Processor, integrated circuit, and method of generating random permutation

Abstract

A processor includes: a controller configured to assign different index numbers to a plurality of operations, respectively; a shuffling logic configured to perform a bit-by-bit operation on each index number based on a modulo addition operation and a rotation shift operation and shuffle the index numbers; and operation logic configured to perform a plurality of operations based on the shuffled index number.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the priority of Korean Patent Application No. 10-2023-0086099 filed on July 3, 2023, in the Korean Intellectual Property Office and Korean Patent Application No. 10-2023-0113070 filed on August 28, 2023, in the Korean Intellectual Property Office, the disclosures of which are incorporated herein in their entirety by reference. Technical Field

[0003] Various example embodiments relate to methods and apparatus for generating random permutations, and processors including random permutation generation logic circuitry. Background Art

[0004] Many security techniques use random permutations.

[0005] In the field of post-quantum cryptography (PQC), e.g., cryptography that may be or is more likely to be secure even in the presence of quantum computers, there are methods such as lattice-based cryptography and / or code-based cryptography. Such methods include vector operations that enable or help enable parallel processing. Parallel vector operations implement hiding countermeasures to defend against or help defend against side channel analysis (SCA) attacks. In order to effectively use hiding countermeasures, techniques for generating random permutations in a manner that ensures or helps ensure security are needed or desired.

[0006] In the related art, Fisher-Yates shuffle has been used as a random permutation generation method for shuffling multiple elements included in a sequence. Fisher-Yates shuffle has factor complexity, for example, has complexity scaled by a factor. However, Fisher-Yates shuffle requires considerable storage space and is not suitable for parallel processing. For example, according to Fisher-Yates shuffle, the next round of shuffle is performed based on the result of the previous round of shuffle. Summary of the invention

[0007] Various example embodiments provide a method and apparatus for generating random permutations in a manner that enables parallel processing while achieving or facilitating achievement of a desired complexity.

[0008] Alternatively or additionally, various example embodiments provide a processor including logic circuitry to generate random permutations in a manner capable of performing parallel processing while achieving a desired level of complexity.

[0009] According to some example embodiments, a processor is provided, including a controller configured to assign different index numbers to multiple operations, respectively; a shuffling logic configured to perform a bitwise operation on each index number based on a modulo-addition operation and a rotation-shift operation and shuffle the index numbers; and an operation logic configured to perform multiple operations based on the shuffled index numbers.

[0010] Alternatively or additionally, according to various example embodiments, an integrated circuit includes processing logic configured to provide processing data on which operations are to be performed to shuffle logic, and shuffle logic configured to perform a bit-by-bit operation on at least a portion of the processing data based on a modular addition operation and a rotate-shift operation.

[0011] Alternatively or additionally, according to various example embodiments, the integrated circuit includes processing logic configured to provide different pieces of processing data to a plurality of shuffle logics, and a plurality of shuffle logics configured to perform bit-by-bit operations on at least a portion of the processing data based on a modular addition operation and a rotation shift operation. Output data of each of the plurality of shuffle logics may set an arrangement in which the different pieces of processing data are shuffled.

[0012] Alternatively or additionally, according to some example embodiments, a method for generating a random permutation performed by a processor of a computing device includes: receiving a plurality of key sets and basic permutation data set by a plurality of digits, and shuffling the digits of the basic permutation data by performing a bit-by-bit operation based on a modular addition operation and a rotation-shift operation based on each digit of the basic permutation data. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The above and other aspects, features and advantages of the present disclosure will be more clearly understood from the following detailed description taken in conjunction with the accompanying drawings.

[0014] Figure 1 is a block diagram illustrating a processor including shuffle logic according to some example embodiments.

[0015] Figure 2 It shows that according to Figure 1 A schematic diagram of an example embodiment of a processor processing multiple operations based on a random arrangement.

[0016] Figure 3 is a schematic diagram illustrating a modular adder according to some example embodiments.

[0017] Figure 4 is a schematic diagram illustrating a rotation shift calculator according to some example embodiments.

[0018] Figure 5 is a block diagram illustrating a shuffling circuit according to some example embodiments.

[0019] Figure 6 is a block diagram illustrating shuffling logic according to some example embodiments.

[0020] Figure 7 It shows that according to Figure 6 A block diagram of initial shuffle logic of an example embodiment of FIG.

[0021] Figure 8 It shows that according to Figure 6 00147] Block diagram of intermediate shuffle logic of an example embodiment of FIG.

[0022] Fig. 9 It shows that according to Figure 6 Schematic diagram of the operation of the round key sets and intermediate shuffle logic of an example embodiment of FIG.

[0023] Fig.10 It shows that according to Figure 6 00143] Block diagram of the final shuffle logic of an example embodiment of FIG.

[0024] Fig.11 is a block diagram illustrating a shuffling circuit according to some example embodiments.

[0025] Fig.12 is a block diagram illustrating intermediate shuffle logic according to some example embodiments.

[0026] Fig.13 is a flow chart illustrating a method of generating a random permutation according to some example embodiments.

[0027] Fig.14 It shows that according to Fig.13 A flowchart of a shuffling operation in a method of generating a random permutation according to an example embodiment of the present invention.

[0028] Fig.15 It shows that according to Fig.14 The shuffle operations of the example embodiments are intermediate shuffle operations. DETAILED DESCRIPTION

[0029] Hereinafter, various example embodiments will be described with reference to the accompanying drawings.

[0030] Figure 1 is a block diagram illustrating a processor 10 according to some example embodiments. Figure 1 , the processor 10 may include a controller 100 , a shuffle logic 200 , and a calculation logic 300 .

[0031] The processor 10 may be or may include, or may be included in a processor used in a mobile device such as a smartphone and / or tablet computer. Alternatively or additionally, the processor 10 may be or may include, or may be included in a processor used in a server device such as one or more security servers, data management servers, or cloud servers.

[0032] The processor 10 may be or include a general-purpose processor, such as an application processor (AP) and / or a central processing unit (CPU), or a dedicated security processor that performs encryption and decryption. When the processor 10 is a dedicated security processor, the processor 10 may be arranged as a semiconductor chip, separate from the application processor (AP) and the central processing unit (CPU), or may be arranged as part of a module inside the application processor (AP) and the central processing unit (CPU).

[0033] The controller 100 according to various example embodiments may transmit a command for generating a random arrangement to the shuffle logic 200 .

[0034] In some example embodiments, the controller 100 may send a random permutation generation command together with a number of desired or expected elements of the random permutation to the shuffle logic 200. For example, the controller 100 may send 6 and the random permutation generation command to the shuffle logic 200, where 6 is the bit digits (or bit size) of the number of elements of the random permutation including 64=2^6 elements.

[0035] Alternatively or additionally, the controller 100 may assign index numbers to the respective elements included in the basic arrangement data, and transmit the assigned index numbers one by one to the shuffle logic 200. The number of elements included in the basic arrangement data may also be individually provided to the shuffle logic 200. Alternatively or additionally, each index number may be provided to the shuffle logic 200. For example, the index number "1" of the basic arrangement data including 64 elements may be transmitted to the shuffle logic 200 as "00 00 01".

[0036] The controller 100 may generate a plurality of keys to be used in the shuffling of the shuffle logic 200, and may provide the generated keys to the shuffle logic 200. A portion of the key may have a size different from a size of another portion of the key. For example, the key may include an initial key and a round key, and the number of bits in the initial key may be greater than the number of bits in the round key. The round key may include a plurality of key sets including the same number of keys. The controller 100 may include a storage unit capable of temporarily storing a plurality of keys.

[0037] Shuffle logic 200 may include multiple shuffle logics. Different shuffle logics or different shuffle logic operations may use different keys to perform bit-by-bit operations. The keys may be used in modular addition operations using processed data. The initial key and the round key may be randomly generated.

[0038] In some example embodiments, the controller 100 may assign an index number to each of the plurality of operations. The controller 100 may control the shuffling logic 200 so that the index numbers are shuffled to generate a random arrangement. Then, the operation logic 300 may perform a plurality of operations based on the shuffled index numbers.

[0039] For example, refer to Figure 2 , the controller 100 may assign integers from index number 1 to index number N to the corresponding N operations. The controller 100 may use the number of bits as log 2 N is sent, and the random permutation generation command may be sent to the shuffle logic 200. Alternatively or additionally, the controller 100 may send the number of elements to be randomly permuted, N, and the random permutation generation command to the shuffle logic 200. The shuffle logic 200 may shuffle the binary bits of integers from 1 to N to output the permutations serially and / or in parallel, such as for an illustrative example, {j,1,..,N,2,i}(2 <i<j<N)。

[0040] The controller 100 may sequentially reallocate the example random permutations (e.g., but not limited to {j, 1, ..., N, 2, i}) generated by shuffling the N index numbers by the shuffling logic 200 to the N operations as new index numbers. The operation logic 300 may perform the operations based on the new index numbers. In this case, the operation logic 300 may perform the operations serially, for example, in the order of the new index numbers, and / or may group the multiple operations based on the new index numbers and then process the grouped operations in parallel. Thus, at least some parallel vector operations of the security algorithm may be randomized and executed, so that at least some hidden countermeasures with respect to side channel analysis (SCA) may be performed.

[0041] The shuffle logic 200 according to some example embodiments may perform bitwise operations based on a modulo addition operation and a rotation shift operation on the processed data to output shuffled data. For example, the shuffle logic 200 may receive an integer i, and may perform bitwise operations based on a bitwise modulo addition operation and a rotation shift operation on i binary bits to output j, where i and j may be different from each other.

[0042] The shuffle logic 200 may perform a rotation-shift operation on the result of the modular addition operation. When the shuffle logic 200 performs multiple modular addition operations, multiple rotation-shift operations may be performed. When multiple rotation-shift operations are performed, the number of bits rotated and shifted in some rotation-shift operations may be different from each other.

[0043] When generating a random arrangement from a basic arrangement data having N elements, the shuffle logic 200 can independently shuffle the binary bits of the N elements. For example, when generating a random arrangement by shuffling N elements according to the Fisher-Yates shuffle, one element of the random arrangement can be determined, and then another element can be determined. Therefore, the elements of the random arrangement can be determined sequentially. However, the shuffle logic 200 according to some example embodiments can independently determine the elements of the random arrangement. Therefore, the elements of the random arrangement can be independently determined in the same clock cycle. For example, the shuffle logic 120 can shuffle each binary bit data in a plurality of processed data fragments in the same clock cycle, regardless of other processed data. For example, the shuffle logic 200 can simultaneously and independently shuffle i binary bits and (i+1) binary bits in the same clock cycle.

[0044] The following will refer to Figure 3 The modular addition operation of shuffle logic 200 is described in more detail. Figure 3 An operation is shown in which the shuffle logic 200 performs a modular addition operation of the process data t and the key IK to output output data t_MA.

[0045] As described in this article, the modular addition operation is represented by the symbol Modulo addition symbol is defined as (k+t) mod N, and for n bits of processing data t, N is defined as 2 n For example, N may be the number of integers that can be represented by n (number of bits). In addition, k represents a key. Therefore, the shuffle logic 200 may perform a modular addition operation on at least a portion of the processing data provided from the controller 100 and the key.

[0046] refer to Figure 3 , the processing data t is, for example, a binary bit sequence having 6 bits and is represented by 6 bits from the most significant bit t[5] to the least significant bit t[0]; however, the exemplary embodiment is not limited to 6 bits. The processing data t and the key IK on which the modular addition operation is to be performed are binary bit sequences having the same number of bits as the processing data t. The key IK is represented by 6 bits from the most significant bit MSB IK[5] to the least significant bit IK[0]. Therefore, N used to obtain the remainder of the modular addition operation is 64.

[0047] Each bit of the binary digit of the processing data t is added to the bit of the corresponding bit digit of the key IK. Therefore, t[5] is added to IK[5], t[4] is added to IK[4], t[3] is added to IK[3], t[2] is added to IK[2], t[1] is added to IK[1], and t[0] is added to IK[0]. Adding bits in each digit can generate a carry bit in the high-order digit. The addition of bits is performed with the carry bit included. The most significant bit C6 of the result of the binary bit addition operation of the processing data t and the key IK is discarded. Therefore, the output data t_MA becomes the remainder of N=64.

[0048] The following will refer to Figure 4 The rotate-shift operations of the shuffle logic 200 are described in more detail. Figure 4 An operation is shown in which the shuffle logic 200 performs a 2-bit rotation shift operation on the data t_MA to output the output data t_RS.

[0049] As described in this paper, the rotation and shift operation is represented by the symbol or Indicates. Symbol and Refers to a rotation shift operation of S bits in the left direction (more significant direction) and a rotation shift operation of S bits in the right direction (less significant direction), respectively. The bits shifted to exceed the most significant bit digit are sequentially rotated and shifted to the least significant bit digit. Therefore, when a rotation shift operation is performed on data having n bits, the data can be returned to itself regardless of the direction, for example, after n such rotations.

[0050] refer to Figure 4 , the processed data t_MA is a binary bit sequence having 6 bits and is represented by 6 bits from the most significant bit t_MA[5] to the least significant bit t_MA[0]. When a 2-bit rotation and shift operation is performed to the left, t_MA[5] and t_MA[4] are sequentially rotated and shifted to the least significant bit.

[0051] Figure 5 2001 is a block diagram illustrating a shuffle circuit according to some example embodiments. The shuffle circuit 2001 may include processing logic, such as pre-processing logic 210 and shuffle logic 220 .

[0052] The pre-processing logic 210 may receive input data IN and may provide the shuffling logic 220 with processed data i to be shuffled and at least one key to be used for a modular addition operation.

[0053] In some example embodiments, the input data IN may include processing data i and a key. In this case, the pre-processing logic 210 may include a flip-flop (such as one or more D flip-flops) and may provide the processing data i and the key to the shuffle logic 220 in synchronization with the clock signal.

[0054] In some example embodiments, the input data IN may be the number of numbers required for or used for random permutation. For example, when a random permutation including 64 numbers is required or used, the pre-processing logic 210 may sequentially provide processing data i including 6 bits to the shuffle logic 220. Alternatively or additionally, a plurality of processing data segments may be provided to a plurality of shuffle logics 220 in parallel, respectively.

[0055] According to some example embodiments, the preprocessing logic 210 may include a key generator. The key generator may be a random number generator that generates a random key. In this case, the preprocessing logic 210 may generate a plurality of keys that are different from each other, and may provide the generated keys to the shuffling logic 220. In some example embodiments, the key generator may be a post-quantum key generator; example embodiments are not limited thereto.

[0056] Figure 6 is a block diagram illustrating shuffling logic according to some example embodiments. Figure 6 The shuffle logic 220 may include an initial shuffle logic 221, an intermediate shuffle logic 223, and a final shuffle logic 225. Each of the shuffle logics 221, 223, and 225 may include at least one modular adder and at least one rotation and shift operator. Some shuffle logics may each include multiple modular adders and multiple rotation and shift operators.

[0057] The shuffle logic 220 may receive processed data i including n bits, and may shuffle at least a portion of the n bits, and output shuffled data i_shuffled including n bits.

[0058] The initial shuffle logic 221 may be provided with an initial key IK. Figure 6 The initial shuffle logic 221 is described in detail.

[0059] The initial shuffle logic 221 may divide the shuffle result of the binary data of the process data i into a plurality of blocks MSB and LSB_INIT and provide each of the blocks MSB and LSB_INIT to the intermediate shuffle logic 223 .

[0060] The intermediate shuffle logic 223 may include a plurality of key selectors 223_K1 to 223_KR and a plurality of round units 223_R1 to 223_RR.

[0061] Each of the plurality of wheel units 223_R1 to 223_RR may include at least one adder and at least one rotation shift operator.

[0062] The intermediate shuffle logic 223 may be provided with a key to be used in a modular addition operation of a plurality of round units 223_R1 to 223_RR. The key provided to the intermediate shuffle circuit 223 may include a plurality of key sets. The key set may be referred to as a round key set. Each round key set may include a plurality of round keys. The round key may be a randomly generated key.

[0063] In some example embodiments, a round key set may include multiple keys, such as four round key sets. This will refer to Figure 8 Describe in detail.

[0064] Each of the key selectors 223_K1 to 223_KR of the intermediate shuffle logic 223 may select a single round key from the round keys to be used in the modular addition operation based on the first block of MSBs among the plurality of blocks of MSBs and LSB_INIT provided by the initial shuffle logic 221. In some example embodiments, the first block of MSBs may include the most significant 2 bits of a result of shuffling the data i by the initial shuffle logic 221.

[0065] Each of the plurality of round units 223_R1 to 223_RR of the intermediate shuffle logic 223 may perform a modular addition operation on the output result of the previous round unit and the round keys Key_1 to Key_R selected based on the first block MSB. For example, the first round unit 223_R1 may perform a modular addition operation on the second block LSB_INIT provided by the initial shuffle logic 221 and the round key Key_1 selected by the first key selector 223_K1. The second block LSB_INIT may include the remaining bits excluding the most significant 2 bits from the result of the shuffle processing data i by the initial shuffle logic 221. The first round unit 223_R1 may perform a rotation shift operation on the result of the modular addition operation, and may provide the result to the next round unit.

[0066] The final shuffle logic 225 may receive the first block of MSBs and the second block of LSB_INTER from the intermediate shuffle logic 223. The first block of MSBs provided to the final shuffle logic 225 is the same as the first block of MSBs provided to the intermediate shuffle logic 223.

[0067] The final shuffle logic 225 is provided with the final key. The final shuffle logic 225 may perform a modulo addition operation on the second block LSB_INTER and the final key.

[0068] The following will refer to Figure 7The initial shuffle logic 221 may include a modulo adder 221_MA that performs an n-bit modulo add operation. The initial shuffle logic may be referred to as a first logic unit.

[0069] The modular adder 221_MA may perform a modular addition operation on n bits of the processed data i and n bits of the initial key IK, and may provide n bits of the output i_MA to the rotation shift operator 221_RS. Figure 3 The modular addition operation is performed as described in the above. The initial key IK may be provided from the controller 100 or the pre-processing logic 210. The initial key IK may be randomly generated. In some example embodiments, the initial key IK may be generated using a post-quantum cryptographic protocol; example embodiments are not limited thereto.

[0070] The rotation shift operator 221_RS may perform a rotation shift operation of S bits on the provided i_MA. The bit digit S to be rotated and shifted may be randomly determined. The rotation shift operator 221_RS may receive the number of bit digits S from the pre-processing logic 210 and / or from the controller 100. In some example embodiments, the rotation shift operator 221_RS of the initial shuffle logic 221 may perform a rotation shift operation in the left direction (e.g., in the direction of more significant bits).

[0071] The initial shuffle logic 221 may divide the result i_RS of performing the rotation-shift operation into two blocks MSB[2] and LSB_INIT[n-2], and may provide each of the blocks MSB[2] and LSB_INIT[n-2] to the intermediate shuffle logic 223. The first block MSB[2] may include the two most significant bits of the result i_RS of performing the rotation-shift operation, and the second block LSB_INIT[n-2] may include a remainder excluding the two most significant bits from the result i_RS of performing the rotation-shift operation.

[0072] The following will refer to Figure 8 Describe the intermediate shuffle logic in detail.

[0073] According to some example embodiments, the intermediate shuffle logic 223 may include R round units 223_R1 to 223_RR and R key selectors 223_K1 to 223_KR. Each of the round units 223_R1 to 223_RR may perform a shuffle operation. The shuffle operation may include a modular add operation using a modular adder and a rotation shift operation using a rotation shift operator.

[0074] The intermediate shuffle logic 223 may include a plurality of key selectors 223_K1 to 223_KR and a plurality of wheel units 223_R1 to 223_RR. Each of the plurality of wheel units 223_R1 to 223_RR may include a modulo-add operator and a rotation-shift operator. For example, the first wheel unit 223_R1 may include a first modulo-add operator 223_MA1 and a first rotation-shift operator 223_RS1. The second wheel unit 223_R2 may include a second modulo-add operator 223_MA2 and a second rotation-shift operator 223_RS2. The final wheel unit 223_RR may include an Rth modulo-add operator and an Rth rotation-shift operator.

[0075] The plurality of round units 223_R1 to 223_RR may receive round keys from corresponding key selectors 223_K1 to 223_KR, respectively. Each of the plurality of key selectors 223_K1 to 223_KR may select a round key based on the first block of MSB provided from the initial shuffle logic 221. The plurality of key selectors 223_K1 to 223_KR may select a round key based on the same first block of MSB. In some example embodiments, the key selectors 223_K1 to 223_KR may select a single round key from four round keys based on 2 bits of the first block of MSB.

[0076] The first round unit 223_R1 may perform a modulo addition operation on n-2 bits of the second block LSB_INIT provided from the initial shuffle logic 221 and n-2 bits of the round key provided from the key selector 223_K1. The first round unit 223_R1 may perform a rotation shift operation on the modulo addition operation result MA1 and may provide the rotation shift operation result RS1 to the next round unit.

[0077] The round unit after the first round unit 223_R1 may perform a modulo addition operation on the rotation shift operation result of the previous round unit and the round key provided from the corresponding key selector, and may perform a rotation shift operation on the modulo addition operation result. The result of performing the rotation shift operation may be provided to the next round unit.

[0078] The modulo addition operator of each of the plurality of round units 223_R1 to 223_RR may perform a modulo addition operation on n-2 bits of the processing data provided from the previous unit and n-2 bits of the round key. Therefore, when the processing data i input to the shuffle logic 220 is n=6 bits, the most significant 2 bits may be used for round key selection, and the remaining 4 bits may be used for a modulo addition operation on 16.

[0079] In some example embodiments, a portion of the rotational shift operators 223_RS1 to 223_RR of the plurality of wheel units 223_R1 to 223_RR may perform a 1-bit rotational shift operation in the left direction, and the remaining portion may perform a 1-bit (single-bit) rotational shift operation in the right direction. For example, among the plurality of wheel units 223_R1 to 223_RR, the first R / 2 rotational shift operators may perform a 1-bit rotational shift operation in the left direction, and the remaining R / 2 rotational shift operators may perform a 1-bit rotational shift operation in the right direction.

[0080] The number of shuffle operations performed by the intermediate shuffle logic 223 may be preset based on the number of bits and the complexity of the processed data input to the shuffle logic 220. The complexity may be or may correspond to the complexity required or used by the security specification and / or hiding countermeasures.

[0081] For example, the number of shuffle operations performed by the intermediate shuffle logic 223 may be preset as shown in Table 1 based on the number and complexity of the bit digits (bit size) of the processing data input to the shuffle logic 220 .

[0082] Referring to Table 1, when the processing data is 6 bits and requires a complexity of 228, 8 shuffle operations may be performed in the intermediate shuffle logic 223. Therefore, the shuffle logic 223 may include eight round units.

[0083] Table 1

[0084]

[0085] The complexity H(X) refers to the complexity of the computational operation on the random variable X and can be based on the product of the probability p(x) of the random variable and the logarithmic scale log(p(x)).

[0086] G(X)=-∑p(x)log(p(x)) Formula 1

[0087] In some example embodiments, based on the processing data and the required complexity, the intermediate shuffle logic 223 may perform only half of the number of shuffle operations in Table 1. Therefore, the shuffle logic 223 may include wheel units corresponding to half of the number of shuffle operations in Table 1. In this case, the rotation shift operator of each wheel unit of the shuffle logic 223 may be an operator that performs only a 1-bit rotation shift operation in the left direction. For example, when there is a random arrangement with a symmetrical structure, the required complexity can be achieved even when only half of the number of shuffle operations in Table 1 is performed. Therefore, when the random arrangement has a symmetrical structure, it is possible or more likely to achieve the desired complexity and / or security using only a small number of wheel units of the intermediate shuffle logic 223.

[0088] The key selectors 223_K1 to 223_KR according to some example embodiments may select one of a plurality of keys as a round key based on the first block of MSBs provided by the initial shuffle logic 221 .

[0089] refer to Fig. 9 In some example embodiments, the intermediate shuffle logic 223 may be provided with four round key sets KeySet 0, Key Set 1, Key Set 2, and Key Set 3. Each of the round key sets KeySet 0, KeySet 1, KeySet 2, and KeySet 3 may include R keys corresponding to the number of shuffle operations of the intermediate shuffle logic 223.

[0090] For example, the first round key set Key Set 0 may include R keys {k01, k02 to k0R}. Similarly, the second round key set Key Set 1 may include R keys {k11, k12 to k1R}. The third round key set Key Set 2 and the fourth round key set Key Set 3 may be similar.

[0091] The keys included in each of the round key sets Key Set 0, Key Set 1, Key Set 2, and Key Set 3 may be randomly generated. The round key sets Key Set 0, Key Set 1, Key Set 2, and Key Set 3 may be generated by the pre-processing logic 210 and / or the controller 100.

[0092] The key selector may select one of four round key sets KeySet 0, KeySet 1, KeySet 2, and KeySet 3 based on the most significant 2 bits MSB[2] of the processed data. The key selector may provide a round key corresponding to a round unit from among R keys included in the selected round key set.

[0093] For example, a portion of the n processed data segments may be modulo-added with each round key of the first round key set Key Set 0 based on the most significant 2 bits (MSB[2]) “00”. Another portion of the n processed data segments may be modulo-added with each round key of the second round key set Key Set 1 based on the most significant 2 bits (MSB[2]) “01”. Another portion of the n processed data segments may be modulo-added with each round key of the third round key set Key Set 2 based on the most significant 2 bits (MSB[2]) “10”. The remaining portion of the n processed data segments may be modulo-added with each round key of the fourth round key set Key Set 3 based on the most significant 2 bits (MSB[2]) “11”.

[0094] return Figure 8 , each of the plurality of key selectors 223_K1 to 223_KR may be provided with four keys corresponding to the round units among the keys of the four round key sets Key Set 0, Key Set 1, Key Set 2, and Key Set 3. Each of the plurality of key selectors 223_K1 to 223_KR may select one of the four keys based on the most significant 2 bits MSB[2], and may provide the selected key to the corresponding round unit.

[0095] The intermediate shuffle logic 223 may increase complexity by selecting a round key based on the most significant bits of the data processed.

[0096] The following will refer to Fig.10 The final shuffle logic 225 may include a modulo adder 225_MA and a rotation shift operator 225_RS. The final shuffle logic may be referred to as a second logic unit.

[0097] The modular adder 225_MA may perform a modular addition operation on n-2 bits of the processed data RSR and n-2 bits of the final key provided by the intermediate shuffle logic 223. Similar to the intermediate shuffle logic 223, based on the first block of MSBs [2] provided by the initial shuffle logic 221, one of the multiple keys k0j, k1j, k2j, and k3j may be selected as the final key.

[0098] The modular adder 225_MA can provide n-2 bits of the output MAj to the rotation shift operator 225_RS. The modular add operation can be as follows Figure 3 The execution may provide the final key from the controller 100 or the pre-processing logic 210. The final key may be randomly generated.

[0099] The rotation shift operator 225_RS may configure the provided MAj as a low bit and may perform an S-bit rotation shift operation on the data having the first block MSB[2] configured as the most significant bit. For example, the rotation shift operator 225_RS may merge the first block MSB[2] and the provided MAj and then may perform a rotation shift operation.

[0100] The number of rotated and shifted bit digits S may be randomly determined. The rotate-shift operator 225_RS may receive the number of bit digits S from the pre-processing logic 210 or the controller 100. In some example embodiments, the rotate-shift operator 221_RS of the final shuffle logic 225 may perform a rotate-shift operation in the right direction.

[0101] Finally, the shuffle logic 225 may output data i_shuffled, in which the binary bits of the processed data i received by the shuffle logic 220 are shuffled.

[0102] refer to Figures 5 to 10 The described shuffle circuit 200_1 can shuffle the binary bits of the input processing data into the output elements constituting the random arrangement. Therefore, the elements constituting the random arrangement can be generated independently of each other. For example, unlike the Fisher-Yates shuffle, the elements constituting the random arrangement are generated independently of each other, so that it is not necessary or possible to use a large storage space. Additionally or alternatively, the random arrangement can be generated in a small amount of time.

[0103] Fig.11 2 is a block diagram illustrating a shuffling circuit according to some example embodiments. The shuffling circuit 200_2 may include a preprocessing logic unit 210_2 and a shuffling logic unit 220_2. The preprocessing logic unit 210_2 may include a plurality of preprocessing logics Preprocessing Logic 1 to Preprocessing Logic n, and the shuffling logic unit 220_2 may include a plurality of shuffling logics Shuffling Logic 1 to Shuffling Logic n.

[0104] Similar to reference Figure 5 As described above, the pre-processing logic unit 210_2 may receive processing data {1, ..., n} and keys {keys_1 to keys_n} as input data IN. In this case, the pre-processing circuit unit 210_2 may include a plurality of flip-flops and may provide each of the processing data {1, ..., n} and keys {keys_1 to keys_n} to the corresponding shuffling logic in synchronization with a clock signal.

[0105] In some example embodiments, the input data IN may be the number of digits required for random permutation. For example, when a request is made to generate a random permutation including 64 digits, each of the preprocessing logics PreprocessingLogic 1 to Preprocessing Logic n of the preprocessing logic unit 210_2 may process 6-bit data. A plurality of processing data segments {1, ..., n} may be provided in parallel to corresponding shuffling logics Shuffling Logic 1 to ShufflingLogic n, respectively. Each of the plurality of shuffling logics Shuffling Logic 1 to Shuffling Logic n may independently shuffle the binary bits of the input processing data. Each of the plurality of shuffling logics Shuffling Logic 1 to Shuffling Logic n may perform a shuffling operation in the same clock cycle.

[0106] The output data of each of the plurality of shuffling logics Shuffling Logic1 to Shuffling Logic n of the shuffling circuit 200_2 may constitute a random arrangement in which a plurality of processed data pieces {1, . . . , n} are randomly shuffled.

[0107] Therefore, unlike the Fisher Yates shuffle, random permutations can be generated in a very short time. In addition, multiple shuffle logics operate independently of each other, which may not require large storage space.

[0108] Fig.12 is a block diagram illustrating intermediate shuffle logic according to some example embodiments.

[0109] refer to Fig.12 , the intermediate shuffle logic 223_2 may include a key storage unit 223_D, a key selector 223_K, and a round unit 223_R.

[0110] With reference Figure 8 Unlike the example embodiments of the intermediate shuffle logic 223_1 described above, Fig.12 The intermediate shuffle logic 223_2 may include a wheel unit 223_R having a recursive structure.

[0111] The key storage unit 223_D may include a plurality of round key sets. Each of the plurality of round key sets may store a plurality of round keys. Each of the plurality of round key sets may store a plurality of round keys corresponding to a plurality of rounds (such as a predetermined number of rounds) ROUND.

[0112] The key storage unit 223_D may receive a round ROUND_NO to be performed among the plurality of rounds ROUND, and may provide the key selector 223_K with corresponding round keys k0r, k1r, k2r, and k3r of each round key set.

[0113] The key selector 223_K may select a single round key from a plurality of provided round keys k0r, k1r, k2r, and k3r based on the first block of MSBs provided to the initial shuffle logic, and may provide the selected round key to the round unit 223_R.

[0114] The wheel unit 223_R may include a multiplexer 223_MU, a modulo adder 223_MA, a rotation shift operator 223_RS, and a wheel controller 223_C.

[0115] The wheel controller 223_C may determine whether to perform additional rounds based on the number of rounds performed in the plurality of rounds ROUND. When the plurality of rounds ROUND are completed, the wheel controller 223_C may provide the output RS provided by the rotation shift operator 223_RS to the final shuffle unit. When the plurality of rounds ROUND are not completed, the wheel controller 223_C may provide the output RS provided by the rotation shift operator 223_RS to the multiplexer 223_MU.

[0116] The multiplexer 223_MU can select any one of the second block LSB provided by the initial shuffle unit and the output RS provided by the rotation shift operator 223_RS, and can provide the selected LSB or RS to the modular adder 223_MA. The multiplexer 223_MU can select one of the second block LSB and the output RS as an output to the modular adder 223_MA based on the selection signal SEL provided by the wheel controller 223_C.

[0117] The modular adder 223_MA performs a modular addition operation on one of the second block LSB and the output RS and the round key provided by the key selector 223_K. The modular adder 223_MA may provide a result MA of the modular addition operation to the rotation shift operator 223_RS.

[0118] The rotation shift operator 223_RS may receive the direction of the rotation shift operation LEFT (left) or RIGHT (right), and may perform an S-bit rotation shift operation on the result MA of the modulo addition operation. According to some example embodiments, the rotation shift operator 223_RS may perform a 1-bit rotation shift operation. The rotation shift operator 223_RS may provide the result RS of the rotation shift operation to the wheel controller 223_C.

[0119] Therefore, according to Fig.12The intermediate shuffle logic 223_2 of the example embodiment of FIG. 1 may shuffle a plurality of rounds based on the intermediate shuffle logic having a small area.

[0120] According to some example embodiments, the intermediate shuffle logic 223_2 may be provided as a plurality of Fig.11 As described in.

[0121] Fig.13 is a flow chart illustrating a method of generating a random permutation according to some example embodiments.

[0122] A method of generating a random arrangement according to some example embodiments may be performed by Figure 1 processor and Figure 5 and Fig.11 This is performed by the shuffle circuit described in .

[0123] The shuffle circuit can shuffle a plurality of elements of the basic arrangement data to generate a random arrangement. The shuffle circuit can process a plurality of numbers, ie, elements of the basic arrangement data, in parallel independently of each other to shuffle the processed numbers.

[0124] Alternatively, the shuffling circuit may sequentially receive a plurality of numbers, ie, elements of the basic permutation data, and may shuffle the binary bits of each number to output numbers constituting a random permutation.

[0125] In operation S110 , the shuffling circuit may receive basic arrangement data and a plurality of key sets.

[0126] The elements of the basic arrangement data may be a plurality of non-overlapping numbers. In this case, the shuffling circuit may generate and shuffle index numbers corresponding to the elements of the basic arrangement data.

[0127] In some example embodiments, the elements of the basic arrangement data may be a sequence of index numbers.

[0128] When the basic arrangement data is X={x 0 , x 1 , x 2 , ..., x N-1}, the random permutation of shuffling and output can be Y = {y 0 ,y 1 ,y 2 , ..., y N-1}, where yi and yj are different from each other, and i and j are different from each other.

[0129] The shuffling circuit may be provided with multiple keys and a number of rounds R.

[0130] The shuffling circuit may be provided with a round number R together with the basic arrangement data. The round number R is a reference Fig.14The number of rounds performed in the described intermediate shuffle operation. The number of rounds R can be preset based on the number of bit digits (bit size) and complexity of the basic arrangement data. The complexity can be the complexity required by the security specification and / or the hiding countermeasure. The number of rounds R can be selected based on the above Table 1.

[0131] The multiple keys may include multiple round keys for each round. For example, a single key set may be K = {k 0 , k 1 , ..., k R}, including the R-round keys used in the R-round of the intermediate shuffle operation and the final key used in the final shuffle operation. Multiple key sets may be provided.

[0132] In operation S120 , the shuffling circuit may shuffle elements of the basic arrangement data by performing a modular addition operation and a rotation shift operation on the basic arrangement data.

[0133] The modular addition operation and the rotation shift operation may be bit-by-bit operations and may be performed on each element of the base arrangement data.

[0134] For example, the basic arrangement data X = {x 0 , x 1 , x 2 , ..., x N-1 A bit-by-bit operation is performed on each element of}, and the result of performing the bit-by-bit operation on each element can constitute a randomly arranged element.

[0135] The modular addition operation can be Figure 3 The key provided in operation S110 may be used for a modular addition operation. The rotation shift operation may be as follows: Figure 4 Described as shown.

[0136] Fig.14 It shows that according to Fig.13 Flowchart of the shuffling operation in operation S120 of the method of generating a random permutation according to an example embodiment of the present invention.

[0137] The shuffle circuit may perform an initial shuffle operation, an intermediate shuffle operation, and a final shuffle operation.

[0138] In operation S121, the shuffling circuit may process the processing data (basic arrangement data X={x 0 , x 1 , x 2 , ..., x N-1The shuffle circuit may perform a modular addition operation on the result of the modular addition operation (single element of}) and the initial key. The shuffle circuit may perform an S-bit rotation shift operation on the result of the modular addition operation. The S bits may be randomly determined. The initial key may be a randomly generated key of n bits (logN). The shuffle circuit may perform a rotation shift operation in a left direction.

[0139] The shuffle circuit may divide the result of the rotate-shift operation in operation S121 into two blocks (a first block and a second block), and may provide the two blocks to an intermediate shuffle operation.

[0140] In operation S123, the shuffle circuit may perform R rounds of shuffle operations based on the second block. Each round of shuffle operations may be performed by a modular addition operation and a rotation shift operation. According to some example embodiments, the shuffle circuit may utilize R / 2 rounds of shuffle operations to achieve the required complexity.

[0141] The key set K provided in operation S110 is 0 , k 1 , ..., k R The round key of} can be used for the modular addition operation of each round of shuffling operation.

[0142] The following will refer to Fig.15 Describe the round shuffle operation in detail.

[0143] In operation S123a, among the plurality of key sets, a single key set may be selected based on the first block provided in operation S121. Each key set may include R round keys and a final key used in a final shuffling operation.

[0144] In operation S123b, a modular addition operation may be performed on a round key corresponding to each round operation among the round keys of the selected key set and an operation result provided in a previous round operation.

[0145] In operation S123c, an S-bit rotation shift operation may be performed on the result of the modular addition operation. According to some example embodiments, a 1-bit rotation shift operation may be performed.

[0146] A portion of the total R rounds of shuffle operations may be a rotate-shift operation performed in the left direction, and another portion may be a rotate-shift operation performed in the right direction. For example, for a total of R rounds of shuffle operations, a rotate-shift operation may be performed in the left direction in the first half of the round shuffle operations, and a rotate-shift operation may be performed in the right direction in the second half of the round shuffle operations.

[0147] In operation S123d, when the round shuffle operation is performed a plurality of times (such as a predetermined number of times), the shuffle circuit may stop the round shuffle operation.

[0148] Although Fig.15It is described on the premise that the round shuffle operation is repeatedly performed in a single round unit in a recursive manner, but according to example embodiments, the round shuffle operation may be continuously performed in a plurality of round units.

[0149] return Fig.14 In operation S125, the shuffle circuit may perform a final shuffle operation. The final shuffle operation may include a modular addition operation and a rotation shift operation.

[0150] The shuffle circuit may perform a modular addition operation on the operation result in the intermediate shuffle operation S123 and the final key. The shuffle circuit may perform a rotation shift operation on the result of the modular addition operation. The rotation shift operation in the final shuffle operation S125 may be performed on data obtained by merging the result of the modular addition operation and the first block. The shuffle circuit may perform an S-bit rotation shift operation on the result of the modular addition operation. The S bits may be randomly determined. The shuffle circuit may perform a rotation shift operation in the right direction.

[0151] As described above, methods and apparatus for generating random permutations according to some example embodiments may generate random permutations in a manner capable of performing parallel processing while achieving or facilitating achievement of required or desired complexity.

[0152] Alternatively or additionally, methods and apparatus for generating random permutations according to various example embodiments may process multiple operations in parallel based on random permutations generated in a manner that enables parallel processing while achieving or facilitating achievement of required or desired complexity.

[0153] Any of the elements and / or functional blocks disclosed above may include processing circuits or may be implemented in processing circuits, such as hardware including logic circuits, hardware / software combinations, such as processors that execute software; or combinations thereof. For example, the processing circuits may more specifically include, but are not limited to, a central processing unit (CPU), an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), a system on a chip (SoC), a programmable logic unit, a microprocessor, an application specific integrated circuit (ASIC), etc. The processing circuit may include electrical components such as at least one of a transistor, a resistor, a capacitor, etc. The processing circuit may include electrical components such as logic gates, including at least one of an AND gate, an OR gate, a NAND gate, a NOT gate, etc.

[0154] Although various example embodiments have been shown and described above, it will be apparent to those skilled in the art that modifications and variations may be made without departing from the scope of the inventive concept as defined by the appended claims. In addition, the example embodiments are not necessarily mutually exclusive. For example, some example embodiments may include one or more features described with reference to one or more figures, and may also include one or more other features described with reference to one or more figures.

Claims

1. A processor, comprising: The controller is configured to assign different index numbers to the plurality of operations respectively; shuffle logic configured to perform a bit-by-bit operation on each of the index numbers based on a modular addition operation and a rotation-shift operation to shuffle the index numbers; as well as The operation logic is configured to perform the plurality of operations based on the shuffled index numbers.

2. The processor according to claim 1, wherein: The shuffle logic comprises at least one wheel unit, The at least one round unit is configured to perform a shuffle operation, the shuffle operation comprising: the modular addition operation and the rotation shift operation performed on a round key and provided input data, and The number of times the shuffling operation is performed is set based on the number of bits of the index number and the complexity of the setting.

3. An integrated circuit comprising: processing logic configured to provide the shuffle logic with processed data on which at least one operation is to be performed; as well as The shuffle logic is configured to perform a bit-by-bit operation on at least a portion of the processed data based on a modular addition operation and a rotation-shift operation.

4. The integrated circuit according to claim 3, wherein: The shuffling logic includes a first logic unit configured to output first data by performing a modular addition operation on the processed data and the random initial key, and to generate a shuffle signal by performing a shuffle operation on the first data in a left direction. to output the second data.

5. The integrated circuit of claim 4, wherein: The shuffling logic includes a plurality of round units and a plurality of key selection units, wherein the plurality of key selection units are configured to provide round keys to the plurality of corresponding round units, respectively. The shuffle logic is configured to divide the second data into a first block and a second block, Each of the plurality of key selection units is configured to select the round key from a plurality of keys based on the first block, and Each of the plurality of round units is configured to perform a modular addition operation on input data and a round key, and to perform a rotation shift operation on a result of the modular addition operation on the input data and the round key.

6. The integrated circuit of claim 5, wherein: The plurality of wheel units include an initial wheel unit and an intermediate wheel unit, The initial round unit is configured to receive the second block as the input data, and The intermediate wheel unit is configured to receive the output of the initial wheel unit as the input data.

7. The integrated circuit according to claim 6, comprising: The second logic unit is configured to calculate the final output data based on the output of the intermediate wheel unit, wherein: The second logic unit includes: a modular adder configured to perform a modular addition operation on a round key selected from the plurality of keys based on the first block and an output of the intermediate round unit; and A rotation shift calculator is configured to perform a rotation shift operation on a result of combining the output of the modulo adder and the first block in a right direction, and the rotation shift calculator is configured to calculate the final output data.

8. The integrated circuit of claim 3, wherein: The shuffle logic includes a plurality of shuffle logics, Each of the plurality of shuffle logics is configured to receive a different processed data segment and output output data having at least one shuffled bit, and The output data of each of the plurality of shuffle logics corresponds to an arrangement in which the different processed data segments are randomly shuffled.

9. An integrated circuit comprising: processing logic configured to provide different processed data segments to the plurality of shuffle logics; as well as The plurality of shuffle logics are configured to perform bit-by-bit operations on at least a portion of the processed data based on a modular addition operation and a rotation shift operation, wherein: The output data of each of the plurality of shuffle logics sets the arrangement in which the differently processed data segments are shuffled.

10. The integrated circuit of claim 9, wherein: Each of the plurality of shuffle logics is configured to perform a bit-by-bit operation on the processing data independently of one another.

11. The integrated circuit of claim 9, wherein: Each of the plurality of shuffle logics is configured to perform a bit-by-bit operation within a same clock cycle.

12. A method for generating a random permutation performed by a processor of a computing device, the method comprising: receiving a plurality of key sets and basic arrangement data set by a plurality of numbers; as well as The numbers of the basic arrangement data are shuffled by performing a bit-by-bit operation on each number of the basic arrangement data based on a modular addition operation and a rotation shift operation.

13. The method according to claim 12, wherein: The bit-by-bit operation is performed independently on each of the digits of the basic arrangement data.

14. The method according to claim 12, wherein: The shuffling of the numbers of the basic arrangement data comprises: performing an initial shuffling operation of a first modular addition operation and a first rotation-shift operation, the first modular addition operation and the first rotation-shift operation being based on the number of bit digits of the digits of the basic arrangement data; performing an intermediate shuffling operation of a second modular addition operation and a second rotation-shift operation, the second modular addition operation and the second rotation-shift operation being based on the number of digits of a portion of the digital bit block of the basic arrangement data; and A final shuffling operation of a third modular addition operation based on the number of digits of the portion of the bit block and a third rotation-shift operation based on the number of bit digits of the number of the basic arrangement data is performed.

15. The method according to claim 14, wherein: A result of the initial shuffle operation is divided into a first block and a second block, and the first block and the second block are provided to the intermediate shuffle operation, and The second modular addition operation and the second rotational shift operation are performed on the second block.

16. The method according to claim 15, wherein: The first block includes the two most significant bits of the result of the initial shuffle operation, and the second block includes remaining bits of the result of the initial shuffle operation except the two most significant bits.

17. The method of claim 15, wherein: The intermediate shuffle operation includes multiple round shuffle operations, and Each of the plurality of round shuffling operations comprises: selecting a round key from the plurality of key sets based on the first block; performing the second modular addition operation on the round key and input data received in a previous operation; and The second rotational shift operation is performed on a result of the second modular addition operation in a right direction.

18. The method according to claim 14, wherein: A shift direction of the first rotational shift operation is different from a shift direction of the third rotational shift operation.

19. The method according to claim 15, wherein: The final shuffling operation includes: performing a third modular addition operation on a round key selected from the plurality of key sets based on the first block and a result of the intermediate shuffle operation; combining a result of the third modular-add operation with the first block; and The third rotation and shift operation is performed on the combined result.

20. The method according to claim 17, wherein: The plurality of rounds of shuffling are performed a number of times based on the number and complexity of bit digits of the numbers of the basic arrangement data.

Images