographic operation system, which undoubtedly increases the area overhead of the hardware circuit.

[0048] Taking the implementation of an S-box through a function operation circuit unit (e.g., a multiplication inversion circuit unit) as an example, this involves using a function operation circuit unit on a finite field to generate the output of the S-box, such as the S-box being designed as a logic circuit capable of implementing a function operation (e.g., a multiplication inversion operation). In this case, if a cryptographic operation system supports multiple types of cryptographic algorithms, since different types of cryptographic algorithms require the use of different S-boxes, and different S-boxes may correspond to different function operation circuit units, this results in the cryptographic operation system needing to use multiple function operation circuit units of different S-boxes, increasing the area overhead of the hardware circuit.

[0049] Based on this, it is particularly necessary to provide a unified data obfuscation transformation scheme for various types of cryptographic algorithms in order to reduce resource overhead (especially area overhead) in the process of processing data using cryptographic algorithms.

[0050] Taking S-box operation as an example, in various types of cryptographic algorithms, resource overhead can be reduced by reusing S-boxes. Taking AES algorithm, SM4 algorithm, and Camellia algorithm as examples, Figure 1 The following diagrams illustrate the reuse of S-boxes for various cryptographic algorithms. Figure 1 As shown, the original finite field of the S-box elements of the AES algorithm is GF(2 8 ), the irreducible polynomial is x 8 +x 4 +x 3 +x+1; that is, the S-box of the AES algorithm uses a finite field GF(2 8 ) operation, the finite field consists of 256 elements; wherein the irreducible polynomial is an irreducible polynomial in a given number field (such as a finite field), that is, it cannot be decomposed into the product of two or more non-constant polynomials, and x is an unknown number of the irreducible polynomial (such as a variable of the irreducible polynomial).

[0051] It should be noted that, for any cryptographic algorithm, an S-box element is any S-box input data of the S-box. For example, each S-box input data can obtain the corresponding S-box output data through the S-box (such as the lookup table defined by the S-box), and each S-box input data can be regarded as an S-box element. For example, the original finite field of the S-box element is GF(2 8 ), then there exists 2 8 (i.e. 256) S-box elements correspond to 256 S-box input data.

[0052] Continue to refer to Figure 1 , the original finite field of the S-box elements of the SM4 algorithm is GF(2 8 ), the irreducible polynomial is x 8 +x 7 +x 6 +x 5 +x 4 +x 2 +1; the original finite field of the S-box elements of the Camellia algorithm is GF((2 4 ) 2 ), and divided into two groups GF(2 4 ) finite field, two groups of GF(2 4 ) are irreducible polynomials in the finite field x 4 +x+1,x 2 +x+9.

[0053] Furthermore, Figure 1 Provides a unified domain GF((2 4 ) 2 ), unified domain GF((2 4 ) 2 ) can be regarded as a composite field; thus, the S-box elements of the AES algorithm, SM4 algorithm, and Camellia algorithm can be mapped from their respective original finite fields to the unified field GF((2 4 ) 2 ), so as to perform operations under the unified domain, and then transform back to the original finite field through inverse mapping, and then obtain the S-box output data of the S-box of the AES algorithm, SM4 algorithm and Camellia algorithm respectively.

[0054] Although the above method realizes the S-box operation of AES algorithm, SM4 algorithm and Camellia algorithm, it can reuse the same domain GF((2 4 ) 2 ) is used to perform operations, realizing the unification of the S-boxes of the AES algorithm, SM4 algorithm, and Camellia algorithm. However, the resource overhead still needs to be reduced, as shown in the following:

[0055] The delay and area overhead need to be reduced, and the unified domain GF((24 ) 2 ) is more complicated, which will lead to longer critical path delays and larger area overhead; for example, GF((2 4 ) 2 ) is based on a smaller finite field GF(2 4 ), the multiplication inversion operation in this composite domain still requires relatively complex operation steps, which leads to a longer delay in the critical path of the operation (for example, the continuous path with the longest delay in the operation), that is, due to the increased complexity of the operation, the time required for each operation of the operation becomes longer, thereby increasing the delay of the critical path; at the same time, the increased complexity of the operation requires the use of more electronic devices such as logic gates and storage elements to achieve it, which increases the area overhead of the chip.

[0056] Furthermore, the above method cannot be applied to cryptographic algorithm acceleration instructions (such as GFNI instructions) with affine transformation (such as inverse affine transformation). When cryptographic algorithm acceleration instructions such as GFNI instructions perform affine transformation, the affine transformation matrix and the affine transformation vector both come from the instruction and are in variable form; that is, cryptographic algorithm acceleration instructions such as GFNI instructions need to dynamically adjust the affine transformation matrix and the affine transformation vector. If the above method is to support cryptographic algorithm acceleration instructions such as GFNI instructions that can dynamically adjust the affine transformation matrix and the affine transformation vector, additional hardware overhead needs to be added, resulting in an increase in chip area and cost. Therefore, the above method cannot be applied to cryptographic algorithm acceleration instructions such as GFNI instructions, and there are limitations in applicability, and additional hardware overhead needs to be added to expand the applicable scenarios.

[0057] Based on this, in order to reduce resource overhead, the embodiment of the present application further provides a target composite domain with a binary finite field as a subdomain and multi-level nested expansion, as a unified domain for affine transformation of S-boxes and cryptographic algorithm acceleration instructions of various cryptographic algorithms, so that the affine transformation of S-boxes and cryptographic algorithm acceleration instructions of various cryptographic algorithms can reuse the operations under the target composite domain to improve the reusability of operations. Since the target composite domain is a composite domain with a binary finite field as a subdomain and multi-level nested expansion, and the binary finite field is a finite field containing two elements, the operations of the binary finite field as a subdomain in the target composite domain are relatively simplified (for example, operations involving two elements), so that the operations under the target composite domain can be simplified, thereby reducing the delay and area overhead of the critical path, and achieving a reduction in resource overhead.

[0058] As an optional implementation, Figure 2 The optional flow chart of the data processing method provided by the embodiment of the present application is exemplarily shown. Optionally, the method flow can be executed by a processor, for example, by a device such as a processor having the ability to execute a cryptographic algorithm. Of course, the embodiment of the present application can also support the execution of the method by other forms of integrated circuits. Figure 2 As shown, the data processing method may include the following steps.

[0059] In step S210, input data of the cryptographic algorithm is obtained.

[0060] As an optional implementation, the data processing method provided in the embodiment of the present application can be applicable to any one of a variety of cryptographic algorithms, such as the AES algorithm, the SM4 algorithm, the Camellia algorithm, and other cryptographic algorithms.

[0061] For example, if a data encryption process is performed using a cryptographic algorithm, the input data of the cryptographic algorithm may be plaintext data; if a data decryption process is performed using a cryptographic algorithm, the input data of the cryptographic algorithm may be ciphertext data.

[0062] In step S211, the intermediate data of the cryptographic algorithm is determined according to the input data as the transformed input data of the data obfuscation transformation.

[0063] For ease of explanation, the embodiment of the present application refers to the input data of the data obfuscation transformation (i.e., the data to be subjected to the data obfuscation transformation) as the transformed input data of the data obfuscation transformation. As an optional implementation, based on the data obfuscation transformation may include the nonlinear transformation of the S-box or the linear obfuscation of the affine transformation, the transformed input data of the data obfuscation transformation may include the S-box input data of the S-box, or the affine transformed input data of the affine transformation. For ease of explanation, the embodiment of the present application refers to the input data of the S-box as the S-box input data, and the input data of the affine transformation as the affine transformed input data.

[0064] When a cryptographic algorithm processes input data, it goes through multiple steps, where the output obtained in the early steps can be used as the input of the subsequent steps, so that for data obfuscation transformation, the output of the previous step before the data obfuscation transformation can be used as the transformation input data of the data obfuscation transformation. The output of the previous step before the data obfuscation transformation can be regarded as the intermediate data obtained by the cryptographic algorithm by processing the input data of the cryptographic algorithm, and the intermediate data is used as the input of the subsequent data obfuscation transformation (such as the nonlinear transformation of the S-box or the linear obfuscation of the affine transformation) to increase the security of the cryptographic algorithm.

[0065] Taking the S-box operation of a cryptographic algorithm as an example, the S-box input data of the S-box may be the output of the previous step of the S-box operation of the cryptographic algorithm. For example, the cryptographic algorithm may complete the cryptographic operation through multiple rounds of round calculations (such as multiple rounds of encryption or multiple rounds of decryption), so that the S-box input data of each round of S-box operation may be the output of the previous step, that is, the output of the previous step may be regarded as the intermediate data of the cryptographic algorithm as the S-box input data, and is determined according to the input data of the cryptographic algorithm.

[0066] For example, for the AES algorithm, the SubBytes (byte replacement) step in each round of calculation of the AES algorithm (such as each round of encryption or each round of decryption) can perform S-box operation, so that the output of the previous step of the SubBytes step in each round of calculation can be used as S-box input data; that is, the AES algorithm completes the cryptographic operation through multiple rounds of round calculations (such as multiple rounds of encryption or multiple rounds of decryption), and there is a SubBytes step for performing S-box operation in each round of round calculation, so that the output of the previous step of the SubBytes step in each round can be used as S-box input data, and the output of the previous step of the SubBytes step can be regarded as intermediate data of the cryptographic algorithm as S-box input data, which is determined according to the input data of the cryptographic algorithm.

[0067] Specifically, in the encryption operation performed by the AES algorithm, each round of operation may include a SubBytes step, a ShiftRows (row shift), a MixColumns (column confusion) step, and an AddRoundKey (round key addition) step, wherein the SubBytes step performs an S-box operation, the ShiftRows step permutes the rows in the data, the MixColumns step performs algebraic operations on the columns, and the AddRoundKey step combines the data of each round with the round key (e.g., an XOR operation). Thus, the previous step of each round of the SubBytes step may be, for example, the initial AddRoundKey (round key addition) step or the previous round of the AddRoundKey step. For example, the first round of the SubBytes step may receive the output of the initial AddRoundKey step as input, and starting from the second round, the input of the SubBytes step is the output of the previous round of the AddRoundKey step. Among them, the initial AddRoundKey step occurs before the start of the first round, which is used to combine the plaintext data with the initial round key, so that the first round of SubBytes step accepts the output of the initial AddRoundKey step as input; starting from the second round, the AddRoundKey step of the previous round is the previous step of the SubBytes step of the current round, so starting from the second round, the input of each round of SubBytes step comes from the output of the previous round of AddRoundKey step.

[0068] For example, for the SM4 algorithm, the SM4 algorithm can complete the cryptographic operation through multiple rounds of round calculations (for example, multiple rounds of encryption or multiple rounds of decryption), and each round of round calculations may include AddRoundKey (round key addition) steps, S-box operation (non-linear transformation) steps, linear transformation and other steps, so that the input of each round of the S-box operation step can come from the output of the AddRoundKey step of the current round. For example, the AddRoundKey step of each round performs an XOR operation on the output of the previous round of round calculations and the sub-key of the current round to obtain the output of the AddRoundKey step of each round as the input of the S-box operation step of each round (that is, S-box input data); wherein, the output of each round of the AddRoundKey step can be regarded as the intermediate data of the cryptographic algorithm as the S-box input data, which is determined according to the input data of the cryptographic algorithm.

[0069] For example, for the Camellia algorithm, the Camellia algorithm can complete the cryptographic operation through multiple rounds of round calculations, and the input of the S-box operation step of each round can come from the AddRoundKey step of the current round; that is, the output of the AddRoundKey step of each round can be regarded as the intermediate data of the cryptographic algorithm as the S-box input data, which is determined according to the input data of the cryptographic algorithm.

[0070] Taking the affine transformation possessed by cryptographic algorithm acceleration instructions such as GFNI instructions as an example, the affine transformation input data of the affine transformation can be the output of the previous step of the affine transformation, that is, the output of the previous step can be regarded as the intermediate data of the cryptographic algorithm as the affine transformation input data, and is determined based on the input data of the processing cryptographic algorithm.

[0071] In an optional implementation, when a cryptographic algorithm acceleration instruction such as a GFNI instruction is used to perform an affine transformation, the affine transformation input data of the affine transformation may be derived from any of the following intermediate data of the cryptographic algorithm:

[0072] The output after nonlinear transformation, that is, the output after nonlinear transformation of the cryptographic algorithm, can be used as affine transformation input data; for example, the output of the nonlinear transformation of the S-box of the AES algorithm and the SM4 algorithm can be used as the input of the affine transformation implemented by the cryptographic algorithm acceleration instruction such as the GFNI instruction, thereby serving as the affine transformation input data;

[0073] The output after key mixing, for example, in each round calculation of the cryptographic algorithm, after the data is XORed with the round key (corresponding to the AddRoundKey step), can be used as the input of the affine transformation implemented by the cryptographic algorithm acceleration instructions such as the GFNI instruction; for example, the output of the AddRoundKey step of each round calculation of the cryptographic algorithm can be used as the affine transformation input data.

[0074] In a possible implementation example, the affine transformation can be applied before or after the S-box operation of the cryptographic algorithm.

[0075] In step S212, the transformed input data is mapped from the original finite field of the data obfuscation transformation to a target composite field, where the target composite field is a composite field with a binary finite field as a subfield and multi-level nested expansion.

[0076] A finite field (also called a Galois field) is a mathematical structure containing a finite number of elements. The original finite field of the data obfuscation transformation may be the finite field where the transformed input data of the data obfuscation transformation originally lies; the original finite field of the data obfuscation transformation may be any original finite field among multiple original finite fields, and the original finite field of the data obfuscation transformation may be determined according to the type of cryptographic algorithm or affine transformation applied to the data obfuscation transformation; for example, multiple cryptographic algorithms and affine transformations may correspond to multiple original finite fields, and thus based on the type of cryptographic algorithm or affine transformation applied to the data obfuscation transformation, one of the multiple original finite fields may be determined as the original finite field of the data obfuscation transformation.

[0077] In an optional implementation, taking the data obfuscation transformation as an S-box operation of an encryption algorithm as an example, the original finite field of the data obfuscation transformation can be the original finite field of the S-box, and the form of the original finite field is determined according to the type of encryption algorithm. For example, the original finite field of the S-box of the AES algorithm and the SM4 algorithm can be the same, both using GF(2 8 ), where the S-box of the AES algorithm is in the original finite field GF(2 8 ) is represented by the irreducible polynomial x 8 +x 4 +x 3 +x+1, the S-box of the SM4 algorithm is in the original finite field GF(2 8 ) is represented by the irreducible polynomial x 8 +x 7 +x 6 +x 5 +x 4 +x 2 +1; For example, the original finite field of the S-box of the Camellia algorithm uses GF((2 4 ) 2 ), and divided into two groups GF(2 4 ), that is, the finite field GF((2 4 ) 2 ) is a composite field consisting of two groups of GF(2 4 ) finite field, the S-box of Camellia algorithm is constructed in the original finite field GF((2 4 )2 ) is represented by the irreducible polynomial x 4 +x+1, x 2 +x+9.

[0078] In an optional implementation, taking the data obfuscation transformation as an affine transformation of a cryptographic algorithm acceleration instruction such as a GFNI instruction as an example, the original finite field of the data obfuscation transformation can be the original finite field of the affine transformation. For example, the original finite field of the affine transformation can be consistent with the original finite field used by the S-box of the AES algorithm and the SM4 algorithm, both of which are GF(2 8 ); Furthermore, the irreducible polynomial of the affine transformation is consistent with the irreducible polynomial corresponding to the AES algorithm, both of which are x 8 +x 4 +x 3 +x+1.

[0079] The target composite domain is a composite domain reused by the S-boxes of various cryptographic algorithms provided in the embodiments of the present application, as well as the affine transformations of cryptographic algorithm acceleration instructions such as the GFNI instruction. In other words, the S-box operations of various cryptographic algorithms, as well as the affine transformations of cryptographic algorithm acceleration instructions such as the GFNI instruction, can all be converted to the target composite domain for operation. It should be noted that the composite domain can be understood as a multi-dimensional finite field expanded on the basis of a sub-domain, that is, the composite domain is expanded from a sub-domain, and the sub-domain is the basic domain used to constitute the multi-dimensional finite field. For example, in the composite domain GF((2 4 ) 2 ), the subfield is GF(2 4 ), the subfield GF(2 4 ) can be expanded to obtain the composite field GF((2 4 ) 2 ); For example, construct a subfield GF(2 4 ) is a quadratic polynomial with coefficients, and irreducible polynomials are used to define polynomial multiplication operations, thereby expanding to obtain the composite field GF((2 4 ) 2 ).

[0080] In an embodiment of the present application, the target composite domain is a composite domain with a binary finite field as a subdomain and multi-level nested expansion; wherein the binary finite field is a finite field of two elements (for example, 0 and 1), and the operations in the binary finite field follow modulo 2 arithmetic, such as the binary finite field is GF(2). Optionally, the embodiment of the present application can use a binary finite field as a subdomain to obtain the target composite domain by multi-level nested expansion. That is to say, in the process of multi-level nested expansion, the next-level expansion is based on the finite field obtained by the previous-level expansion (that is, each expansion depends on the result obtained by the previous-level domain expansion), thereby forming a hierarchical nested relationship.

[0081] As an optional implementation, the number of elements represented by the target composite domain may be a set number of elements, and the set number of elements corresponds to the number of elements of the S-box of various cryptographic algorithms and the number of elements of the affine transformation of cryptographic algorithm acceleration instructions such as the GFNI instruction. For example, the set number of elements corresponds to the number of elements of the original finite field, and the number of elements of multiple original finite fields is the set number of elements. For example, the set number of elements may be 256, which corresponds to GF(2 8 )、GF((2 4 ) 2 Thus, the embodiment of the present application can use a binary finite field as a subfield and obtain a target composite field corresponding to the set number of elements through multi-level nesting expansion.

[0082] For example, taking the binary finite field GF(2) and setting the number of elements to 256, the target composite field can be expressed as GF(((2 2 ) 2 ) 2 ), so the embodiment of the present application can use the binary finite field GF(2) as a subfield and obtain the target composite field GF(((2) through three-level nested expansion. 2 ) 2 ) 2 ); For example, starting from the binary finite field GF(2), the first-level expansion yields GF(2 2 ), the second level expansion gives GF((2 2 ) 2 ), the third level expansion gives GF(((2 2 ) 2 ) 2 ), that is, the first-level expansion is based on the binary finite field GF(2), and the second-level expansion is based on the result of the first-level expansion GF(2 2 ), the third level expansion is based on the result of the second level expansion GF((2 2 ) 2 ), and then through three-level nested expansion, we get the target composite domain GF(((2 2 ) 2 ) 2 ).

[0083] In an optional implementation, the embodiment of the present application can also perform multi-layer decomposition on the original finite field until it is decomposed into a binary finite field, so that the finite field after multi-layer decomposition can be represented as a target composite field with a binary finite field as a subfield and multi-level nested expansion. For example, the original finite field GF(2 8 ) as an example, then GF(2 8 ) can be decomposed into a binary finite field GF(2) through multiple layers of decomposition, so that the finite field after multiple layers of decomposition can represent the target composite field GF(((2 2 )2 ) 2 ). For example, we can first transform the finite field GF(2 8 ) is decomposed into two finite fields GF((2 4 ) 2 );Then each group of finite fields GF((2 4 ) 2 ) are decomposed into two groups of finite fields GF(2 2 ); Finally, each group of finite fields GF(2 2 ) are decomposed into two groups of finite fields GF(2), so that the finite fields after multi-layer decomposition can represent the target composite field GF(((2 2 ) 2 ) 2 ).

[0084] Since the target composite domain GF(((2 2 ) 2 ) 2 ) is a binary finite field GF(2), which is a finite field containing two elements. Therefore, the arithmetic operations of the binary finite field GF(2) are relatively simple, so the operation unit based on GF(2) is easy to implement in hardware. Therefore, using the operation unit based on GF(2) can effectively construct more complex polynomial operation circuits, such as GF(2 4 ) multiplication inversion, multiplication, square operation circuit, GF(2 8 ), thereby simplifying the hardware implementation of more complex polynomial operation circuits; that is, through the operation unit based on the binary finite field GF(2), complex operations of higher-order finite fields can be implemented at the hardware level, and the efficiency of the operation can be improved, the implementation complexity can be reduced, the delay and area overhead of the critical path can be reduced, and the resource overhead such as the area overhead of the hardware circuit can be reduced.

[0085] Thus, the embodiment of the present application can map the transformed input data from the original finite field of the data obfuscation transformation to the target composite field, for example, involving the S-box input data of the S-box of the AES algorithm and the SM4 algorithm from the original finite field GF(2 8 ) is mapped to the target composite domain GF(((2 2 ) 2 ) 2 ), input the S-box of the Camellia algorithm to the original finite field GF((2 4 ) 2 ) is mapped to the target composite domain GF(((2 2 ) 2 ) 2), transform the affine transformation input data of the affine transformation of the cryptographic algorithm acceleration instruction such as GFNI instruction from the original finite field GF(2 8 ) is mapped to the target composite domain GF(((2 2 ) 2 ) 2 ). Thus, in the target composite domain GF(((2 2 ) 2 ) 2 ) can be used to perform S-box operations of various cryptographic algorithms and affine transformation processing of cryptographic algorithm acceleration instructions, which can simplify operations.

[0086] In a further optional implementation, based on the existence of multiple original finite fields (for example, the S-boxes and affine transformations of multiple cryptographic algorithms can correspond to multiple original finite fields), the embodiment of the present application can set the mapping relationship between each original finite field and the target composite field (from the original finite field to the target composite field) to obtain multiple mapping relationships. Thus, when executing step S212, the embodiment of the present application can map the transformed input data from the original finite field of the data obfuscation transformation to the target composite field according to the mapping relationship between the original finite field of the data obfuscation transformation and the target composite field. For example, the embodiment of the present application can select the mapping relationship between the original finite field of the data obfuscation transformation and the target composite field from multiple pre-set mapping relationships; thus, based on the selected mapping relationship (i.e., the mapping relationship from the original finite field of the data obfuscation transformation to the target composite field), the transformed input data is mapped from the original finite field of the data obfuscation transformation to the target composite field. In the optional implementation example, the mapping relationship can be in the form of a mapping matrix.

[0087] Furthermore, based on the different computational requirements of S-boxes and affine transformations of different types of cryptographic algorithms, even if the S-boxes and affine transformations of different types of cryptographic algorithms use the same original finite field, the mapping relationship to the target composite field may be different. In other words, for any original finite field, the S-boxes or affine transformations of different types of cryptographic algorithms may have different mapping relationships between the original finite field and the target composite field.

[0088] In step S213, in the target composite domain, data obfuscation transformation is performed on the transformation input data mapped to the target composite domain to obtain transformation output data of the data obfuscation transformation.

[0089] As an optional implementation, the embodiment of the present application can perform a multiplication inverse operation on the transformed input data mapped to the target composite domain in the target composite domain to solve the multiplication inverse element, thereby obtaining the transformed output data of the data obfuscation transformation.

[0090] In other optional implementations, in the target composite domain, the transformed input data mapped to the target composite domain is operated to complete the data obfuscation transformation, which may not be limited to the multiplication inversion operation. For example, the operation form may be determined according to the actual operation requirements of the data obfuscation transformation, and is not limited to the multiplication inversion operation.

[0091] In a further optional implementation, the target composite domain may adopt a normal basis, for example, the elements are represented in the target composite domain in the form of a normal basis. Further, the original finite field may adopt a polynomial basis, for example, the elements are represented in the original finite field in the form of a polynomial basis. Thus, when the transformed input data (e.g., input finite element) is mapped to the target composite domain through the mapping relationship (e.g., mapping matrix) between the original finite field and the target composite domain, the transformation input data (e.g., input finite element) represented by the polynomial basis can be converted to the transformed input data represented by the normal basis; that is, the mapping between the original finite field and the target composite domain can not only realize the domain conversion of the transformed input data, but also realize the conversion of the representation form of the transformed input data from the polynomial basis to the normal basis, and then use the characteristics of the normal basis to further simplify the operations under the target composite domain, thereby simplifying the circuit structure of the data confusion transformation (e.g., the circuit structure of the multiplication inversion operation).

[0092] For example, taking the multiplication inversion operation of data obfuscation transformation (S-box operation or affine transformation) as an example, the transformation input data of the original finite field (such as input finite element) can be set to x, and the transformation input data x of the original finite field can be represented as Y after being mapped to the target composite field. i (e.g. the result of mapping the i-th transformed input data to the target composite domain), Y i It can be expressed using a normal basis; furthermore, Y i By performing an inverse operation in the target composite domain, the transformed output data can be obtained. The transformed output data can be expressed as Y0, for example, Y0=(Y i ) -1 , Y0 can be expressed using a normal basis.

[0093] It should be noted that the elements of a finite field can be expressed by a polynomial basis or a normal basis. The polynomial basis is a way of expressing the elements of a finite field. For example, the polynomial basis is a set of basis elements used in a finite field, which is a continuous power of the generator. The normal basis is another way of expressing the elements of a finite field. Each basis element of a normal basis can be obtained by an automorphism of an element in the application domain (such as repeated squaring, etc.), that is, starting from a basis element of a normal basis, all other basis elements of the normal basis can be generated through continuous specific operations (such as exponentiation).

[0094] It should be further explained that normal basis can be used in scenarios where frequent automorphic transformations are required. For example, normal basis can optimize the calculation process in encryption algorithms that require frequent automorphic transformations. Furthermore, in cryptographic algorithms, the transformed input data mapped to the target composite domain is represented by a normal basis, which can simplify the computational logic of the S-box and affine transformation of the cryptographic algorithm and simplify the computational circuit structure.

[0095] In step S214, the output data of the cryptographic algorithm is determined based on the transformed output data.

[0096] In an optional implementation, an embodiment of the present application can map the transformed output data from the target composite field back to the original finite field of the data obfuscation transformation to obtain the transformed output data of the original finite field; thereby, the output data of the cryptographic algorithm can be determined based on the transformed output data of the original finite field.

[0097] By way of example, an embodiment of the present application may set an inverse mapping relationship (e.g., an inverse mapping matrix) between each original finite field and the target composite field to obtain multiple inverse mapping relationships (e.g., multiple inverse mapping matrices), and the inverse mapping relationship is mapped from the target composite field to the original finite field. Thus, an embodiment of the present application may select the inverse mapping relationship between the original finite field of the data obfuscation transformation and the target composite field from multiple inverse mapping relationships; according to the inverse mapping relationship between the original finite field of the data obfuscation transformation and the target composite field, map the transformed output data from the target composite field back to the original finite field of the data obfuscation transformation. By way of example, the inverse mapping relationship may be in the form of an inverse mapping matrix.

[0098] In other possible implementations, the embodiments of the present application may also support not using a normal basis, for example, both the target composite field and the original finite field use a polynomial basis; thus, the embodiments of the present application may not perform basis transformation (i.e., transformation between a polynomial basis and a normal basis) during mapping and inverse mapping. For ease of understanding, Figure 3A The following is an exemplary diagram showing a process example without base transformation: Figure 3A As shown, the original finite field, the mapping matrix and the inverse mapping matrix can adopt a polynomial basis, so that the transformed input data can be a polynomial basis of the original finite field, and the transformed input data is mapped to a polynomial basis under the target composite field through the mapping matrix, and then the polynomial basis is used for operation under the target composite field to obtain the transformed output data of the polynomial basis; the transformed output data of the polynomial basis is mapped back to the original finite field through the inverse mapping matrix to obtain the transformed output data corresponding to the polynomial basis of the original finite field.

[0099] Furthermore, Figure 3B The following is an exemplary diagram showing the processing example of base transformation: Figure 3BAs shown, the original finite field adopts a polynomial basis, and the mapping matrix and the inverse mapping matrix adopt a normal basis, so that the transformed input data can be a polynomial basis of the original finite field, and the transformed input data is mapped to a normal basis under the target composite domain through the mapping matrix, and then the operation is performed with the normal basis under the target composite domain to obtain the transformed output data of the normal basis; the transformed output data of the normal basis is mapped back to the original finite field through the inverse mapping matrix to obtain the transformed output data corresponding to the polynomial basis of the original finite field.

[0100] In an optional implementation, the transformed output data (eg, the transformed output data mapped back to the original finite field) can participate in subsequent rounds of calculations of the cryptographic algorithm, so that after all multiple rounds of calculations of the cryptographic algorithm are completed, the output data of the cryptographic algorithm can be output.

[0101] Taking the S-box operation of the cryptographic algorithm as an example, the S-box input data (a form of transformed input data) of the S-box can obtain the S-box output data after the target composite domain completes the operation; the S-box output data (for example, the S-box output data mapped back from the target composite domain to the original finite field) can participate in the subsequent steps of the cryptographic algorithm (for example, the ShiftRows step, the MixColumns step, the AddRoundKey step, etc., and each step depends on the output of the previous step as its input), and then after the cryptographic algorithm completes all the multi-round calculations, the output data of the cryptographic algorithm is output. It should be noted that the steps related to the AES algorithm, the SM4 algorithm, and the Camellia algorithm that are connected with the S-box can refer to the description of the corresponding part of the previous text, and will not be expanded here; based on the different types of cryptographic algorithms applied by the S-box, the steps of connecting the cryptographic algorithm with the S-box to obtain the output data of the cryptographic algorithm may be different, which can be determined according to the specific type of cryptographic algorithm.

[0102] Taking the affine transformation of cryptographic algorithm acceleration instructions such as GFNI instructions as an example, after the affine transformation input data (a form of transformation input data) of the affine transformation completes the operation in the target composite domain, the affine transformation output data can be obtained. For the convenience of explanation, the output data of the affine transformation is referred to as the affine transformation output data in the embodiment of the present application; the affine transformation output data (for example, the affine transformation output data mapped from the target composite domain back to the original finite field) can be used in the subsequent steps of the cryptographic algorithm to obtain the output data of the cryptographic algorithm. For example, when using cryptographic algorithm acceleration instructions such as GFNI, the affine transformation can be used as an optimization step to increase computing efficiency and / or security, and the affine transformation output data can be directly used in the subsequent steps of the cryptographic algorithm or directly form the output result of the cryptographic algorithm (for example, the encryption result).

[0103] For example, if the embodiment of the present application uses a cryptographic algorithm to perform a data encryption process, the output data of the cryptographic algorithm may be ciphertext data; if the cryptographic algorithm is used to perform a data decryption process, the input data of the cryptographic algorithm may be plaintext data.

[0104] In the process of processing data using a cryptographic algorithm, the embodiments of the present application can increase the security of the cryptographic algorithm through data obfuscation transformation, thereby improving the security protection of the data. Specifically, the intermediate data of the cryptographic algorithm can be determined according to the input data of the cryptographic algorithm as the transformed input data of the data obfuscation transformation; the transformed input data is mapped from the original finite field of the data obfuscation transformation to the target composite domain, and the target composite domain is a composite domain with a binary finite field as a subdomain and multi-level nested expansion; thereby, in the target composite domain, the transformed input data mapped to the target composite domain is subjected to data obfuscation transformation to obtain the transformed output data of the data obfuscation transformation; further, according to the transformed output data, the output data of the cryptographic algorithm is determined, the processing of the input data by the cryptographic algorithm is completed, and the output data of the cryptographic algorithm is obtained.

[0105] The scheme provided by the embodiment of the present application can be applied to any of a variety of cryptographic algorithms, and in the case of using data obfuscation transformation to increase the security of the cryptographic algorithm, the original finite field of the data obfuscation transformation can be any of a plurality of original finite fields, so that the embodiment of the present application supports mapping the transformed input data from any of a plurality of original finite fields to a target composite field, so that the data obfuscation transformation of any cryptographic algorithm in any original finite field can reuse the operation of the target composite field, so as to improve the reusability of the data obfuscation transformation and reduce the resource overhead of the data obfuscation transformation. At the same time, the target composite field is a composite field with a binary finite field as a subfield and multi-level nested expansion, and the binary finite field is a finite field containing two elements, so the operation of the binary finite field as a subfield in the target composite field is relatively simplified (for example, operations involving two elements), so that the data obfuscation transformation of any cryptographic algorithm in any original finite field (for example, the S-box operation or affine transformation of any cryptographic algorithm) is uniformly mapped to the target composite field for operation, which can not only realize operation reuse, but also simplify the operation, thereby reducing the delay and area overhead of the critical path and reducing the resource overhead.

[0106] In a further optional implementation, in order to realize the mapping of the original finite field to the target composite field of the data obfuscation transformation, the embodiment of the present application can set the mapping relationship between each original finite field and the target composite field, so as to obtain multiple mapping relationships (such as multiple mapping matrices). Optionally, the embodiment of the present application can decompose any original finite field layer by layer by direct sub-field decomposition until it is decomposed into a binary finite field, thereby determining the mapping relationship from the original finite field to the target composite field according to the corresponding inter-layer mapping relationship in the decomposition process.

[0107] As an optional implementation, Figure 4 The optional flow chart for setting the mapping relationship provided in the embodiment of the present application is shown as an example. Figure 4 , the process may include the following steps.

[0108] In step S410, for any original finite field, direct subfield decomposition is performed layer by layer based on the original finite field until it is decomposed into a binary finite field, so as to obtain a multi-layer finite field.

[0109] It should be noted that a direct subdomain can be regarded as a subdomain that can be directly extended from a parent domain without passing through other intermediate domains. In other words, it only takes one extension from the parent domain to the direct subdomain. For example, the finite field GF(2 8 ) as the parent domain, then GF(2 8 ) can be a direct subdomain of GF(2 4 ), that is, GF(2 4 ) of exponent 4 is GF(2 8 ) is a direct factor of exponent 8, and GF(2 2 ) is not considered to be GF(2 8 ), because GF(2 2 ) exists through GF(2 4 ) this intermediate region and then to GF(2 8 ) situation.

[0110] For any original finite field, the embodiment of the present application can decompose the original finite field into smaller subfields in layers by direct subfield decomposition until the binary finite field GF(2) is reached, thereby simplifying the structure of the field and gradually reducing the complexity of the field. For example, in the process of performing direct subfield decomposition layer by layer, each layer of decomposition will generate a new finite field (referred to as the new field), so that the embodiment of the present application can obtain multiple layers of finite fields.

[0111] In step S411, a mapping relationship between an original finite field and a target composite field is determined according to the roots of the reduced polynomial of the multi-layer finite field.

[0112] In the process of performing direct subdomain decomposition layer by layer, the algebraic structure of the new domain defined by the reduced polynomial will be generated. The roots of the reduced polynomial of the new domain have the function of generators in the new domain, thereby expressing the elements in the new domain. Through the algebraic properties of the roots of the reduced polynomial of the new domain, the mapping relationship between the previous finite domain and the new domain can be constructed (in the process of performing direct subdomain decomposition layer by layer, the previous finite domain can be decomposed into the new domain), so that through the multi-layer mapping relationship, the original finite domain and the target composite domain can be linked to obtain the mapping relationship between the original finite domain and the target composite domain.

[0113] It can be seen that in the process of performing direct subdomain decomposition layer by layer in the embodiment of the present application, a new finite field can be generated at each layer of decomposition to obtain a multi-layer finite field; thus, according to the root of the reduced polynomial of the new field, a mapping relationship between the finite field of the previous layer and the new field is constructed. For example, according to the root of the reduced polynomial of the finite field of the next layer, a mapping relationship between the finite field of the previous layer and the finite field of the next layer is established to obtain an inter-layer mapping relationship between the finite field of the previous layer and the finite field of the next layer; wherein the finite field of the next layer can be regarded as a new field decomposed from the finite field of the previous layer; and then through multi-layer continuous mapping, the mapping relationship between the original finite field and the target composite field is determined according to the root of the reduced polynomial of the multi-layer finite field, for example, the mapping relationship between the original finite field and the target composite field is determined according to the inter-layer mapping relationship.

[0114] In a further optional implementation, if the target composite field adopts a normal basis, the normal basis can be used when establishing the above-mentioned inter-layer mapping relationship. In an optional implementation, when using the roots of the reduced polynomial of the next-layer finite field to establish the mapping relationship between the previous-layer finite field and the next-layer finite field, the functional relationship of the roots of the reduced polynomial of the next-layer finite field can be used to represent the normal basis of the elements of the previous-layer finite field; that is, the functional relationship of the roots of the reduced polynomial of the next-layer finite field can be used to represent the normal basis of the elements of the previous-layer finite field, thereby obtaining the inter-layer mapping relationship between the previous-layer finite field and the next-layer finite field.

[0115] As an optional implementation, the composite field can be understood as a multi-layer extended finite field, that is, the extension dimension of the finite field is multi-layer. For example, for GF(2 8 ) and GF((2 4 ) 2 ), GF(2 8 ) is a single-layer finite field constructed over GF(2) by an irreducible polynomial of degree 8, while GF((2 4 ) 2 ) is a function from GF(2 4 ) constructs a multi-layer finite field, so GF(2 8 ) is not a composite field, GF((2 4 ) 2 ) is a composite domain. Thus, for any original finite field, when performing direct subdomain decomposition layer by layer based on the original finite field, if the original finite field is not a composite domain (for example, the original finite field is a single-layer finite field), the embodiment of the present application can decompose the original finite field into a composite domain of direct subdomains of the original finite field; thus, starting from the composite domain of direct subdomains of the original finite field, the direct subdomain of the finite field of the current layer is decomposed into a composite domain of the next direct subdomain at the next layer, until the last layer of finite field is a composite domain of a binary finite field, so as to realize direct subdomain decomposition layer by layer.

[0116] Let the original finite field be GF(2 8 ), the target composite domain is GF(((2 2 ) 2 ) 2 ) as an example, Figure 5A Another optional flow chart for setting a mapping relationship provided in an embodiment of the present application is exemplarily shown. The flow chart can be used to set GF(2 8 ) and GF(((2 2 ) 2 ) 2 ) mapping relationship (such as mapping matrix), refer to Figure 5A , the process may include the following steps.

[0117] In step S510, GF(2 8 ) is decomposed into GF((2 4 ) 2 ), and determine GF((2 4 ) 2 ) and the roots of the first reduced polynomial.

[0118] Reduction polynomials are used to construct or expand finite fields. For example, reduction polynomials can define the algebraic structure of the elements in the new field during the expansion of the finite field. As an alternative implementation, the original finite field GF(2 8 ) is a direct subdomain of GF(2 4 ), so that the original finite field GF(2 8 ) is decomposed into the direct subfield GF(2 4 ) is a composite domain, namely GF((2 4 ) 2 ). That is, with GF(2 4 ) for GF(2 8 ) is reconstructed to obtain the composite field GF((2 4 ) 2 ). Further, we can determine GF((2 4 ) 2 ) is a reduced polynomial (called the first reduced polynomial), which can define GF((2 4 ) 2 ) is the algebraic structure of the elements in .

[0119] As an alternative implementation, GF((2 4 ) 2 ) can be expressed as the first reduced polynomial y 2 +τy+v; where y is the algebraic variable of the first reduction polynomial, and its characteristics can be defined by the coefficients τ and v in the first reduction polynomial; the coefficients τ and v can come from the subfield GF(2 4), that is, after GF(2 8 ) is decomposed into GF((2 4 ) 2 ) from the subdomain GF(2 4 ) can be used to adjust and control GF((2 4 ) 2 ) and the characteristics of the field; specifically, τ is GF(2 4 ) as the coefficient of the first-order term in the first reduction polynomial, affecting GF((2 4 ) 2 ) affects the algebraic behavior of the elements in GF((2 4 ) 2 ); v is GF(2 4 ) are used as free terms in the first reduction polynomial, defining GF((2 4 ) 2 ), such as GF((2 4 ) 2 ) interactions between the elements in it.

[0120] The roots of the reduction polynomial can represent the elements in the field corresponding to the reduction polynomial. Furthermore, the roots can be the generators of the field corresponding to the reduction polynomial, used to express the elements in the field. 4 ) 2 ), the root of the first reduction polynomial can be expressed as Y, that is, Y can be the first reduction polynomial y 2 +τy+v, indicating that it exists in the field GF((2 4 ) 2 ) in the .

[0121] Furthermore, based on the fact that the mapping relationship between the upper finite field and the lower finite field can be established according to the root of the reduced polynomial of the lower finite field, the GF(2 8 ) and GF((2 4 ) 2 ), so based on the roots of the first reduced polynomial, we can build GF(2 8 ) and GF((2 4 ) 2 ) between them (called the first mapping relationship). For example, based on the functional relationship that can use the roots of the reduced polynomial of the next finite field, the normal basis of the elements of the previous finite field is represented by GF(2 8) is expressed as an example using a normal basis, GF(2 8 ) can be expressed as J1 = γ1Y 16 +γ0Y, where γ1,γ0∈GF(2 4 ). γ1, γ0 are from GF((2 4 ) 2 ) of the subfield GF(2 4 ) coefficients, and thus from GF(2 4 ) can be expressed as GF(2 8 ) is a normal basis for the elements of .

[0122] In step S511, GF(2 4 ) is decomposed into GF((2 2 ) 2 ), and determine GF((2 2 ) 2 ) and the roots of the second reduced polynomial.

[0123] GF(2 8 ) is decomposed into GF((2 4 ) 2 ) after that, the current finite field is GF((2 4 ) 2 ), then the direct subfield of the current finite field is GF(2 4 ), and GF(2 4 ) is a direct subdomain of GF(2 2 ); That is, for the current layer finite field GF((2 4 ) 2 ) is a direct subfield of GF(2 4 ), the next direct subdomain is GF(2 2 ), so that GF(2 4 ) is decomposed into GF(2 2 ) to decompose the direct subfield of the current finite field into the composite field of the next direct subfield at the next level. 4 ) 2 ) is a direct subfield of GF(2 4 ) can be further decomposed into GF(2 2 ) for GF(2 4 ) is reconstructed to obtain the composite field GF((2 2 ) 2 ). Further, we can determine GF((2 2 ) 2) is a reduced polynomial (called the second reduced polynomial), which can define GF((2 2 ) 2 ) is the algebraic structure of the elements in .

[0124] As an alternative implementation, GF((2 2 ) 2 ) can be expressed as z 2 +αz+β; where z is the algebraic variable of the second reduction polynomial, whose characteristics can be defined by the coefficients α and β in the second reduction polynomial; the coefficients α and β can come from GF(2 2 ).

[0125] Furthermore, when defining GF((2 2 ) 2 ), the roots of the second reduction polynomial can represent the field GF((2 2 ) 2 ). For example, the root of the second reduction polynomial can be expressed as Z, that is, Z can be the second reduction polynomial z 2 +αz+β, indicating that it exists in the field GF((2 2 ) 2 ) in the .

[0126] Furthermore, based on the fact that the mapping relationship between the upper finite field and the lower finite field can be established based on the root of the reduced polynomial of the lower finite field, the GF(2 4 ) and GF((2 2 ) 2 ), for example, based on the roots of the second reduction polynomial, we can build GF(2 4 ) and GF((2 2 ) 2 ) between them (called the second mapping relationship). For example, based on the functional relationship that can use the roots of the reduced polynomial of the next finite field, the normal basis of the elements of the previous finite field is represented by GF(2 4 ) is expressed as an example using a normal basis, GF(2 4 ) can be expressed as J2 = ▽1Z 4 +▽0Z, where ▽0, ▽1∈GF(2 2 ); that is, ▽0, ▽1 are from GF((2 2 ) 2 ) of the subfield GF(2 2 ) coefficients, and thus from GF(2 2) coefficients ▽0, ▽1 can be linearly combined through the power of the root Z of the second reduction polynomial to express GF(2 4 ) is a normal basis for the elements of .

[0127] In step S512, GF(2 2 ) is decomposed into GF((2) 2 ), and determine GF((2) 2 ) and the roots of the third reduced polynomial.

[0128] GF(2 4 ) is decomposed into GF((2 2 ) 2 ) after that, the current finite field is GF((2 2 ) 2 ), then the direct subfield of the current finite field is GF(2 2 ), and GF(2 2 ) is a direct subfield of GF(2); that is, for the current level finite field GF((2 2 ) 2 ) is a direct subfield of GF(2 2 ), the next direct subdomain is GF(2), so GF(2) can be converted to 2 ) is decomposed into a composite field of GF(2) to realize decomposing the direct subfield of the current layer finite field into a composite field of the next direct subfield at the next layer. Thus, the GF((2) decomposed in step S511 2 ) 2 ) is a direct subfield of GF(2 2 ) can be further decomposed, that is, reconstructed with the binary finite field GF(2), and we get GF((2) 2 ). Further, we can determine GF((2) 2 ) (called the third reduction polynomial).

[0129] As an alternative implementation, GF((2) 2 ) can be expressed as ω 2 +ω+1, the third reduction polynomial can reflect the conversion from binary finite field GF(2) to GF(2 2 ), since the elements of the binary finite field GF(2) are 0 and 1, the form of the third reduction polynomial can be relatively simplified, and no additional coefficients are required to adjust the behavior of the field. In other words, when using the elements (0 and 1) of the binary finite field GF(2) to represent GF(2 2 ), ω is used as the variable of the third reduction polynomial.

[0130] Furthermore, by using the third reduction polynomial to define GF((2)2 ), the roots of the third reduction polynomial can be expressed as GF((2) 2 ). For example, the root of the third reduction polynomial can be expressed as W, that is, W can be the third reduction polynomial ω 2 +ω+1, indicating that it exists in the field GF((2) 2 ) in the .

[0131] Furthermore, based on the fact that the mapping relationship between the upper finite field and the lower finite field can be established based on the root of the reduced polynomial of the lower finite field, the function relationship of the root of the third reduced polynomial can be used to express and transform GF(2 2 ) and GF((2) 2 ), for example, based on the roots of the third reduction polynomial, we can build GF(2 2 ) and GF((2) 2 ) (called the third mapping relationship). For example, based on the functional relationship that can use the roots of the reduced polynomial of the next finite field, the normal basis of the elements of the previous finite field is represented by GF(2 2 ) is expressed as an example using a normal basis, GF(2 2 ) can be expressed as J3 = g1W 2 +g0W, where g1, g0∈GF(2); that is, g1, g0 are coefficients (0 and 1) from the binary finite field GF(2), so the coefficients g1, g0 from the binary finite field GF(2) can be linearly combined by the power of the root W of the third reduction polynomial to express GF(2 2 ) is a normal basis for the elements of .

[0132] In step S513, GF(2 8 ) and GF(((2 2 ) 2 ) 2 )’s mapping relationship.

[0133] As an optional implementation, Figure 5A In the exemplary layer-by-layer decomposition, the inter-layer mapping relationship between the finite field of the previous layer and the finite field of the next layer may include: GF(2 8 ) and GF((2 4 ) 2 ) first mapping relationship, GF(2 4 ) and GF((2 2 ) 2) is the second mapping relationship, and the GF(2 2 ) and GF((2) 2 ) of the third mapping relationship; thus, the embodiment of the present application can obtain GF(2 according to the first mapping relationship, the second mapping relationship and the third mapping relationship. 8 ) and GF(((2 2 ) 2 ) 2 ). When the function relationship of the roots of the reduced polynomial of the next finite field is used to represent the normal basis of the elements of the previous finite field, the normal basis representation corresponding to the above-mentioned inter-layer mapping relationship can refer to the description of the corresponding part in the previous text and will not be expanded here.

[0134] In an optional implementation example, after obtaining the first mapping relationship, the second mapping relationship, and the third mapping relationship, the embodiment of the present application can integrate the first mapping relationship, the second mapping relationship, and the third mapping relationship to obtain GF(2 8 ) and GF(((2 2 ) 2 ) 2 ) mapping relationship. For example, through the continuous first mapping relationship, the second mapping relationship and the third mapping relationship, GF(2 8 ) is mapped to GF((2 4 ) 2 ), GF((2 4 ) 2 ) is a direct subfield of GF(2 4 ) is mapped to GF((2 2 ) 2 ), GF((2 2 ) 2 ) is a direct subfield of GF(2 2 ) is mapped to GF((2) 2 ), thus constructing a complete GF(2 8 ) to GF(((2 2 ) 2 ) 2 ) mapping relationship. In this way, complex operations can be performed on simple domains, thereby reducing the implementation complexity. For example, GF(2 8 ) and GF(((2 2 ) 2 ) 2 ) can be used to simulate the operation of the higher complexity GF(2) using the lower complexity binary finite field GF(2) 8 ) operations.

[0135] For example, GF(2 8) and GF(((2 2 ) 2 ) 2 ) can be mapped to GF(2 8 ) is expressed as GF(((2 2 ) 2 ) 2 ) includes a mapping formula or mapping matrix (the mapping relationship can be in formula form or matrix form) for the elements of the first reduction polynomial, which includes the conversion process from the root Y of the first reduction polynomial to the root Z of the second reduction polynomial, and then to the root W of the third reduction polynomial.

[0136] In an alternative implementation, the original finite field GF(2 8 ) may include the affine transformation of the S-box of the AES algorithm, the S-box of the SM4 algorithm, the affine transformation of the cryptographic algorithm acceleration instructions such as the GFNI instruction, etc., so the affine transformation of the S-box of the AES algorithm, the S-box of the SM4 algorithm, the affine transformation of the cryptographic algorithm acceleration instructions such as the GFNI instruction can be used Figure 5A Example way to get GF(2 8 ) and GF(((2 2 ) 2 ) 2 )’s mapping relationship (e.g., mapping matrix).

[0137] Furthermore, different types of cryptographic algorithms have S-boxes and affine transformations of GF(2 8 ) and GF(((2 2 ) 2 ) 2 ) can be different. For example, the S-box and affine transformation of different types of cryptographic algorithms can choose GF(2 8 ) and adjusting different irreducible polynomials in the reduction polynomials (for example, optimizing and adjusting the coefficients τ and v in the first reduction polynomial and the coefficients α and β in the second reduction polynomial), so as to adapt to the requirements of S-boxes and affine transformations of different types of cryptographic algorithms.

[0138] Specifically, for the original finite field, GF(2 8 ) of different types of cryptographic algorithms, S-boxes and affine transformations, GF(2 8 ) are not the same. Different irreducible polynomials can be selected to adapt to different types of cryptographic algorithms' S-boxes and affine transformations. Thus, in GF(2 8 ) decomposes into GF(((2 2 ) 2 ) 2), the reduction polynomials (such as the first reduction polynomial, the second reduction polynomial, and the third reduction polynomial) corresponding to the S-box and affine transformation of different types of cryptographic algorithms may be different, which leads to the GF(2 8 ) to GF(((2 2 ) 2 ) 2 ) may be different. This is applicable to the case where the 8 ) for any type of cryptographic algorithm.

[0139] In the optional implementation example, the original finite fields used by the S-boxes of the affine transformation, AES algorithm, and SM4 algorithm are all GF(2 8 ), and the irreducible polynomial of the affine transformation is consistent with the irreducible polynomial corresponding to the AES algorithm, for example, both use x 8 +x 4 +x 3 +x+1, then the mapping relationship (e.g., mapping matrix) of the affine transformation may be the same as the mapping relationship (e.g., mapping matrix) of the S-box of the AES algorithm, but different from the mapping relationship (e.g., mapping matrix) of the S-box of the SM4 algorithm; further, for the corresponding inverse mapping relationship (e.g., inverse mapping matrix), the inverse mapping relationship (e.g., inverse mapping matrix) of the affine transformation may be the same as the inverse mapping relationship (e.g., inverse mapping matrix) of the S-box of the AES algorithm, but different from the inverse mapping relationship (e.g., inverse mapping matrix) of the S-box of the SM4 algorithm. Of course, this example is only an optional implementation, and the embodiments of the present application may also support that the mapping relationship of the affine transformation may be different from the mapping relationship of the S-box of the AES algorithm, and the inverse mapping relationship of the affine transformation may be different from the inverse mapping relationship of the S-box of the AES algorithm.

[0140] In GF(2 8 ), it is necessary to construct multiple reduction polynomials (such as the first reduction polynomial, the second reduction polynomial and the third reduction polynomial). The coefficients in the reduction polynomials (such as τ, v, α, β, etc.) determine the algebraic behavior of the elements in the composite field that is gradually decomposed and expanded. These coefficients can be adjusted to optimize the operation performance of the S-box and affine transformation of different types of cryptographic algorithms, such as the efficiency of multiplication inversion; thus, based on the adjustment of the coefficients in the reduction polynomials, the S-box and affine transformation of different types of cryptographic algorithms GF(2 8 ) to GF(((2 2 ) 2 ) 2 ) may have different mapping relationships;

[0141] Optionally, the coefficients (such as τ, v, α, β, etc.) in the reduction polynomials corresponding to the S-boxes and affine transformations of different types of cryptographic algorithms may be optimized and adjusted based on the characteristics of the finite field conjugation of the S-boxes and affine transformations of different types of cryptographic algorithms. For example, the coefficients in the reduction polynomials may be selected and optimized by utilizing the properties of the finite field conjugated elements of the S-boxes and affine transformations of different types of cryptographic algorithms.

[0142] It should be noted that finite field conjugation refers to the conjugation of elements of a finite field, such as a set of elements obtained through automorphism transformation of a finite field. Conjugated elements have the same minimal polynomial mathematically, which can help describe the algebraic properties of the elements and simplify operations within the domain. Multiplication inversion is an operation in cryptographic algorithms and affine transformations. Therefore, for different types of cryptographic algorithms' S-boxes and affine transformations, based on the characteristics of the finite field conjugation of the cryptographic algorithms' S-boxes and affine transformations, coefficients such as τ, v, α, and β can be adjusted to construct a specific form of reduction polynomial, making the inversion operation in the domain corresponding to the reduction polynomial more efficient.

[0143] Furthermore, for ease of understanding, Figure 5B GF(2 8 ) to GF(((2 2 ) 2 ) 2 )'s mapping matrix, such as Figure 5B As shown, in step S501, GF(2 8 ) is an irreducible polynomial.

[0144] Optionally, for operations over finite fields GF(2 8 ) of different types of cryptographic algorithms, the irreducible polynomials of the S-box and affine transformation are different, which can be solved by choosing GF(2 8 ) to adapt to different types of cryptographic algorithms' S-boxes and affine transformations.

[0145] In step S502, layer-by-layer decomposition is performed.

[0146] In step S503, the coefficients of the first reduction polynomial and the coefficients of the second reduction polynomial are selected and optimized.

[0147] Optional, combined Figure 5A In the form of the first reduced polynomial, the second reduced polynomial, and the third reduced polynomial, the embodiment of the present application can choose to optimize the coefficients τ and v in the first reduced polynomial and the coefficients α and β in the second reduced polynomial. For example, based on the characteristics of the S-box of different types of cryptographic algorithms and the finite field conjugation of affine transformation, τ, v, α, and β are selected for optimization.

[0148] In step S504, the roots of the first reduced polynomial, the roots of the second reduced polynomial, and the roots of the third reduced polynomial are determined.

[0149] In step S505, determine GF(2 8 ) to GF(((2 2 ) 2 ) 2 ) is the mapping matrix.

[0150] The relevant contents of step S504 and step S505 can refer to the description of the corresponding parts in the previous text. 8 ) may have different irreducible polynomials. The coefficients of the S-box and affine transformation of different types of cryptographic algorithms in the first reduction polynomial and the second reduction polynomial may be optimized differently. Therefore, the roots corresponding to the S-box and affine transformation of different types of cryptographic algorithms in the first reduction polynomial, the second reduction polynomial and the second reduction polynomial may be different. Therefore, the GF(2 8 ) to GF(((2 2 ) 2 ) 2 ) may be different; thus, the embodiment of the present application can determine GF(2 8 ) to GF(((2 2 ) 2 ) 2 ) mapping matrix, and obtain the GF(2 8 ) to GF(((2 2 ) 2 ) 2 ) mapping matrix, and the affine transformation corresponding to the cryptographic algorithm acceleration instructions such as GFNI instructions (GF(2 8 ) to GF(((2 2 ) 2 ) 2 ) is the mapping matrix.

[0151] For example, using GF(2 8 ) of the AES algorithm, the S-box of the SM4 algorithm, the affine transformation of the GFNI instruction, and the S-box of other cryptographic algorithms are taken as examples. The GF(2 8 ) to GF(((2 2 ) 2 ) 2 ) can be set as M aes , GF(2 8 ) to GF(((2 2 )2 ) 2 ) can be set as M sm4 , the affine transformation of GFNI instruction is GF(2 8 ) to GF(((2 2 ) 2 ) 2 ) can be set as M GFNI , GF(2 8 ) to GF(((2 2 ) 2 ) 2 ) can be set as M other1 In an optional implementation example, M GFNI Can be equal to M aes , so that in some embodiments, M GFNI It can be directly expressed as M aes .

[0152] As an optional implementation, when performing direct subdomain decomposition layer by layer based on the original finite field, if the original finite field is a composite field, the embodiment of the present application can decompose the original finite field into multiple groups of direct subdomains of the original finite field; thereby, each group of direct subdomains of the original finite field is decomposed into the composite field of the next direct subdomain; then, starting from the composite field of the next direct subdomain, the direct subdomain of the finite field of the current layer is decomposed into the composite field of the next direct subdomain at the next layer, until the last layer of the finite field is the composite field of the binary finite field, so as to realize direct subdomain decomposition layer by layer.

[0153] Let the original finite field be GF((2 4 ) 2 ), the target composite domain is GF(((2 2 ) 2 ) 2 ) as an example, Fig. 6A Another optional flow chart for setting a mapping relationship provided in an embodiment of the present application is shown as an example. The flow chart can be used to set GF((2 4 ) 2 ) and GF(((2 2 ) 2 ) 2 ) mapping relationship (such as mapping matrix), refer to Fig. 6A , the process may include the following steps.

[0154] In step S610, GF((2 4 ) 2 ) is decomposed into two groups of GF(2 4 ) elements.

[0155] The original finite field is the composite field GF((24 ) 2 ), and GF((2 4 ) 2 ) is a direct subdomain of GF(2 4 ), then we can convert the original finite field GF((2 4 ) 2 ) is decomposed into two groups of direct subfields GF(2 4 ). For example, the original finite field GF((2 4 ) 2 ) can be divided into two groups of elements (for example, high and low groups of elements), each of which belongs to GF(2 4 ), thus obtaining two groups of GF(2 4 ). For example, for cryptographic algorithms such as the Camellia algorithm using two S-boxes, the original finite field is GF((2 4 ) 2 ), it can be decomposed into two groups of GF (2 4 ) and each group of elements∈GF(2 4 ).

[0156] In step S611, two groups of GF(2 4 ) are decomposed into GF((2 2 ) 2 ), and determine two groups of GF(2 4 ) decomposed GF((2 2 ) 2 ) respectively correspond to the second reduced polynomials, and obtain two second reduced polynomials and two roots of the second reduced polynomials.

[0157] In the case of GF((2 4 ) 2 ) is decomposed into two groups of GF(2 4 ), each group GF(2 4 ) is a direct subdomain of GF(2 2 ), that is, the next direct subdomain is GF(2 2 ), then each group GF(2 4 ) can be further decomposed into a composite field GF((2 2 ) 2 ). Since the original finite field GF((2 4 ) 2 ) contains two groups of GF(2 4 ) elements, so we can get GF((2 2 ) 2 ),two groups of GF(2 4 ) can be decomposed into GF((2 2 ) 2). Furthermore, the present embodiment can obtain two groups of GF (2 4 ) after decomposition of GF((2 2 ) 2 ), and expressed using two reduced polynomials. For ease of explanation, GF((2 2 ) 2 ) is called the second simplified form. Since the two groups of GF(2 4 ) are decomposed into GF((2 2 ) 2 ), then there exist two second reduction polynomials.

[0158] For example, the two second reduction polynomials can be expressed as z 2 +α0z+β0、z 2 +α1z+β1, where z is an algebraic variable of the second reduction polynomial, and its characteristics can be defined by the coefficients in the second reduction polynomial; based on the embodiment of the present application having two second reduction polynomials, there are coefficients α0 and β0 in a second reduction polynomial, for example, a set of GF(2 4 ) decomposed GF((2 2 ) 2 ) The coefficients α0 and β0 in the second reduction polynomial corresponding to α0 and β0 come from the set of GF(2 4 ) decomposed GF((2 2 ) 2 ) corresponds to the subfield GF(2 2 ); and, there exists another coefficient α1 and β1 in the second reduction polynomial, such as another set GF(2 4 ) decomposed GF((2 2 ) 2 ) The coefficients α1 and β1 in the second reduction polynomial corresponding to α1 and β1 come from the other group GF(2 4 ) decomposed GF((2 2 ) 2 ) corresponds to the subfield GF(2 2 ).

[0159] Furthermore, the embodiment of the present application can determine the roots of two second reduced polynomials, such as z 2 +α0z+β0, and z 2 +α1z+β1; for ease of explanation, the root of any of the two second reduction polynomials can be set to Z, for example, z 2 +α0z+β0 root or z 2+α1z+β1 is set to Z. Optionally, based on the ability to establish a mapping relationship between the upper finite field and the lower finite field based on the root of the reduced polynomial of the lower finite field, GF(2 4 ) and GF((2 2 ) 2 ), for example, based on the roots of the second reduction polynomial, we can build GF(2 4 ) and GF((2 2 ) 2 ) between them (called the second mapping relationship). For example, based on the functional relationship that can use the roots of the reduced polynomial of the next finite field, the normal basis of the elements of the previous finite field is represented by GF(2 4 ) is expressed as an example using a normal basis, GF(2 4 ) can be expressed as J2 = ▽1Z 4 +▽0Z, where ▽0, ▽1∈GF(2 2 ). The content of establishing the second mapping relationship in this part can be Figure 5A The corresponding parts are similar and can be referenced to each other.

[0160] In step S612, GF(2 2 ) is decomposed into GF((2) 2 ), and determine GF((2) 2 ) and the roots of the third reduced polynomial.

[0161] The two groups of GF(2 4 ) are decomposed into GF((2 2 ) 2 ) after that, the current finite field is GF((2 2 ) 2 ), then the direct subfield of the current finite field is GF(2 2 ), and GF(2 2 ) is a direct subfield of GF(2); that is, for the current level finite field GF((2 2 ) 2 ) is a direct subfield of GF(2 2 ), the next direct subdomain is GF(2), so GF(2) can be converted to 2 ) is decomposed into a composite field with GF(2) as a subfield, so as to realize decomposing the direct subfield of the current layer finite field into a composite field of the next direct subfield at the next layer. The description of step S612 can be the same as Figure 5A The description of step S512 in is similar and can be referenced to each other.

[0162] For example, GF((2)2 ) can be expressed as ω 2 +ω+1. Further, let the root of the third reduced polynomial be W, then we can establish GF(2 2 ) and GF((2) 2 ) (called the third mapping relationship), for example, GF(2 2 ) is expressed as an example using a normal basis, then GF(2 2 ) can be expressed as J3 = g1W 2 +g0W, where g1,g0∈GF(2).

[0163] In step S613, GF((2 4 ) 2 ) and GF(((2 2 ) 2 ) 2 )’s mapping relationship.

[0164] As an optional implementation, Fig. 6A In the exemplary layer-by-layer decomposition, the inter-layer mapping relationship between the upper layer finite field and the lower layer finite field may include: two groups of GF (2 4 ) and GF((2 2 ) 2 ) respectively, according to the root of the third reduction polynomial, GF(2 2 ) and GF((2) 2 ) of the third mapping relationship; thus, the embodiment of the present application can be based on two groups of GF (2 4 ) and GF((2 2 ) 2 ) respectively, and the third mapping relationship, and obtain GF((2 4 ) 2 ) and GF(((2 2 ) 2 ) 2 ). When the function relationship of the roots of the reduced polynomial of the next finite field is used to represent the normal basis of the elements of the previous finite field, the normal basis representation corresponding to the above-mentioned inter-layer mapping relationship can refer to the description of the corresponding part in the previous text and will not be expanded here.

[0165] In an optional implementation example, the embodiment of the present application obtains two groups of GF (2 4 ) and GF((2 2 ) 2 ) respectively, we can integrate the two sets of GF(24 ) and GF((2 2 ) 2 ) respectively, and the second and third mapping relationships, and we get GF((2 4 ) 2 ) and GF(((2 2 ) 2 ) 2 ) mapping relationship. For example, through two groups of GF(2 4 ) and GF((2 2 ) 2 ) respectively, and GF((2 4 ) 2 ) decomposes two groups of GF(2 4 ), respectively mapped to GF((2 2 ) 2 ); and then, through GF(2 2 ) and GF((2) 2 ) between the third mapping relationship, GF((2 2 ) 2 ) of the subfield GF(2 2 ) is mapped to GF((2) 2 ), thus constructing a complete set of two GF(2 4 ) to GF(((2 2 ) 2 ) 2 ), in this way, complex operations can be performed on simple domains, thereby reducing the implementation complexity.

[0166] In a further alternative implementation, the original finite field GF((2 4 ) 2 ) may include the S-box of the Camellia algorithm. Of course, the present application embodiment may also support other GF((2 4 ) 2 ) is the S-box of the cryptographic algorithm of the original finite field. Furthermore, the GF of the S-box of different types of cryptographic algorithms ((2 4 ) 2 ) to GF(((2 2 ) 2 ) 2 ) can be different. For ease of understanding, Figure 6B GF((2 4 ) 2 ) to GF(((2 2 ) 2 ) 2 ) of the mapping matrix, such as Figure 6BAs shown, in step S601, GF((2 4 ) 2 ) is an irreducible polynomial.

[0167] Optionally, for operations over a finite field GF((2 4 ) 2 ) of different types of cryptographic algorithms, the irreducible polynomials of the S-boxes are different, which can be obtained by choosing GF((2 4 ) 2 ) to adapt to different types of S-boxes of cryptographic algorithms.

[0168] In step S602, layer-by-layer decomposition is performed.

[0169] In step S603, the coefficients of two second reduction polynomials are selected and optimized.

[0170] Optional, combined Fig. 6A In the form of some of the reduction polynomials illustrated, the embodiments of the present application can select and optimize the coefficients α0, β0, α1 and β1 in the two second reduction polynomials based on the characteristics of the finite field conjugation of the S-box of different types of cryptographic algorithms.

[0171] In step S604, two roots of the second reduced polynomials and a root of the third reduced polynomial are determined.

[0172] In step S605, determine GF((2 4 ) 2 ) and GF(((2 2 ) 2 ) 2 ) is the mapping matrix.

[0173] The relevant contents of step S604 and step S605 can refer to the description of the corresponding parts in the previous text. 4 ) 2 ) may have different irreducible polynomials. The coefficients of the S-boxes of different cryptographic algorithms in the two second reduction polynomials may be different. Therefore, the roots of the two second reduction polynomials and the roots of the third reduction polynomial may be different. Therefore, the GF((2 4 ) 2 ) to GF(((2 2 ) 2 ) 2 ) may be different; thus, for the mapping matrix acting on GF((2 4 ) 2) of different types of cryptographic algorithms, the present application embodiment can respectively determine GF((2 4 ) 2 ) to GF(((2 2 ) 2 ) 2 ) mapping matrix, and obtain the GF((2 4 ) 2 ) to GF(((2 2 ) 2 ) 2 ) is the mapping matrix.

[0174] For example, using the original finite field GF((2 4 ) 2 )'s Camellia S-box and other cryptographic algorithms' S-boxes as examples, then the GF of the Camellia algorithm's S-box ((2 4 ) 2 ) to GF(((2 2 ) 2 ) 2 ) can be set as M Cam , GF of S-box of other cryptographic algorithms ((2 4 ) 2 ) to GF(((2 2 ) 2 ) 2 ) can be set as M other2 .

[0175] It can be seen from the above examples that when determining the mapping relationship (e.g., mapping matrix) between any original finite field and the target composite field, the embodiment of the present application can perform direct sub-field decomposition layer by layer based on the original finite field until it is decomposed into a binary finite field to obtain a multi-layer finite field; then, according to the roots of the reduced polynomials of the multi-layer finite field, determine the mapping relationship between the original finite field and the target composite field. Furthermore, the functional relationship of the roots of the reduced polynomials of the next finite field can express and transform the elements of the previous finite field and the next finite field, so that the mapping relationship between the previous finite field and the next finite field can be established according to the roots of the reduced polynomials of the next finite field; for example, the functional relationship of the roots of the reduced polynomials of the next finite field can be used to represent the normal basis of the elements of the previous finite field, so as to perform the conversion from the polynomial basis to the normal basis, and then, without increasing the hardware overhead, the characteristics of the normal basis can be used to simplify the operation and the corresponding circuit structure.

[0176] Furthermore, based on the different computational requirements of S-boxes and affine transformations of different types of cryptographic algorithms, even if the S-boxes and affine transformations of different types of cryptographic algorithms use the same original finite field, the mapping relationship to the target composite field may be different. In other words, for any original finite field, the S-boxes or affine transformations of different types of cryptographic algorithms have different mapping relationships between the original finite field and the target composite field.

[0177] Specifically, the irreducible polynomials of the original finite fields of the S-boxes and affine transformations of different types of cryptographic algorithms may be different, and / or the coefficient adjustments of the reduction polynomials may be different, which makes the mapping relationship between the S-boxes or affine transformations of different types of cryptographic algorithms in the same original finite field and the target composite field different; wherein, for any type of S-box or affine transformation of a cryptographic algorithm, the coefficients in the reduction polynomial may be adjusted based on the conjugate properties of the original finite field of the S-box or affine transformation of the cryptographic algorithm.

[0178] Similarly, the embodiments of the present application can set the inverse mapping relationship between each original finite field and the target composite field (mapping from the target composite field back to the original finite field), for example, the inverse mapping matrix of each original finite field and the target composite field. It should be noted that the mapping relationship (such as a mapping matrix) is to map the original finite field to the target composite field, and the inverse mapping relationship (such as an inverse mapping matrix) is to map the target composite field back to the original finite field. Therefore, the mapping directions of the mapping relationship (such as a mapping matrix) and the inverse mapping relationship (such as an inverse mapping matrix) are opposite. Therefore, after obtaining the mapping relationship (such as a mapping matrix) between the original finite field and the target composite field, the embodiments of the present application can correspondingly obtain the inverse mapping relationship (such as an inverse mapping matrix) between the original finite field and the target composite field with opposite mapping directions.

[0179] For example, using GF(2 8 )'s AES algorithm S-box, SM4 algorithm S-box, affine transformation of GFNI instruction, and S-box of other cryptographic algorithms are taken as examples. The GF(((2 2 ) 2 ) 2 ) to GF(2 8 ) can be set as M aes -1 , GF of the S-box of the SM4 algorithm (((2 2 ) 2 ) 2 ) to GF(2 8 ) can be set as M sm4 -1 GFNI instruction affine transformation GF(((2 2 ) 2 ) 2 ) to GF(28 ) can be set as M GFNI -1 , GF of S-box of other cryptographic algorithms (((2 2 ) 2 ) 2 ) to GF(2 8 ) can be set as M other1 -1 . Using GF((2 4 ) 2 )'s Camellia S-box and other cryptographic algorithms' S-boxes as examples, then the GF of the Camellia algorithm's S-box is (((2 2 ) 2 ) 2 ) to GF((2 4 ) 2 ) can be set as M Cam -1 , GF of S-box of other cryptographic algorithms (((2 2 ) 2 ) 2 ) to GF((2 4 ) 2 ) can be set as M other2 -1 In an optional implementation example, M GFNI -1 Can be equal to M aes -1 , so that in some embodiments, M GFNI -1 It can be directly expressed as M aes -1 .

[0180] In an alternative implementation, for using GF(2 8 ), the S-box of the AES algorithm, the S-box of the SM4 algorithm, the affine transformation, and the S-box of other cryptographic algorithms, the transformed input data (such as the S-box input data or the affine transformation input data) can be obtained by the corresponding mapping matrix M aes 、M sm4 、M GFNI , or M other1 , from GF(2 8 ) is mapped to GF(((2 2 ) 2 ) 2 ) is a normal basis, and then in GF(((2 2 ) 2 ) 2) to obtain the transformation output data of the normal basis (such as the S-box output data of the normal basis or the affine transformation output data); the transformation output data of the normal basis is then transformed through the corresponding inverse mapping matrix M aes -1 、M sm4 -1 、M GFNI -1 , or M other1 -1 , from GF(((2 2 ) 2 ) 2 ) is mapped back to GF(2 8 ) is a polynomial basis of .

[0181] In an alternative implementation, for using GF((2 4 ) 2 ) of Camellia's S-box and other cryptographic algorithms' S-boxes, the transformed input data (e.g., S-box input data) can be obtained by the corresponding mapping matrix M Cam , or M other2 , from GF((2 4 ) 2 ) is mapped to GF(((2 2 ) 2 ) 2 ) is a normal basis, and then in GF(((2 2 ) 2 ) 2 ) to obtain the transformed output data of the normal basis (such as the S-box output data of the normal basis); the transformed output data of the normal basis is then transformed through the corresponding inverse mapping matrix M Cam -1 , or M other2 -1 , from GF(((2 2 ) 2 ) 2 ) is mapped back to GF((2 4 ) 2 ) is a polynomial basis of .

[0182] In an optional implementation, the operation performed in the target composite domain may be a multiplication inversion operation. In a further optional implementation, the S-box or affine transformation of different types of cryptographic algorithms may perform other operations before or after the multiplication inversion operation. For example, the positive S-box of the AES algorithm may perform matrix multiplication and vector addition operations after the multiplication inversion operation; the inverse S-box of the AES algorithm may perform vector addition and matrix multiplication operations before the multiplication inversion operation; the S-box of the SM4 algorithm may perform matrix multiplication and vector addition operations before and after the multiplication inversion operation. The other operations performed by the S-box or affine transformation of different types of cryptographic algorithms before or after the multiplication inversion operation may be reflected in the expression of the polynomial basis of the S-box or affine transformation of each type of cryptographic algorithm; for example, the following Table 1 shows the expressions of the S-box or affine transformation of different types of cryptographic algorithms, which may be used for reference.

[0183]

[0184]

[0185] Table 1

[0186] In Table 1, x is the input, A aes is the box matrix of the positive S-box of the AES algorithm, used for linear transformation processing, c aes A is the vector of the S-box of the AES algorithm; aes -1 is the box matrix of the inverse S-box of the AES algorithm; A sm4 is the box matrix of the S-box of the SM4 algorithm, c sm4 A is the vector of the S-box of the SM4 algorithm; gfni The affine transformation matrix of the cryptographic algorithm acceleration instructions such as the GFNI instruction is used to perform affine transformation (affine forward transformation or affine inverse transformation); c gfni A is the vector of affine transformation of cryptographic algorithm acceleration instructions such as GFNI instructions; 0i is the box matrix of the S-box of other cryptographic algorithms, which performs a linear transformation on the input x; c 0i A is the vector of S-boxes of other cryptographic algorithms, used to add offsets; 00 is the affine transformation matrix of other cryptographic algorithms, and the result after the inverse operation is linearly transformed again; c 00 A vector of affine transformation of other cryptographic algorithms, used to add an offset to the result.

[0187] It should be noted that the S-box can be divided into a positive S-box and an inverse S-box. The data processing scheme provided in the embodiment of the present application is applicable to the process in which the cryptographic algorithm uses the positive S-box for data processing, and is also applicable to the process in which the cryptographic algorithm uses the inverse S-box for data processing. For example, the positive S-box is an S-box used in the encryption process of the cryptographic algorithm, which is used to replace each byte in the plaintext data block with another byte to increase nonlinearity and encryption strength. The inverse S-box is used in the decryption process of the cryptographic algorithm, and its function is to reverse the operation of the positive S-box. If the positive S-box is used to convert data during encryption, the corresponding inverse S-box can be used to restore the data during decryption. Thus, the positive S-box of the AES algorithm in Table 1 is used for encryption, and the inverse S-box of the AES algorithm is the inverse process of the positive S-box of the AES algorithm, which is used for decryption. In an optional implementation, the S-box of the SM4 algorithm may not distinguish between the positive S-box and the inverse S-box. For example, the decryption of the SM4 algorithm uses the same S-box as the encryption, but is executed in steps that are in reverse order to the encryption process.

[0188] It should be further explained that affine transformation can be divided into affine forward transformation and affine inverse transformation, among which affine transformation can be used in the encryption process of the cryptographic algorithm; affine inverse transformation is the inverse process of affine forward transformation, for example, it is used to restore data processed by affine forward transformation during the decryption process to facilitate the recovery of decrypted plaintext. As an optional implementation, the data processing scheme provided in the embodiment of the present application can be applied to the process in which cryptographic algorithm acceleration instructions such as GFNI use affine inverse transformation for data processing. Of course, the affine forward transformation process of the cryptographic algorithm acceleration instructions of the embodiment of the present application is also applicable to the embodiment of the present application.

[0189] From the above description, it can be concluded that the input finite element x acting on the original finite field can obtain the transformed output data of the original finite field through the mapping matrix, the operation under the target composite domain, and the inverse mapping matrix. Taking the multiplication inversion operation as an example, after the input finite element x is mapped to the target composite domain and the inversion operation is performed, the multiplication inverse element of the original finite field can be obtained through the inverse mapping matrix. i The result of mapping the input finite element x of the original finite domain to the target composite domain is obtained by inverse operation (Y i ) -1 The multiplicative inverse of the input finite element x can be expressed as: M·(Y i ) -1 ·M -1 , where Y0=(Y i ) -1 , M is the mapping matrix from the original finite field to the target composite field, M -1 is the inverse mapping matrix from the target composite field to the original finite field. The S-box or affine transformation of different types of cryptographic algorithms has their own mapping matrix and inverse mapping matrix.

[0190] Furthermore, in combination with the above-mentioned representation of the multiplication inverse element and the expressions of the S-box or affine transformation of different types of cryptographic algorithms shown in Table 1, the embodiment of the present application can divide the processing process of transforming the input data into three parts: pre-inversion operation, multiplication inversion operation and post-inversion operation. For example, the expression of the three-part operation can be shown in Table 2 below, which can be used for reference.

[0191]

[0192] Table 2

[0193] It can be seen that mapping the input transformed data from the original finite field to the target composite field can be located in the pre-inversion operation, so that the embodiment of the present application can map the input transformed data from the original finite field of the data obfuscation transformation to the target composite field in the pre-inversion operation. Optionally, in the pre-inversion operation, the embodiment of the present application can use the input mapping transformation matrix to perform a matrix multiplication operation with the transformed input data of the original finite field to obtain an input matrix multiplication operation result, wherein the input mapping transformation matrix at least includes a mapping matrix; thereby, at least based on the input matrix multiplication operation result, the transformed input data mapped to the target composite field is obtained.

[0194] In an optional implementation example, as shown in Table 2, in the pre-inversion operation, the input mapping transformation matrix corresponding to the S-box or affine transformation of the encryption algorithm can be used to perform a matrix multiplication operation with the input element x (i.e., the transformed input data of the original finite field), and the input mapping transformation matrix at least includes a mapping matrix (e.g., M aes 、M sm4 、M GFNI 、M other ); further, if the S-box operation of the cryptographic algorithm is performed, and the box matrix of the S-box participates in the pre-inversion operation, the input mapping transformation matrix may also include the box matrix of the S-box (e.g., A aes , A sm4 , A 0i ), so when the box matrix of the S-box and the mapping matrix are used simultaneously, the input mapping transformation matrix can be the product of the box matrix of the S-box and the mapping matrix (for example, M aes ·A aes -1 、M sm4 ·A sm4 、M other ·A 0i ), accordingly, an example of performing a matrix multiplication operation on the input mapping transformation matrix and the input element x can be referred to as shown in Table 2; for ease of explanation, the result of the matrix multiplication operation on the input mapping transformation matrix and the input element x can be referred to as the input matrix multiplication operation result (e.g., M aes x, M aes ·A aes-1 x, M GFNI x, M sm4 ·A sm4 x, M other ·A 0i ·x).

[0195] Based on this, in an optional implementation, an embodiment of the present application may preset multiple input mapping transformation matrices, which may include input mapping transformation matrices of S-boxes or affine transformations of various types of cryptographic algorithms; thus, in the pre-inversion operation, the embodiment of the present application may select a corresponding input mapping transformation matrix from multiple input mapping transformation matrices based on the current cryptographic algorithm or the current affine transformation; further, in the pre-inversion operation, the input mapping transformation matrix is ​​used to perform a matrix multiplication operation with the transformed input data of the original finite field to obtain the input matrix multiplication operation result.

[0196] Furthermore, if the vector of the S-box (e.g. c aes 、c sm4 、c 0i ) participates in the pre-inversion operation, then the input matrix multiplication result can also be combined with the input mapping transformation vector (for example, M aes ·A aes -1 ·c aes 、M sm4 ·c sm4 、M other ·c 0i ) performs vector addition operation to complete the inverse operation and obtain the transformed input data mapped to the target composite domain, that is, Y i The input mapping transformation vector may be the multiplication result of the vector of the S-box and the mapping matrix and / or the box matrix; the input mapping transformation vector may be added to the input mapping transformation matrix, and the vector addition operation of the input matrix multiplication operation result and the input mapping transformation vector may refer to the example in Table 2, and the result may be the transformed input data mapped to the target composite domain, i.e., Y i .

[0197] Based on this, in an optional implementation, an embodiment of the present application can preset multiple input mapping transformation vectors, and the multiple input mapping transformation vectors may include input mapping transformation vectors of S-boxes or affine transformations of various types of cryptographic algorithms; thus, in the pre-inversion operation, if the vector of the S-box participates in the pre-inversion operation, the corresponding input mapping transformation vector can be selected from the multiple input mapping transformation vectors based on the current cryptographic algorithm or the current affine transformation, and the input mapping transformation vector is the multiplication result of the vector of the S-box and the mapping matrix and / or the box matrix; then, the input matrix multiplication result is vector-added with the input mapping transformation vector to complete the pre-inversion operation and obtain the transformed input data mapped to the target composite domain.

[0198] The operation on the transformed input data mapped to the target composite domain can be located in a multiplicative inverse operation, in which Y i Perform a unified multiplication inversion operation, that is, (Y i ) -1 , and we get the inverse result of multiplication, which is Y0.

[0199] Mapping the transformed output data from the target composite domain back to the original finite domain may be located in a post-inversion operation, so that in the post-inversion operation, the embodiment of the present application may use the output mapping transformation matrix and the multiplication inversion result to perform a matrix multiplication operation to obtain an output matrix multiplication operation result, wherein the output mapping transformation matrix at least includes an inverse mapping matrix; and further, based at least on the output matrix multiplication operation result, the transformed output data mapped back to the original finite domain is obtained.

[0200] In an optional implementation example, as shown in Table 2, in the post-inversion operation, the output mapping transformation matrix corresponding to the S-box or affine transformation of the encryption algorithm can be used to perform a matrix multiplication operation with the multiplication inversion result (i.e., Y0), and the output mapping transformation matrix can at least include an inverse mapping matrix (e.g., M aes -1 、M GFNI -1 、M sm4 -1 、M other -1 ); further, if the S-box operation or affine transformation of the cryptographic algorithm is performed, and the box matrix or affine transformation matrix of the S-box participates in the inversion operation, the output mapping transformation matrix may also include the box matrix or affine transformation matrix of the S-box (e.g., A aes , A gfni , A sm4i , A gfni , A 00 ), so that when the inverse mapping matrix and the box matrix of the S-box or the affine transformation matrix are used simultaneously, the output mapping transformation matrix can be the product of the inverse mapping matrix and the box matrix of the S-box or the affine transformation matrix (for example, A aes ·M aes -1 , A gfni ·M GFNI -1 , A sm4 ·M sm4 -1 , A 00 ·M other -1); Accordingly, an example of performing a matrix multiplication operation on the output mapping transformation matrix and the inverse multiplication result (ie, Y0) can be referred to as shown in Table 2; for ease of explanation, the result of performing a matrix multiplication operation on the output mapping transformation matrix and the inverse multiplication result can be referred to as the output matrix multiplication operation result (eg, A aes ·M aes -1 ·Y0, M aes -1 ·Y0, A gfni ·M GFNI -1 ·Y0, A sm4 ·M sm4 -1 ·Y0, A 00 ·M other -1 ·Y0).

[0201] Based on this, in an optional implementation, the embodiment of the present application can preset multiple output mapping transformation matrices, and the multiple output mapping transformation matrices may include output mapping transformation matrices of S-boxes or affine transformations of various types of cryptographic algorithms; thus, in the post-inversion operation, the embodiment of the present application selects a corresponding output mapping transformation matrix from multiple output mapping transformation matrices based on the current cryptographic algorithm or the current affine transformation; then, the output mapping transformation matrix and the multiplication inversion result are used to perform a matrix multiplication operation to obtain an output matrix multiplication operation result; at least based on the output matrix multiplication operation result, the transformed output data mapped back to the original finite field is obtained.

[0202] Furthermore, if the vector of the S-box or the vector of the affine transformation (e.g. c aes 、c gfni 、c sm4 、c 00 ) participates in the inversion operation, the output matrix multiplication result can also be combined with the output mapping transformation vector (for example, c aes 、c gfni , A sm4 ·c sm4 , A 00 ·c 00 ) performs a vector addition operation to obtain the transformed output data mapped back to the original finite field. The output mapping transformation vector may be a vector (a vector of an S-box or a vector of an affine transformation), or a multiplication result of a vector (a vector of an S-box or a vector of an affine transformation) and a box matrix of an S-box or an affine transformation matrix; the vector addition operation of the output matrix multiplication operation result and the output mapping transformation vector may refer to the example in Table 2, and the result may be the transformed output data mapped back to the original finite field.

[0203] Based on this, in an optional implementation, an embodiment of the present application can preset multiple output mapping transformation vectors, and the multiple output mapping transformation vectors may include output mapping transformation vectors of S-boxes or affine transformations of multiple types of cryptographic algorithms; thus, in the post-inversion operation, if the vector of the S-box or the vector of the affine transformation participates in the post-inversion operation, the corresponding output mapping transformation vector can be selected from the multiple output mapping transformation vectors based on the current cryptographic algorithm or the current affine transformation; the output mapping transformation vector is a vector (a vector of the S-box or a vector of the affine transformation), or a multiplication result of a vector (a vector of the S-box or a vector of the affine transformation) and a box matrix of the S-box or an affine transformation matrix; then, a vector addition operation is performed on the output matrix multiplication result and the output mapping transformation vector to complete the post-inversion operation and obtain the transformed output data mapped back to the original finite field.

[0204] The S-boxes and affine transformations of different types of cryptographic algorithms use different input mapping transformation matrices and input mapping transformation vectors in the pre-inversion operation, and use different output mapping transformation matrices and output mapping transformation vectors in the post-inversion operation. For example, the S-boxes and affine transformations of different types of cryptographic algorithms may use different mapping matrices, S-box box matrices, affine transformation matrices, inverse mapping matrices, S-box vectors, affine transformation vectors, etc. in the pre-inversion operation and post-inversion operation. Thus, in an optional implementation, the embodiment of the present application can select the input mapping transformation matrix and input mapping transformation vector used by the S-box and affine transformation of each type of cryptographic algorithm before the inversion operation, and the output mapping transformation matrix and output mapping transformation vector used after the inversion operation through a multiplexer in the circuit (specific examples of selected matrices and vectors can be shown in Table 2); further, after selecting the matrix and vector, the S-box and affine transformation of different types of cryptographic algorithms can reuse the logic of matrix multiplication operations and vector addition operations, and implement the matrix multiplication operations and vector addition operations required by the S-box and affine transformation of different types of cryptographic algorithms before and after the inversion operation, so as to realize the reuse of the operation logic, thereby simplifying the circuit structure. Furthermore, in the multiplication inversion operation, the S-box and affine transformation of different types of cryptographic algorithms can realize the Y mapped to the target composite domain. i A unified multiplication inversion operation is performed, so that the logic of the multiplication inversion operation can be reused and the circuit structure can be simplified.

[0205] It should be further explained that the A in the affine transformation (affine forward transformation or affine inverse transformation) of the GFNI instruction gfni (affine transformation matrix), c gfni (Affine transformation vectors) are all in variable form, so when performing the affine inverse transformation of Table 2, A gfni ·M GFNI -1 When calculating Y0, A gfni ·MGFNI -1 It cannot be calculated in advance, so an additional matrix multiplication unit (such as a matrix multiplier) can be used to perform A gfni ·M GFNI -1 Matrix multiplication processing; further, to simplify the design, M GFNI -1 Can be calculated with Y0 and then with A gfni Perform matrix multiplication. For example, in the calculation of A gfni ·M GFNI -1 When Y0, first change M GFNI -1 can be calculated with Y0 and then with A through an additional matrix multiplication unit (such as a matrix multiplier) gfni Perform matrix multiplication.

[0206] Furthermore, the affine forward transformation of the GFNI instruction may only perform the post-inversion operation, skipping the pre-inversion operation and the multiplication inversion operation (such as shown in the example of Table 2). Therefore, in an optional implementation, for the affine forward transformation of the GFNI instruction, the embodiment of the present application may set an additional multiplexer in the circuit to help the affine forward transformation of the GFNI instruction skip the pre-inversion operation and the multiplication inversion operation.

[0207] As an optional implementation, Figure 7 The following is an exemplary diagram showing an example of a data processing device provided by an embodiment of the present application. The contents of the data processing device and circuit structure described below can be referred to in correspondence with the contents described above. Figure 7 As shown, the data processing device may include:

[0208] An input data acquisition module 710 is used to acquire input data of a cryptographic algorithm, wherein the cryptographic algorithm is any one of a plurality of cryptographic algorithms;

[0209] A transformation input data determination module 720, used to determine the intermediate data of the cryptographic algorithm according to the input data as the transformation input data of the data obfuscation transformation;

[0210] A mapping module 730 is used to map the transformed input data from the original finite field of the data obfuscation transformation to a target composite field, where the target composite field is a composite field with a binary finite field as a subfield and a multi-level nested expansion; wherein the original finite field of the data obfuscation transformation is any original finite field among the multiple original finite fields;

[0211] The operation module 740 is used to operate the transformed input data mapped to the target composite domain in the target composite domain to obtain transformed output data;

[0212] The output data determination module 750 is used to determine the output data of the cryptographic algorithm according to the transformed output data.

[0213] In an optional implementation, the mapping module 730, for mapping the transformed input data from the original finite field of the data obfuscation transform to the target composite field, comprises:

[0214] From multiple mapping relationships, a mapping relationship between an original finite field of data obfuscation transformation and a target composite field is selected; according to the mapping relationship between the original finite field of data obfuscation transformation and the target composite field, the transformed input data is mapped from the original finite field of data obfuscation transformation to the target composite field.

[0215] Optionally, the embodiment of the present application can set the mapping relationship between each original finite field and the target composite field, so as to obtain multiple mapping relationships. In an optional implementation example, the mapping relationship can be a mapping matrix. Further, the data obfuscation transformation can include an S-box operation of a cryptographic algorithm or an affine transformation of a cryptographic algorithm acceleration instruction, and the mapping matrices of the S-box or affine transformation of different types of cryptographic algorithms are different. The relevant content of setting the mapping relationship (such as a mapping matrix) can refer to the description of the corresponding part of the previous text, which will not be expanded here.

[0216] In an optional implementation, further Figure 7 As shown, the output data determination module 750 may include:

[0217] The inverse mapping module 751 is used to select the inverse mapping relationship between the original finite field of the data obfuscation transformation and the target composite field from multiple inverse mapping relationships; according to the inverse mapping relationship between the original finite field of the data obfuscation transformation and the target composite field, map the transformed output data from the target composite field back to the original finite field of the data obfuscation transformation;

[0218] The output determination module 752 is used to determine the output data of the cryptographic algorithm according to the transformed output data of the original finite field.

[0219] In an optional implementation example, the inverse mapping relationship may be an inverse mapping matrix, and the mapping directions of the mapping matrix and the inverse mapping matrix are opposite; different types of cryptographic algorithms have different inverse mapping matrices for S-boxes or affine transformations.

[0220] The optional implementation functions and further functions of the above modules can refer to the description of the corresponding parts of the previous text. The following mainly introduces the circuit implementation of the mapping module 730, the operation module 740 and the inverse mapping module 751 from the perspective of circuit implementation.

[0221] As an optional implementation, based on the three-part processing of pre-inversion operation, multiplication inversion operation and post-inversion operation, Figure 8 An exemplary diagram showing a circuit implementation of a data processing device provided in an embodiment of the present application is shown. Figure 7 and Figure 8 As shown, the mapping module 730 may include at least: an input mapping generation circuit 810 , a first multiplexer 811 , and a first matrix multiplier 812 .

[0222] The input mapping generation circuit 810 is used to provide at least a plurality of input mapping transformation matrices, wherein the plurality of input mapping transformation matrices include input mapping transformation matrices of S-box or affine transformation of various types of cryptographic algorithms.

[0223] In an optional implementation, the input mapping transformation matrix may include at least a mapping matrix; further, the input mapping transformation matrix may also include a box matrix of an S-box. For example, the input mapping transformation matrix may include a mapping matrix, or a mapping matrix and a box matrix of an S-box.

[0224] Example, combined Figure 8 As shown, the multiple input mapping transformation matrices provided by the input mapping generation circuit 810 may include:

[0225] The input mapping transformation matrix M of the positive S-box of the AES algorithm (used in the encryption process of the AES algorithm) aes , expressed as the mapping matrix M aes ;

[0226] The input mapping transformation matrix M of the affine transformation of the GFNI instruction GFNI , expressed as the mapping matrix M GFNI ; For example, if M GFNI Using M aes If it is implemented, you do not need to set M GFNI , this case applies to the mapping matrix M of the S-box of the AES algorithm aes And the mapping matrix M of the affine transformation GFNI The same situation; of course, the embodiment of the present application can also support the mapping matrix M of the S box of the AES algorithm aes Different from the mapping matrix M of the affine transformation GFNI ;

[0227] The input mapping transformation matrix M of the inverse S-box of the AES algorithm (used in the decryption process of the AES algorithm) aes A aes -1 , expressed as the mapping matrix M aes The box matrix A with the inverse S-box aes -1 The product of

[0228] The input mapping transformation matrix M of the S-box of the SM4 algorithm (used for the encryption and decryption process of the SM4 algorithm) sm4 A sm4 , expressed as the mapping matrix M sm4With the box matrix A sm4 The product of

[0229] The input mapping transformation matrix M of the S-box of other types of cryptographic algorithms other A 0i .

[0230] The first multiplexer 811 is used to select an input mapping transformation matrix from a plurality of input mapping transformation matrices provided by the input mapping generation circuit 810. For example, the first multiplexer 820 may select a corresponding input mapping transformation matrix from a plurality of input mapping transformation matrices provided by the input mapping generation circuit 810 based on a current cryptographic algorithm or a current affine transformation.

[0231] The first matrix multiplier 812 is used to map the input transformation matrix selected by the first multiplexer to the transformation input data ( Figure 8 x), perform matrix multiplication operation to obtain the input matrix multiplication operation result.

[0232] In an alternative implementation, the input matrix multiplication results may be used to form transformed input data that is mapped to the target composite domain.

[0233] In a further optional implementation, in combination with Figure 8 As shown, the mapping module 730 may further include: a second multiplexer 813 and a first adder 814 .

[0234] Thus, the input mapping generation circuit 810 may also be used to provide a plurality of input mapping transformation vectors, including input mapping transformation vectors of S-boxes or affine transformations of various types of cryptographic algorithms.

[0235] In an optional implementation example, if the vector of the S-box participates in the pre-inversion operation, the input matrix multiplication result can be vector-added with the input mapping transformation vector to complete the pre-inversion operation. Optionally, the input mapping transformation vector can be the vector of the S-box, the multiplication result of the mapping matrix and / or the box matrix. For example, combined with Figure 8 As shown, the multiple input mapping transformation vectors provided by the input mapping generation circuit 810 may include:

[0236] The input mapping transformation vector M of the inverse S-box of the AES algorithm (used in the decryption process of the AES algorithm) aes ·A aes -1 ·c aes , which is the vector c of the inverse S-box aes , mapping matrix M aes , and the box matrix A of the inverse S-box aes -1 The product of

[0237] The input mapping transformation vector M of the S-box of the SM4 algorithm (used in the encryption and decryption process of the SM4 algorithm) sm4 ·c sm4 , represented as the vector c of the S-box sm4 With the mapping matrix M sm4 The product of

[0238] The input mapping transformation vector M of the S-box of other types of cryptographic algorithms other ·c 0i .

[0239] The second multiplexer 813 is used to select an input mapping transformation vector from a plurality of input mapping transformation vectors provided by the input mapping generation circuit 810. For example, the second multiplexer 813 may select a corresponding input mapping transformation vector from a plurality of input mapping transformation vectors provided by the input mapping generation circuit 810 based on a current cryptographic algorithm or a current affine transformation.

[0240] The first adder 814 is used to perform a vector addition operation on the input matrix multiplication result obtained by the first matrix multiplier 812 and the input mapping transformation vector selected by the second multiplexer 813 to obtain the transformed input data mapped to the target composite domain.

[0241] In a further optional implementation, in combination with Figure 8 As shown, the operation module 740 may include: a multiplication inversion unit 820, which is used to perform a unified multiplication inversion operation on the transformed input data mapped to the target composite domain to obtain a multiplication inversion result as the transformed output data. Figure 8 Shown Y i -1 , where Y0=Y i -1

[0242] Combination Figure 7 and Figure 8 As shown, the inverse mapping module 751 may include at least: an output mapping generation circuit 830 , a third multiplexer 831 , and a second matrix multiplier 832 .

[0243] The output mapping generation circuit 830 is used to provide at least a plurality of output mapping transformation matrices, wherein the plurality of output mapping transformation matrices include output mapping transformation matrices of S-box or affine transformation of various types of cryptographic algorithms.

[0244] In an optional implementation, the output mapping transformation matrix may include at least an inverse mapping matrix; further, the input mapping transformation matrix may also include a box matrix or an affine transformation matrix of an S-box. For example, the output mapping transformation matrix may include: an inverse mapping matrix, or an inverse mapping matrix and a box matrix or an affine transformation matrix of an S-box.

[0245] Example, combined Figure 8 As shown, the multiple output mapping transformation matrices provided by the output mapping generation circuit 830 may include:

[0246] The output mapping transformation matrix A of the positive S-box of the AES algorithm aes M aes -1 , represented as the box matrix A of the positive S-box aes and the inverse mapping matrix M aes -1 The product of

[0247] The output mapping transformation matrix M of the inverse S-box of the AES algorithm aes -1 , expressed as the inverse mapping matrix M aes -1 ;

[0248] The output mapping transformation matrix A of the S-box of the SM4 algorithm sm4 M sm4 -1 , expressed as a box matrix A sm4 is the inverse mapping matrix M sm4 -1 The product of

[0249] The output mapping transformation matrix A of the S-box of other types of cryptographic algorithms 00 ·M other -1 .

[0250] The third multiplexer 831 is used to select an output mapping transformation matrix from a plurality of output mapping transformation matrices provided by the output mapping generation circuit 830. For example, the third multiplexer 831 may select a corresponding output mapping transformation matrix from a plurality of output mapping transformation matrices provided by the output mapping generation circuit 830 based on a current cryptographic algorithm or a current affine transformation.

[0251] The second matrix multiplier 832 is used to perform a matrix multiplication operation on the output mapping transformation matrix selected by the third multiplexer 831 and the multiplication inversion result of the multiplication inversion unit 820 to obtain an output matrix multiplication operation result.

[0252] In an alternative implementation, the output matrix multiplication operation result may be used to form transformed output data that is mapped back to the original finite field.

[0253] In a further optional implementation, in combination with Figure 8 As shown, the inverse mapping module 751 may further include: a fourth multiplexer 833 and a second adder 834 .

[0254] Thus, the output mapping generation circuit 830 can also be used to provide multiple output mapping transformation vectors, wherein the multiple output mapping transformation vectors include output mapping transformation vectors of S-box or affine transformation of multiple types of cryptographic algorithms.

[0255] In an optional implementation example, if the vector of the S-box or the vector of the affine transformation participates in the post-inversion operation, the output matrix multiplication result can be vector-added with the output mapping transformation vector to complete the post-inversion operation. Optionally, the output mapping transformation vector can be the vector of the S-box or the vector of the affine transformation, or the multiplication result of the vector and the box matrix of the S-box or the affine transformation matrix. For example, combined with Figure 8 As shown, the multiple output mapping transformation vectors provided by the output mapping generation circuit 830 may include:

[0256] The output mapping transformation vector c of the positive S-box of the AES algorithm aes , represented as the vector c of the S-box aes ;

[0257] The output of the affine inverse transformation of the GFNI instruction maps the transformation vector c gfni , which represents the affine transformation vector c gfni ;

[0258] The output mapping transformation vector A of the S-box of the SM4 algorithm sm4 c sm4 , expressed as a box matrix A sm4 Vector c with S-box sm4 The product of

[0259] The output mapping transformation vector A of the S-box of other types of cryptographic algorithms 00 c 00 .

[0260] The fourth multiplexer 833 is used to select an output mapping transformation vector from the multiple output mapping transformation vectors provided by the output mapping generation circuit 830. For example, the fourth multiplexer 833 can select a corresponding output mapping transformation vector from the multiple output mapping transformation vectors provided by the output mapping generation circuit 830 based on the current cryptographic algorithm or the current affine transformation.

[0261] The second adder 834 is used to perform a vector addition operation on the output matrix multiplication result obtained by the second matrix multiplier 832 and the output mapping transformation vector selected by the fourth multiplexer 833 to obtain the transformation output data mapped back to the original finite field.

[0262] In a further optional implementation, since A in the affine transformation (affine inverse transformation or affine forward transformation) gfni and c gfni In variable form, so when calculating Agfni ·M GFNI -1 When Y0, you can first GFNI -1 Calculated with Y0, and then with A through an additional matrix multiplication unit gfni Perform matrix multiplication. Based on this, in an optional implementation, combined with Figure 8 As shown, for the affine inverse transformation of the cryptographic algorithm acceleration instruction such as the GFNI instruction, the output mapping generation circuit 830 may not directly provide the corresponding output mapping transformation matrix (ie, A gfni ·M GFNI -1 ), but rather provides an affine transformation matrix A used to form the output mapping transformation matrix gfni , and the inverse mapping matrix M GFNI -1 .

[0263] Therefore, in a further optional implementation, the inverse mapping module 751 provided in the embodiment of the present application may further be provided with an additional third matrix multiplier 835 and a fifth multiplexer 836;

[0264] The third matrix multiplier 835 is used to convert the inverse mapping matrix M of the affine transformation into GFNI -1 A matrix multiplication operation is performed with the inverse multiplication result of the inverse multiplication unit 820 , and the result is introduced into the fifth multiplexer 836 .

[0265] Further, the inverse multiplication result of the inverse multiplication unit 820 can also be introduced into the fifth multiplexer 836. Thus, the fifth multiplexer 836 is used to select the result obtained by the third matrix multiplier 835 or the inverse multiplication result of the inverse multiplication unit 820, and introduce the selected result into the second matrix multiplier 832.

[0266] As an optional implementation, under the S-box operation of the cryptographic algorithm, the fifth multiplexer 836 selects the multiplication inversion result of the multiplication inversion unit 820 and imports it into the second matrix multiplier 832; under the affine inverse transformation, the fifth multiplexer 836 selects the result obtained by the third matrix multiplier 835 and imports it into the second matrix multiplier 832.

[0267] Furthermore, under the S-box operation of the cryptographic algorithm, the multiplication inversion result of the multiplication inversion unit 820 selected by the fifth multiplexer 836 can be used to perform a matrix multiplication operation on the output mapping transformation matrix corresponding to the current cryptographic algorithm selected by the second matrix multiplier 832 and the third multiplexer 831 to obtain the output matrix multiplication operation result corresponding to the S-box operation of the current cryptographic algorithm.

[0268] Under the affine inverse transformation, the third multiplexer 831 can select the affine transformation matrix A gfni and provided to the second matrix multiplier 832; thus, under the affine inverse transformation, the result obtained by the third matrix multiplier 835 selected by the fifth multiplexer 836 can be obtained by combining the affine transformation matrix A selected by the second matrix multiplier 832 and the third multiplexer 831 gfni Perform matrix multiplication to obtain the corresponding output matrix multiplication result A under the affine inverse transformation gfni ·M GFNI -1 ·Y0.

[0269] Through the above-mentioned manner, the embodiment of the present application can obtain the corresponding output matrix multiplication operation result under the S-box operation of various types of cryptographic algorithms, and obtain the corresponding output matrix multiplication operation result under the affine inverse transformation. Furthermore, the output matrix multiplication operation result can be vector-added with the corresponding output mapping transformation vector selected by the fourth multiplexer 833 in the second adder 834, so as to obtain the transformation output data corresponding to the S-box operation of various types of cryptographic algorithms mapped back to the original finite field, and the transformation output data corresponding to the affine inverse transformation mapped back to the original finite field.

[0270] In a further optional implementation, the affine forward transformation of the GFNI instruction only performs the post-inversion operation, skipping the pre-inversion operation and the multiplication inversion operation, so that in the optional implementation, for the affine forward transformation, the fifth multiplexer 836 can select the transformation input data ( Figure 8 x), and imported into the second matrix multiplier 832; at the same time, for the affine forward transformation, the third multiplexer 831 can select the affine transformation matrix A gfni Output, and import into the second matrix multiplier 832; then, under the affine positive transformation, the second matrix multiplier 832 can transform the original finite field input data x and the affine transformation matrix A gfni The matrix multiplication operation is performed so that the result is combined with the affine transformed vector c selected by the fourth multiplexer 833. gfni , a vector addition operation is performed in the second adder 834; that is, under the affine positive transformation, the vector c of the affine transformation selected by the fourth multiplexer 833 gfni , and the result of the second matrix multiplier 832 under the affine forward transformation, can be vector-added in the second adder 834 to obtain A gfni ·Y0+c gfni The corresponding results.

[0271] The data processing device provided in the embodiment of the present application can be applicable to the S-box of any type of cryptographic algorithm and the affine transformation of any cryptographic algorithm acceleration instruction. By reusing the S-boxes and affine transformations of different cryptographic algorithms, it is possible to reduce the circuit area overhead while improving the computing performance, thereby reducing the chip area and cost, thereby reducing resource overhead.

[0272] The data processing device provided in the embodiment of the present application can be implemented as a data processing circuit. In a further optional implementation, the embodiment of the present application provides a processor, which can be configured to execute the data processing method provided in the embodiment of the present application. In an optional implementation, the processor may include the data processing device provided in the embodiment of the present application to implement the data processing method provided in the embodiment of the present application.

[0273] The present application also provides a chip, such as a SOC (System on Chip) chip, which may include a processor provided by the present application, or a data processing device provided by the present application. The present application also provides an electronic device, such as a terminal device or a server device, which may include a chip provided by the present application.

[0274] The above describes multiple embodiments provided by the embodiments of the present application, and each optional method introduced in each embodiment can be combined and cross-referenced with each other without conflict, thereby extending a variety of possible embodiments, which can be considered as embodiments disclosed and disclosed by the embodiments of the present application. Although the embodiments of the present application are disclosed as above, the present application is not limited thereto. Any person skilled in the art can make various changes and modifications without departing from the spirit and scope of the present application, so the scope of protection of the present application should be based on the scope defined by the claims.

Claims

1. A data processing method, characterized in that: include: Obtaining input data of a cryptographic algorithm, wherein the cryptographic algorithm is any one of a plurality of cryptographic algorithms; Determine the intermediate data of the cryptographic algorithm according to the input data as the transformed input data of the data obfuscation transformation; Mapping the transformed input data from the original finite field of the data obfuscation transformation to a target composite field, where the target composite field is a composite field with a binary finite field as a subfield and multi-level nested expansion; wherein the original finite field of the data obfuscation transformation is any original finite field among multiple original finite fields; In the target composite domain, operating the transformed input data mapped to the target composite domain to obtain transformed output data; Based on the transformed output data, output data of the cryptographic algorithm is determined.

2. The method according to claim 1, characterized in that The number of elements of the multiple original finite fields is a set number of elements, and the target composite field is a composite field with a binary finite field as a subfield and the number of elements obtained by multi-level nesting expansion is the set number of elements.

3. The method according to claim 1, characterized in that Also includes: Setting mapping relationships between each original finite field and the target composite field to obtain multiple mapping relationships; Mapping the transformed input data from the original finite field of the data obfuscation transform to the target composite field comprises: Selecting a mapping relationship between an original finite field and a target composite field of the data obfuscation transformation from a plurality of mapping relationships; According to the mapping relationship between the original finite field of the data obfuscation transformation and the target composite field, the transformation input data is mapped from the original finite field of the data obfuscation transformation to the target composite field.

4. The method according to claim 3, characterized in that The step of setting the mapping relationship between each original finite field and the target composite field includes: For any original finite field, direct subfield decomposition is performed layer by layer based on the original finite field until it is decomposed into a binary finite field to obtain a multi-layer finite field; According to the roots of the reduced polynomial of the multi-layer finite field, the mapping relationship between the original finite field and the target composite field is determined.

5. The method according to claim 4, characterized in that The reduction based on multi-layer finite fields The root of the polynomial determines the mapping relationship between the original finite field and the target composite field: According to the root of the reduced polynomial of the next finite field, a mapping relationship between the previous finite field and the next finite field is established, and an inter-layer mapping relationship between the previous finite field and the next finite field is obtained; According to the inter-layer mapping relationship, the mapping relationship between the original finite field and the target composite field is determined.

6. The method according to claim 5, characterized in that The original finite field adopts a polynomial basis, and the target composite field adopts a normal basis; the mapping relationship between the upper finite field and the lower finite field is established according to the root of the reduced polynomial of the lower finite field, and the inter-layer mapping relationship between the upper finite field and the lower finite field is obtained, which includes: The functional relationship of the roots of the reduced polynomial of the next finite field is used to represent the normal basis of the elements of the previous finite field, and the inter-layer mapping relationship between the previous finite field and the next finite field is obtained.

7. The method according to claim 6, characterized in that The original finite field is not a composite field; the direct subfield decomposition based on the original finite field layer by layer until decomposition into a binary finite field includes: Decompose the original finite field into composite fields that are direct subfields of the original finite field; Starting from the composite field of the direct subfield of the original finite field, the direct subfield of the current level finite field is decomposed into the composite field of the next direct subfield at the next level, until the last level finite field is the composite field of the binary finite field.

8. The method according to claim 7, characterized in that The original finite field includes GF(2 8 ), the target composite domain includes GF(((2 2 ) 2 ) 2 ); the composite domain that decomposes the original finite field into direct subdomains of the original finite field includes: GF(2 8 ) is decomposed into GF((2 4 ) 2 ), and determine GF((2 4 ) 2 ) and the roots of the first reduced polynomial; The process of starting from the composite domain of the direct subdomain of the original finite field and decomposing the direct subdomain of the current layer of the finite field into the composite domain of the next direct subdomain at the next layer until the last layer of the finite field is a composite domain of a binary finite field includes: GF(2 4 ) is decomposed into GF((2 2 ) 2 ), and determine GF((2 2 ) 2 ) and the roots of the second reduced polynomial; GF(2 2 ) is decomposed into GF((2) 2 ), and determine GF((2) 2 ) and the roots of the third reduced polynomial.

9. The method according to claim 8, characterized in that The inter-layer mapping relationship includes: GF(2 8 ) and GF((2 4 ) 2 ) first mapping relationship, GF(2 4 ) and GF((2 2 ) 2 ) of the second mapping relationship, according to the third reduction Determination of the roots of the term GF(2 2 ) and GF((2) 2 )'s third mapping relationship; Determining the mapping relationship between the original finite domain and the target composite domain according to the inter-layer mapping relationship includes: According to the first mapping relationship, the second mapping relationship and the third mapping relationship, we can get GF(2 8 ) and GF(((2 2 ) 2 ) 2 )’s mapping relationship.

10. The method according to claim 9, characterized in that The first reduced polynomial is denoted as y 2 +τy+v, y is the algebraic variable of the first reduced polynomial, τ and v are the coefficients in the first reduced polynomial; the second reduced polynomial is expressed as z 2 +αz+β, z is the algebraic variable of the second reduced polynomial, α and β are the coefficients in the second reduced polynomial; the third reduced polynomial is expressed as ω 2 +ω+1, ω is the variable of the third reduced polynomial; The functional relationship of the roots of the reduced polynomial of the next finite field is used to represent the normal basis of the elements of the previous finite field, and the inter-layer mapping relationship between the previous finite field and the next finite field is obtained, which includes: GF(2 8 ) is represented by J1=γ1Y 16 +γ0Y, where Y is the root of the first reduction polynomial, γ1, γ0∈GF(2 4 ); GF(2 4 The normal basis of the elements of ) is represented by J2 = ▽1Z 4 +▽0Z, where Z is the root of the second reduction polynomial, ▽0, ▽1∈GF(2 2 ); GF(2 2 ) is represented by J3=g1W 2 +g0W, where W is the root of the third reduction polynomial, g1, g0∈GF(2).

11. The method according to claim 6, characterized in that The original finite field is a composite field; the direct subfield decomposition based on the original finite field layer by layer until decomposition into a binary finite field includes: Decomposing the original finite field into multiple groups of direct subfields of the original finite field; Decompose each group of direct subdomains of the original finite field into a composite field of the next direct subdomain; Starting from the composite domain of the next direct subdomain, the direct subdomain of the current layer finite field is decomposed into the composite domain of the next direct subdomain at the next layer, until the last layer of finite fields is the composite domain of binary finite fields.

12. The method according to claim 11, characterized in that The original finite field includes GF((2 4 ) 2 ), the target composite domain includes GF(((2 2 ) 2 ) 2 ); the decomposition of the original finite field into multiple groups of direct subfields of the original finite field includes: GF((2 4 ) 2 ) is decomposed into two groups of GF(2 4 ) elements; The step of decomposing each group of direct subdomains of the original finite field into a composite field of the next direct subdomain comprises: The two groups of GF(2 4 ) are decomposed into GF((2 2 ) 2 ), and determine two groups of GF(2 4 ) respectively decomposed GF((2 2 ) 2 ), obtaining two second reduced polynomials, and determining the roots of the two second reduced polynomials; The step of starting from the composite domain of the next direct subdomain and decomposing the direct subdomain of the current layer of finite fields into the composite domain of the next direct subdomain at the next layer until the last layer of finite fields is a composite domain of a binary finite field includes: GF(2 2 ) is decomposed into GF((2) 2 ), and determine GF((2) 2 ) and the roots of the third reduced polynomial.

13. The method according to claim 12, characterized in that The inter-layer mapping relationship includes: two groups of GF (2 4 ) and GF((2 2 ) 2 ) respectively, and GF(2 2 ) and GF((2) 2 )'s third mapping relationship; Determining the mapping relationship between the original finite domain and the target composite domain according to the inter-layer mapping relationship includes: According to the two groups of GF (2 4 ) and GF((2 2 ) 2 ) respectively, and the third mapping relationship, and obtain GF((2 4 ) 2 ) and GF(((2 2 ) 2 ) 2 )’s mapping relationship.

14. The method according to claim 13, characterized in that The two second reduced polynomials are respectively expressed as: 2 +α0z+β0、z 2 +α1z+β1, where z is the algebraic variable of the second reduction polynomial, α0 and β0 are a set of GF(2 4 ) decomposed GF((2 2 ) 2 ) corresponding to the coefficients of the second reduced polynomial, α1 and β1 are another set of GF(2 4 ) decomposed GF((2 2 ) 2 ) corresponding to the coefficients of the second reduced polynomial; The third reduced polynomial is denoted as ω 2 +ω+1, where ω is the variable of the third reduction polynomial; The functional relationship of the roots of the reduced polynomial of the next finite field is used to represent the normal basis of the elements of the previous finite field, and the inter-layer mapping relationship between the previous finite field and the next finite field is obtained, which includes: GF(2 4 The normal basis of the elements of ) is represented by J2 = ▽1Z 4 +▽0Z, where Z is the root of any of the two second reduction polynomials, ▽0, ▽1∈GF(2 2 ); GF(2 2 ) is represented by J3=g1W 2 +g0W, where W is the root of the third reduction polynomial, g1, g0∈GF(2).

15. The method according to any one of claims 4 to 14, characterized in that: The data obfuscation transformation includes an S-box operation of a cryptographic algorithm, or an affine transformation of a cryptographic algorithm acceleration instruction; for any original finite field, the S-box or affine transformation of different types of cryptographic algorithms has a different mapping relationship between the original finite field and the target composite field; Wherein, the irreducible polynomials of the original finite fields of the S-boxes and affine transformations of different types of cryptographic algorithms are different, and / or the coefficients of the reduction polynomials are adjusted differently, so that the mapping relationship between the S-boxes or affine transformations of different types of cryptographic algorithms in the same original finite field and the target composite field is different; For any type of cryptographic algorithm, the coefficients in the reduction polynomial are based on the secret code. The code algorithm is adapted to the conjugate properties of the original finite field of the S-box or affine transformation.

16. The method according to any one of claims 3 to 14, characterized in that: Determining the output data of the cryptographic algorithm according to the transformed output data comprises: Selecting an inverse mapping relationship between an original finite field of the data obfuscation transformation and a target composite field from a plurality of inverse mapping relationships; According to the inverse mapping relationship between the original finite field of the data obfuscation transformation and the target composite field, the transformed output data is mapped from the target composite field back to the original finite field of the data obfuscation transformation; The output data of the cryptographic algorithm is determined based on the transformed output data of the original finite field.

17. The method according to claim 16, characterized in that The mapping relationship is a mapping matrix; the inverse mapping relationship is an inverse mapping matrix, and the mapping directions of the mapping matrix and the inverse mapping matrix are opposite; the data obfuscation transformation includes the S-box operation of the cryptographic algorithm or the affine transformation of the cryptographic algorithm acceleration instruction; wherein, the mapping matrices of the S-box or affine transformation of different types of cryptographic algorithms are different, and the inverse mapping matrices of the S-box or affine transformation of different types of cryptographic algorithms are different.

18. The method according to claim 17, characterized in that The selecting, from a plurality of mapping relationships, a mapping relationship between an original finite field and a target composite field of the data obfuscation transformation comprises: In a pre-inversion operation, based on a current cryptographic algorithm or a current affine transformation, a corresponding input mapping transformation matrix is ​​selected from a plurality of input mapping transformation matrices, wherein the input mapping transformation matrix includes at least a mapping matrix; The step of mapping the transformed input data from the original finite field of the data obfuscation transformation to the target composite field according to the mapping relationship between the original finite field of the data obfuscation transformation and the target composite field comprises: In the pre-inversion operation, the input mapping transformation matrix is ​​used to perform a matrix multiplication operation with the transformed input data of the original finite field to obtain an input matrix multiplication operation result; Based at least on the input matrix multiplication result, transformed input data mapped to the target composite domain is obtained.

19. The method according to claim 18, characterized in that The matrix multiplication operation using the input mapping transformation matrix and the transformed input data of the original finite field includes: Use the mapping matrix and the box matrix of the S-box to perform a matrix multiplication operation with the transformed input data of the original finite field; wherein, if the data obfuscation transformation is an S-box operation of the cryptographic algorithm, and the box matrix of the S-box participates in the pre-inversion operation, then the input mapping transformation matrix also includes the box matrix of the S-box; The step of obtaining the transformed input data mapped to the target composite domain based at least on the input matrix multiplication operation result comprises: If the vector of the S-box participates in the pre-inversion operation, then based on the current cryptographic algorithm or the current affine transformation In exchange, a corresponding input mapping transformation vector is selected from a plurality of input mapping transformation vectors; the input mapping transformation vector is a multiplication result of the vector of the S-box and the mapping matrix and / or the box matrix; The input matrix multiplication result is vector-added with the input mapping transformation vector to complete the pre-inversion operation and obtain the transformed input data mapped to the target composite domain.

20. The method according to any one of claims 18-19, characterized in that: The operation on the transformed input data mapped to the target composite domain includes: A unified multiplication inversion operation is performed on the transformed input data mapped to the target composite domain to obtain a multiplication inversion result as the transformed output data.

21. The method according to claim 20, characterized in that The selecting, from a plurality of inverse mapping relationships, an inverse mapping relationship between an original finite field and a target composite field of the data obfuscation transformation comprises: In the post-inversion operation, based on the current cryptographic algorithm or the current affine transformation, a corresponding output mapping transformation matrix is ​​selected from a plurality of output mapping transformation matrices, wherein the output mapping transformation matrix includes at least an inverse mapping matrix; The step of mapping the transformed output data from the target composite domain back to the original finite domain of the data obfuscation transformation according to the inverse mapping relationship between the original finite domain of the data obfuscation transformation and the target composite domain comprises: In the post-inversion operation, the output mapping transformation matrix and the multiplication inversion result are used to perform a matrix multiplication operation to obtain an output matrix multiplication operation result; Based at least on the output matrix multiplication result, transformed output data mapped back to the original finite field is obtained.

22. The method according to claim 21, characterized in that The matrix multiplication operation using the output mapping transformation matrix and the multiplication inverse result includes: Use the inverse mapping matrix, and the box matrix or affine transformation matrix of the S-box to perform a matrix multiplication operation with the multiplication inversion result; wherein, if the data obfuscation transformation is an S-box operation or affine transformation of the cryptographic algorithm, and the box matrix or affine transformation matrix of the S-box participates in the post-inversion operation, then the input mapping transformation matrix also includes the box matrix or affine transformation matrix of the S-box; The step of obtaining the transformed output data mapped back to the original finite field based at least on the output matrix multiplication operation result comprises: If the vector of the S-box or the vector of the affine transformation participates in the post-inversion operation, a corresponding output mapping transformation vector is selected from a plurality of output mapping transformation vectors based on the current cryptographic algorithm or the current affine transformation; the output mapping transformation vector is the vector of the S-box or the vector of the affine transformation, or the multiplication result of the vector and the box matrix of the S-box or the affine transformation matrix; Perform a vector addition operation on the output matrix multiplication result and the output mapping transformation vector to complete the inversion After the operation, the transformed output data is mapped back to the original finite field.

23. The method according to claim 22, characterized in that Various types of cryptographic algorithms and affine transformations reuse the logic of matrix multiplication and vector addition operations; For the affine forward transformation of cryptographic algorithm acceleration instructions, the pre-inversion operation and the multiplication inversion operation are skipped through an additional multiplexer; For the affine inverse transformation of the cryptographic algorithm acceleration instruction, the inverse mapping matrix of the affine transformation and the multiplication inverse result are first calculated, and then the matrix multiplication operation is performed with the affine transformation matrix through an additional matrix multiplier; wherein the affine transformation matrix and the affine transformation vector are in variable form.

24. A data processing device, characterized in that: include: An input data acquisition module, used to acquire input data of a cryptographic algorithm, wherein the cryptographic algorithm is any one of a plurality of cryptographic algorithms; A transformation input data determination module, used to determine the intermediate data of the cryptographic algorithm according to the input data as the transformation input data of the data obfuscation transformation; A mapping module, used for mapping the transformed input data from the original finite field of the data obfuscation transformation to a target composite field, wherein the target composite field is a composite field with a binary finite field as a subfield and multi-level nested expansion; wherein the original finite field of the data obfuscation transformation is any original finite field among a plurality of original finite fields; A calculation module, used for calculating, in the target composite domain, the transformed input data mapped to the target composite domain to obtain transformed output data; The output data determination module is used to determine the output data of the cryptographic algorithm according to the transformed output data.

25. The device according to claim 24, characterized in that The mapping module, for mapping the transformed input data from the original finite field of the data obfuscation transformation to the target composite field, comprises: Selecting a mapping relationship between an original finite field and a target composite field of the data obfuscation transformation from a plurality of mapping relationships; According to the mapping relationship between the original finite field of the data obfuscation transformation and the target composite field, mapping the transformation input data from the original finite field of the data obfuscation transformation to the target composite field; The output data determination module comprises: The inverse mapping module is used to select the inverse mapping relationship between the original finite field of the data obfuscation transformation and the target composite field from multiple inverse mapping relationships; according to the inverse mapping relationship between the original finite field of the data obfuscation transformation and the target composite field, map the transformed output data from the target composite field back to the original finite field of the data obfuscation transformation. domain; The output module is used to determine the output data of the cryptographic algorithm according to the transformed output data of the original finite field.

26. The device according to claim 25, characterized in that The mapping relationship is a mapping matrix; the inverse mapping relationship is an inverse mapping matrix, and the mapping directions of the mapping matrix and the inverse mapping matrix are opposite; the data obfuscation transformation includes the S-box operation of the cryptographic algorithm or the affine transformation of the cryptographic algorithm acceleration instruction; wherein, the mapping matrices of the S-box or affine transformation of different types of cryptographic algorithms are different, and the inverse mapping matrices of the S-box or affine transformation of different types of cryptographic algorithms are different.

27. The device according to claim 26, characterized in that The mapping module comprises: An input mapping generation circuit is used to provide at least a plurality of input mapping transformation matrices, wherein the plurality of input mapping transformation matrices include input mapping transformation matrices of S-boxes or affine transformations of various types of cryptographic algorithms; the input mapping transformation matrix includes at least a mapping matrix, or a mapping matrix and a box matrix of an S-box; A first multiplexer, configured to select a corresponding input mapping transformation matrix from a plurality of input mapping transformation matrices provided by the input mapping generation circuit based on a current cryptographic algorithm or a current affine transformation; The first matrix multiplier is used to perform a matrix multiplication operation on the input mapping transformation matrix selected by the first multiplexer and the transformed input data of the original finite field to obtain an input matrix multiplication operation result; wherein the input matrix multiplication operation result is used to form the transformed input data mapped to the target composite domain.

28. The device according to claim 27, characterized in that The input mapping generation circuit is further used to provide a plurality of input mapping transformation vectors, wherein the plurality of input mapping transformation vectors include input mapping transformation vectors of S-boxes or affine transformations of various types of cryptographic algorithms; The mapping module also includes: A second multiplexer, configured to select a corresponding input mapping transformation vector from a plurality of input mapping transformation vectors provided by the input mapping generation circuit based on a current cryptographic algorithm or a current affine transformation; The first adder is used to perform a vector addition operation on the input matrix multiplication result obtained by the first matrix multiplier and the input mapping transformation vector selected by the second multiplexer to obtain the transformed input data mapped to the target composite domain.

29. The device according to any one of claims 25 to 28, characterized in that The operation module includes: a multiplication inversion unit, which is used to perform a unified multiplication inversion operation on the transformed input data mapped to the target composite domain, and obtain a multiplication inversion result as the transformed output data.

30. The device according to claim 29, characterized in that The inverse mapping module comprises: The output mapping generation circuit is used to provide at least a plurality of output mapping transformation matrices, wherein the plurality of output The mapping transformation matrix includes an output mapping transformation matrix of an S-box or an affine transformation of various types of cryptographic algorithms; the output mapping transformation matrix includes: an inverse mapping matrix, or an inverse mapping matrix and a box matrix of an S-box or an affine transformation matrix; A third multiplexer, configured to select a corresponding output mapping transformation matrix from a plurality of output mapping transformation matrices provided by the output mapping generation circuit based on a current cryptographic algorithm or a current affine transformation; The second matrix multiplier is used to perform a matrix multiplication operation on the output mapping transformation matrix selected by the third multiplexer and the multiplication inversion result of the multiplication inversion unit to obtain an output matrix multiplication operation result; wherein the output matrix multiplication operation result can be used to form transformation output data mapped back to the original finite field.

31. The device according to claim 30, characterized in that The output mapping generation circuit is further used to provide a plurality of output mapping transformation vectors, wherein the plurality of output mapping transformation vectors include output mapping transformation vectors of S-boxes or affine transformations of various types of cryptographic algorithms; The inverse mapping module also includes: a fourth multiplexer, configured to select a corresponding output mapping transformation vector from a plurality of output mapping transformation vectors provided by the output mapping generation circuit based on a current cryptographic algorithm or a current affine transformation; The second adder is used to perform a vector addition operation on the output matrix multiplication result obtained by the second matrix multiplier and the output mapping transformation vector selected by the fourth multiplexer to obtain the transformation output data mapped back to the original finite field.

32. The device according to claim 31, characterized in that The inverse mapping module further includes: a third matrix multiplier, and a fifth multiplexer; The third matrix multiplier is used for performing matrix multiplication operation on the inverse mapping matrix of the affine transformation provided by the output mapping generation circuit and the inverse multiplication result of the multiplication inversion unit for the affine inverse transformation of the cryptographic algorithm acceleration instruction, and the result is introduced into the fifth multiplexer; The fifth multiplexer is used to select the result of the third matrix multiplier, or the multiplication inversion result of the multiplication inversion unit, and import the selected result into the second matrix multiplier.

33. The device according to claim 32, characterized in that The fifth multiplexer selects the multiplication inversion result of the multiplication inversion unit under the S-box operation of the cryptographic algorithm and imports it into the second matrix multiplier, so that the multiplication inversion result of the multiplication inversion unit and the output mapping transformation matrix selected by the third multiplexer are subjected to matrix multiplication operation in the second matrix multiplier to obtain the output matrix multiplication operation result corresponding to the S-box operation of the current cryptographic algorithm; Under the inverse affine transformation, the fifth multiplexer selects the result of the third matrix multiplier and imports it into the second matrix multiplier; and under the inverse affine transformation, the third multiplexer selects the output mapping generation The affine transformation matrix provided by the circuit is provided to the second matrix multiplier so that the result of the third matrix multiplier and the affine transformation matrix are matrix multiplied in the second matrix multiplier to obtain the corresponding output matrix multiplication result under the affine inverse transformation.

34. The device according to claim 32 or 33, characterized in that The fifth multiplexer is further used to select the transformation input data of the original finite field for the affine forward transformation of the cryptographic algorithm acceleration instruction, and import the transformed input data into the second matrix multiplier; The third multiplexer is further used to select an affine transformation matrix for output with respect to the affine forward transformation, and import it into the second matrix multiplier; Among them, under the affine forward transformation, the second matrix multiplier performs a matrix multiplication operation on the transformed input data of the original finite field and the affine transformation matrix, so that the result and the affine transformed vector selected by the fourth multiplexer are vector-added in the second adder.

35. A processor, characterized in that: Comprising a data processing device as described in any one of claims 24-34.

36. A chip, characterized in that: Comprising a data processing device as described in any one of claims 24-34, or a processor as described in claim 35.

37. An electronic device, characterized in that: Comprising a chip as claimed in claim 36.

Images