A secure and efficient hardware implementation system for the Ascon lightweight cryptographic algorithm

Abstract

This invention discloses a secure and efficient hardware implementation system for the Ascon lightweight cryptographic algorithm. The system's core modules include: a finite state machine module that redefines the seven-state FSM required for implementing authenticated encryption mode and hash function mode into a four-state FSM by using input multiplexing to combine certain states. The FSM also reduces the number of inputs associated with each state from seven to three. A ROM-based finite state machine module is designed based on the redefined FSM, which implements transitions between the four states and outputs corresponding operations. A round operation-exclusive OR module is designed based on the user-defined side channel protection level, introducing DOM technology. The module performs corresponding exclusive OR and round operations on state data based on received operations and the current system state. The invention supports authenticated encryption mode and hash function mode, as well as any level of side channel security defense.

Description

Technical Field

[0001] The present invention belongs to the technical field of cryptography, and in particular relates to a hardware implementation system for a secure and efficient Ascon lightweight cryptographic algorithm. Background Art

[0002] Embedded devices, with their efficient customization and real-time performance, have become core control and monitoring components for the Internet of Things and critical infrastructure. To ensure the security and stability of these facilities, cryptographic protection is essential to prevent unauthorized access and tampering. However, the vast majority of embedded devices utilize extremely low-power microcontrollers, which dedicate only a small portion of their computing power to system security. Traditional encryption algorithms, due to their high resource consumption, are unsuitable for resource-constrained embedded devices. Therefore, lightweight cryptographic algorithms designed for low power and resource consumption have emerged, perfectly meeting the needs of embedded devices.

[0003] Among leading lightweight algorithms, the Ascon cryptographic suite is recognized for its exceptional security and robustness in practice, while maintaining a very small hardware footprint. The suite integrates authenticated encryption and hash functions with associated data, including authenticated encryption modes (Ascon-128 and Ascon-128a) and hash function modes (Ascon-hash and Ascon-hasha). Ascon utilizes the Sponge mode, dynamically updating 320 bits of state data using a Substitution-Permutation Network (SPN) rotation, ensuring efficient operation in a variety of environments and particularly suited for resource-constrained devices. Furthermore, with an increasing number of devices operating in environments potentially vulnerable to physical attacks, hardware implementations of the Ascon cryptographic algorithm present security risks. In the underlying implementation of the Ascon cryptographic algorithm, the number of data flips in the CMOS logic circuits directly impacts power consumption. By connecting a resistor in parallel with the power supply line, the power consumption variation under varying plaintext inputs can be measured, allowing sensitive information such as encryption keys to be inferred. In recent years, several FPGA-based implementations of the Ascon algorithm have been proposed, aiming to achieve breakthroughs in resource consumption, frequency, throughput, supported modes, and security. FPGA-based Ascon cryptographic schemes can be broadly categorized into two categories, depending on their focus: 1. Performance enhancements, employing strategies such as pipelining, full expansion, parallel processing, and serialization to improve efficiency or reduce resource consumption; 2. Security enhancements, employing threshold implementation techniques to defend against side-channel attacks.Among the performance-enhancing solutions: the article "Xu D, Wang X, Hao Q, et al. A High-Performance Transparent Memory Data Encryption and Authentication Scheme Based on Ascon Cipher [J]. IEEE Transactions on Very Large Scale Integration (VLSI) Systems, 2024." proposes a transparent memory data encryption and authentication hardware protection scheme based on Ascon-128. Through multi-stage pipeline design and multi-stage address tag optimization processing, it completes low-latency and high-performance hardware implementation; the article "Pallavi L, Singh P, Patnaik B, et al. High frequency architecture of lightweight authenticated cipher ASCON-128 for resource-constrained IoT devices [C] / / 2023 OITS International Conference on Information Technology (OCIT). IEEE, 2023: 405-410." focuses more on frequency improvement. By dividing the 320-bit internal sponge state S of Ascon-128 into two parts for parallel processing, a high-frequency hardware architecture is achieved.Among the security enhancement solutions: the article "Diehl W, Farhamand F, Abdulgadir A, et al. Face-off between the CAESAR Lightweight Finalists: ACORN vs. Ascon[C] / / 2018 International Conference on Field-Programmable Technology (FPT). IEEE, 2018: 330-333." compares the FPGA implementations of side-channel protection for ACORN and Ascon, and applies a hybrid 2 / 3 share threshold to achieve protection in both Ascon-large and Ascon-small design strategies to effectively defend against differential power analysis; the article "Kandi A, Baksi A, Gerlich T, et al. Hardware Implementation of ASCON[C] / / NIST LWC Workshop. 2023." uses a 3-share threshold to implement side-channel protection for the three stages of the round operation: the round constant XOR layer, the substitution layer, and the linear layer, and designs two sharing options for the only nonlinear component, the S-box.

[0004] However, hardware implementations of the Ascon cryptographic algorithm have not been fully explored. There is a lack of a solution that can implement both authenticated encryption and hashing modes while striking a good balance between resource consumption and performance. Hardware security is crucial, but existing solutions cannot effectively protect against high-level side-channel attacks. Therefore, it is imperative to explore and design a hardware solution that can resist high-level side-channel attacks, support multiple instance modes, and operate efficiently. Summary of the Invention

[0005] In order to solve the above problems existing in the prior art, the present invention provides a secure and efficient hardware implementation system of the Ascon lightweight cryptographic algorithm. The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0006] The embodiment of the present invention provides a secure and efficient hardware implementation system of the Ascon lightweight cryptographic algorithm, the system comprising:

[0007] The pre-processing module is used to transmit the data required for system operation to the system through the defined input interface according to the user-defined instance mode type, side channel protection level, and current input data type. The instance mode types include authenticated encryption mode and hash function mode.

[0008] The core module includes a finite state machine module and a round operation-XOR module; the finite state machine module is used to redefine the 7-state FSM required for implementing the authenticated encryption mode and the hash function mode into an FSM containing 4 states by using input multiplexing to combine certain states, and the number of related inputs for each state is changed from 7 to 3. A ROM-based finite state machine module is designed based on the redefined FSM, and the transfer of 4 states is implemented and the corresponding operations are output based on the ROM-based finite state machine module; the round operation-XOR module is used to design a corresponding round operation module based on the side channel protection level set by the user. When the side channel protection level is greater than 0, the DOM technology is introduced in the round operation module, and the corresponding XOR operation and round operation are performed on the state data based on the operation output by the finite state machine module and the current system state.

[0009] The post-processing module is used to store the data processed by the system and send a signal to the outside world indicating that the system operation is completed.

[0010] Beneficial effects of the present invention:

[0011] The present invention proposes a secure and efficient hardware implementation system for the Ascon lightweight cryptographic algorithm. This system utilizes an optimized ROM-based finite state machine (FSM) and DOM-based round operations, achieving a secure and efficient hardware implementation of the Ascon algorithm that integrates both authenticated encryption and hash function modes. Compared to existing implementations, the proposed system offers greater flexibility in application scenarios. By replacing the traditional register-based FSM with an optimized ROM-based FSM, it achieves higher frequencies and throughput with fewer resources. Furthermore, by incorporating DOM technology into round operations, it implements side-channel protection. Furthermore, the proposed system can be easily extended to higher-level side-channel protection, overcoming the inadequate security and inability to strike a good balance between resource consumption and efficiency associated with existing implementations. This allows its application in a wider range of resource-constrained embedded devices, such as those requiring encryption in network systems, wireless sensor networks, radio frequency identification (RFID) chips, smart home products, and contactless smart cards. Overall, the proposed system not only meets the functional, area, and throughput requirements of resource-constrained embedded devices, but also plays a key role in ensuring data security, providing a stronger foundation for the Ascon cryptographic algorithm in a wide range of practical applications.

[0012] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 Schematic diagram of the structure of a hardware implementation system for a secure and efficient Ascon lightweight cryptographic algorithm provided by an embodiment of the present invention;

[0014] Figure 2 This is a symbolic diagram of the seven states and related input signals involved in the traditional FSM;

[0015] Figure 3 This is a state transition diagram of the 7 states corresponding to the traditional FSM;

[0016] Figure 4 1 is a schematic diagram of the state transition of the optimized ROM-based FSM provided by an embodiment of the present invention;

[0017] Figure 5 1 is a schematic structural diagram of a ROM-based finite state machine module provided in an embodiment of the present invention;

[0018] Figure 6 2 is a schematic structural diagram of a round operation-XOR module provided in an embodiment of the present invention;

[0019] Figure 7 1 is a schematic structural diagram of a wheel operation module designed for a case where side channel protection is not performed, as provided in an embodiment of the present invention;

[0020] Figure 8 Schematic diagram of the structure of a DOM-based AND gate provided by an embodiment of the present invention;

[0021] Figure 9 This is a schematic diagram of the structure of the wheel operation module designed for level 1 side channel protection provided by an embodiment of the present invention;

[0022] Figure 10 Schematic diagram of the overall operation flow of the Ascon cryptographic algorithm provided by an embodiment of the present invention;

[0023] Figure 11 Schematic diagram of the implementation of the authentication encryption mode of the Ascon cipher provided in an embodiment of the present invention;

[0024] Figure 12 It is a schematic diagram of the implementation of the hash function mode of the Ascon cryptographic algorithm provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The present invention will be further described in detail below with reference to specific examples, but the embodiments of the present invention are not limited thereto.

[0026] See Figure 1 The embodiment of the present invention provides a secure and efficient hardware implementation system of the Ascon lightweight cryptographic algorithm, the system comprising:

[0027] The pre-processing module is used to transmit the data required for system operation to the system through the defined input interface according to the user-defined instance mode type, side channel protection level, and current input data type. The instance mode types include authenticated encryption mode and hash function mode.

[0028] The core module includes a finite state machine module and a round operation_XOR module; the finite state machine module is used to redefine the 7-state FSM (Finite State Machine) required for implementing the authenticated encryption mode and the hash function mode into an FSM containing 4 states by using input multiplexing to combine certain states, and the number of related inputs for each state is changed from 7 to 3. A ROM-based finite state machine module is designed based on the redefined FSM, and the ROM-based finite state machine module is used to implement the transfer of 4 states and output corresponding operations; the round operation_XOR module is used to design a corresponding round operation module according to the side channel protection level set by the user. When the side channel protection level is greater than 0, the DOM (Domain-Oriented Masking) technology is introduced in the round operation module, and the corresponding XOR operation and round operation are performed on the state data according to the operation output by the finite state machine module and the current system state.

[0029] The post-processing module is used to store the data processed by the system and send a signal to the outside world indicating that the system operation is completed.

[0030] As can be seen, the overall framework module of the hardware implementation system proposed in this invention consists of three major modules: a preprocessing module, a core module, and a post-processing module. Both the preprocessing module and the post-processing module are equipped with first-in-first-out (FIFO) and cascade registers to ensure seamless storage and efficient processing of input and output data. Furthermore, the resizable external data interface design enables flexible adaptation to various communication interface standards, such as UART, SPI, and I2C. The core module, as the main body of the design, is responsible for executing the core round operations (p) and controlling system behavior. It includes a finite state machine (FSM) module and a round operation-XOR module. The FSM module calculates and outputs the next state and necessary information based on the current input and state, while the round operation-XOR module executes the corresponding XOR operation and round operation (p) based on the FSM output. The FSM module uses an optimized ROM-based FSM instead of a traditional register-based FSM, thereby reducing resource consumption while increasing frequency and throughput. The round operation-XOR module incorporates DOM technology to achieve side-channel protection at any level.

[0031] Next, Figure 1 The framework shown is introduced in detail.

[0032] like Figure 1As shown: For the pre-processing module, 5 input interfaces are defined, which are respectively recorded as Mode, SHARES, I_Valid, I_Data, and Start, and 9 output interfaces are respectively recorded as StartEnc, Mode, Key, Nonce, BlockDin, PHCounter, AMCounter, Random, and RoundDone. For the core module, 9 input interfaces are defined, which correspond one-to-one to the output interfaces of the pre-processing module, and 5 output interfaces are respectively recorded as CHReady, TagReady, Done, BlockDout, and Tag. For the post-processing module, 5 input interfaces are defined, which correspond one-to-one to the output interfaces of the core module, and 4 output interfaces are respectively defined as O_CHReady, O_TagReady, O_Done, and O_Data. More specifically:

[0033] Mode defines the instance mode types that the system can support, including authenticated encryption mode and hash function mode. The authenticated encryption mode includes Ascon-128 and Ascon-128a, and the hash function mode includes Ascon-hash and Ascon-hasha. For different instance modes, the data processing path and core processing logic are basically the same; SHARES defines the side channel protection level. When the side channel protection level is 0, the corresponding input value of SHARES is 1, indicating that there is no protection measure. At this time, the round operation_XOR module is the initial implementation method of the design. When the side channel protection level is 1, the corresponding input value of SHARES is 2. When the side channel defense level is d1 (d1>1), the corresponding input value of SHARES is d1+1; Start defines the system start signal, which triggers the preprocessing module to start working; I_Valid defines the input data type, namely the one-time random number Nonce, key, association Data / message, plaintext, ciphertext and random number Random; I_Data defines the interface size for the system to receive input data, and O_Data defines the interface size for the system to output data. These sizes can be adjusted according to the specific requirements of the external interface; Key defines the system's 128-bit key; Nonce defines the system's 128-bit random number; BlockDin defines the f-bit associated data / plaintext data (authenticated encryption mode) or information (hash function mode) transmitted to the core module; PHCounter defines the number of plaintext data blocks / hash data blocks to be processed; AMCounter defines the number of associated data blocks / information data blocks to be processed; Random defines the random number used for side channel protection. The introduction of Random is to increase the uncertainty of calculation in side channel protection, and its size varies according to the protection level and strategy; RoundDone defines completion That is, the round operation p of a1 or the round operation p of b1 is completed. At this time, a round operation completion signal is sent to the pre-processing module, which prompts the pre-processing module to transfer the next data block BlockDin to the core module until all data blocks are processed; CHReady defines that a ciphertext data / hash data block has been successfully obtained. At this time, the data block can be transferred to the post-processing module for storage; TagReady defines that the tag Tag is ready; Done defines that the system operation is completed; BlockDout defines the r-bit ciphertext / hash value transmitted to the post-processing module; Tag defines a 128-bit tag; O_CHReady informs the outside world that the ciphertext / hash value is ready; O_TagReady informs the outside world that the tag is ready; O_Done informs the entire system that the processing is completed.

[0034] Furthermore, if Figure 2 and Figure 3 As shown, using a traditional FSM to implement both authenticated encryption and hash functions involves seven states: idle state s0, initialization state s1, associated data state s2, plaintext state s3, finalization state s4, information absorption state s5, and tag squeeze state s6. The seven relevant input signals involved in the traditional FSM are the encryption start signal a, the round operation completion signal b, the encryption mode signal c, the associated data presence determination signal d, the determination signal e whether the processed associated data / information is the last data block, the determination signal f whether the processed plaintext data block / hash data block is the last data block, and the system completion signal g. s0 corresponds to the system idle state, i.e., waiting for an external signal trigger; s1 through s4 correspond to the authenticated encryption mode's initialization, associated data, plaintext, and finalization phases, respectively; and s1, s5, and s6 correspond to the hash function phases: initialization, information absorption, and tag squeeze. In implementation, the initial round operation a1 of tag squeeze is considered the final step of information absorption and is assigned to state s5.

[0035] In order to achieve the goal of reducing resource consumption while improving efficiency, the inventors Figure 3An analysis of the traditional FSM shown in the figure reveals that: in the traditional FSM, the relevant inputs for a state to jump to the next state do not involve all inputs, and there are always some inputs that do not need to be cared about. For example, in the idle state s0, the only thing related to its next state is the start encryption signal a, that is, no matter what the signals b~g are, as long as the start encryption signal a is 1, the system state will jump from the idle state s0 to the initialization state s1. For example, in the initialization state s1, the signals related to its next state are b, c, and d. When a1 completes the round operation p (b=1): if the current selection mode is the authentication encryption mode (c=1) and there is no associated data (d=0), then the next state is the plaintext state s3; if the current selection mode is the authentication encryption mode (c=1) but there is associated data (d=1), then enter the associated data state s2; if the current selection mode is the hash function mode (c=0), then directly enter the information absorption state s5. If the current If not completed (b=0), the initialization state s1 is maintained.

[0036] Therefore, the embodiment of the present invention proposes to use input multiplexing technology, which uses irrelevant inputs to combine certain states and uses a multiplexer to select the corresponding input for each new state. Since the maximum number of relevant inputs for the next jump state of a specific state (s0~s6) is 3, that is, the relevant inputs of the initialization state s1 are b, c, and d, and the number of relevant inputs for other states is less than 3. The FSM redefined according to the input multiplexing technology is as follows Figure 4 As shown, the four states in the redefined FSM include the first state s 04 , second state s1, third state s 25 and the fourth state s 36 ; First state s 04 It is a combination of the idle state and the finalization state. The second state s1 is the initialization state, and the third state s 25 The fourth state s is the combination of the associated data state and the absorbed information state. 36 It is composed of the plaintext state and the squeezed tag state. In the redefined FSM, the relevant input of each state jumping to the next state is updated to 3 bits in1, in2, in3. Among them, Figure 4 ps represents the current state, pis represents the relevant input of the current state, in represents the specific value of the relevant input of the current state, ns represents the next state, nis represents the relevant input of the next state, and out represents the operation corresponding to the output of the current state.

[0037] To implement the redefined FSM, the ROM-based finite state machine module designed in the embodiment of the present invention is as follows: Figure 5 As shown, it includes a 2-way selector MUX1, a 4-way selector MUX2, a 3-way selector MUX3, and a ROM memory; wherein,

[0038] The ROM memory is used to pre-store in each storage unit a first selection signal, a second selection signal, a third selection signal, an operation output corresponding to a current state, and a next jump state of the current state;

[0039] The 2-way selector MUX1 is used to select and output the first signal in1 from the encryption start signal and the round operation completion signal according to the first selection signal; it can be seen that the related input signals of the first signal in1 are a / b.

[0040] The 4-way selector MUX2 is used to select and output the second signal in2 from the encryption mode signal, the judgment signal of whether the processed associated data / information is the last data block, the judgment signal of whether the processed plaintext data block / hash data block is the last data block, and the system completion signal according to the second selection signal; it can be seen that the related input signals of the second signal in2 are c / e / f / g.

[0041] The 3-way selector MUX3 is used to select and output a third signal in3 from 0, 1 and the judgment signal of whether the associated data exists according to the third selection signal; it can be seen that the related input signals of the third signal in3 are 0 / 1 / d.

[0042] The ROM memory is also used to retrieve the corresponding operation from the corresponding storage unit of the ROM memory and output it according to the first signal in1, the second signal in2, the third signal in3 and the current state, and update the current state, the first selection signal, the second selection signal and the third selection signal. It can be seen that the content of each storage unit in the ROM memory is: the first selection signal sel1, the second selection signal sel2 and the third selection signal sel3 of the multiplexer (5 bits), the output operation signal out (3 bits) and the next jump state ns (2 bits), whose size is 2 (3+2) ×(5+3+2)=320.

[0043] The operation process of the overall finite state machine module is as follows:

[0044] 1) At the start, the default initial value of each signal is: ps = s 04 , in3=0. The system is in the first state s 04 In idle state.

[0045] 2) The encryption start signal in1(a) becomes high, and the system enters the initialization state s1. The next state is selected based on the round operation completion signal in1(b), the encryption mode signal in2(c), and the judgment signal in3(d) indicating whether the associated data exists. When b=0, the system remains in the initialization state s1; when b=1, if c=1 and d=1, the system enters the third state s 25In the associated data state (in3=0); c=1, d=0, the system enters the fourth state s 36 Plaintext state (in3=0); c=0 enters the third state s 25 Absorbing information state (in3=1).

[0046] 3) If it is the third state s 25 , that is, the associated data state / absorbed information state. When the signal in1(b)=1, if the signal in2(e)=1, the system enters the fourth state s 36 If the signal e=0, it indicates that there are still related data blocks / information blocks that have not been processed. The system remains in the original state to process the next data block until all data blocks are processed. When the signal b=0, it indicates that the b1 round operation has not been completed and remains in the original state.

[0047] 4) If it is the fourth state s 36 , namely the plaintext state / squeezed tag state. When the last plaintext data block (in2(f)=1) is processed or the 256-bit hash data (b=1, f=1) is successfully obtained, the plaintext phase of the system authentication encryption mode is completed and enters the first state s 04 The finalization state (in3=1), or the hash function mode is completed and returns to the first state s 04 Idle state (in3=0).

[0048] 5) The system is in the first state s 04 After the finalization state in the system completes 12 rounds of operations, the system completes the signal g = 1, and the authentication encryption mode is completed and returns to the first state s 04 Idle state.

[0049] During operation of the embodiment of the present invention, the ROM_finite state machine module reads the next jump state and the selection signal of the state-related input from the ROM according to the value of the input signal and the current state, and outputs the operation to be performed at this time out to the round operation_XOR module.

[0050] Furthermore, in order to resist any level of side channel attacks, the embodiment of the present invention is designed as follows Figure 6 The round operation XOR module shown in the figure includes an 8-way selector MUX4, a 4-way selector MUX5 and a round operation module; wherein,

[0051] The 8-way selector MUX4 and the 4-way selector MUX5 are responsible for executing the XOR operations and updating the state data required at each stage of the Ascon lightweight cryptographic algorithm, and outputting the updated data as the input data for the current round. The round operation module is used to perform specific round operations on the input data for the current round. The operation process of the round operation_XOR module is as follows:

[0052] When the system is in idle state, out=0, state=s 04 , in3=0, at this time, the 320-bit state data S processed by Ascon, the processed associated data / information block length AM, and the plaintext / hash block length PH are all 0. When the encryption start signal is triggered, the fourth selection signal sel4 value is 0, that is, the round operation input data I_P=(IV, Key, Nonce} (if it is the hash function mode at this time, the Key and Nonce values ​​are set to 0). Subsequently, after completing the a1 / b1 round operation, the selection signals of MUX4 and MUX5 are updated according to the latest out, state and in3, and the state data S, AM and PH are processed. The processed state data is sent to the Permutation module for round operation. For example, it is currently in the authentication encryption mode, its initialization phase is over and there is no associated data, then the out value output by the ROM finite state machine module should be 7, that is, the XOR operation of the state data S at the end of the initialization phase with the key and the last bit flip operation at the end of the associated data phase need to be completed at this time, At the same time, if there is only one plaintext data block at present, the fourth selection signal sel4 should be 2, and the input data of the round operation needs to XOR the updated state data S with the plaintext and the key at the same time, that is, If the plaintext data block length is greater than 1, the fourth selection signal sel4 is 1. Where S = S r ||S c =x0||x1||x2||x3||x4.

[0053] In the round operation module Permutation, the round constant XOR layer p C , replace layer p S and linear layer p L The specific implementation formula is as follows:

[0054]

[0055] In the wheel operation module, slightly different wheel operation modules are designed for different levels of side channel protection.

[0056] Specifically:

[0057] In the embodiment of the present invention, when the side channel protection level is level 0, it indicates that the side channel protection is not performed; the round operation module includes a round constant XOR layer p C , replace layer p S and linear layer p L ;in,

[0058] Round constant XOR layer p C, using XOR gate, bit splicing operator and inverter to achieve, bit splicing operator and inverter generate the corresponding round constant RC according to the current round operation counter; replace layer p S , using combinational logic circuits, including XOR gates, AND gates, and inverters; linear layer p L , implemented using XOR gates and bit-splicing operators;

[0059] The current round input data passes through the round constant XOR layer p in turn C , replace layer p S and linear layer p L Finally, the data after rounds of operations are output.

[0060] In the embodiment of the present invention, when the side channel protection level is level 1, the wheel operation module introduces the DOM technology. The wheel input data is divided into two shares before entering the wheel operation. The two shares belong to independent domains respectively. The wheel operation module includes a wheel constant XOR layer p C , replace layer p S and linear layer p L , for a round constant XOR layer p containing only nonlinear operations C and linear layer p L , respectively, in two independent domains, for the replacement layer p including linear and nonlinear operations S , linear operations need to be performed in two independent domains respectively, and non-linear operations use DOM-based AND gates to achieve cross-domain re-sharing;

[0061] Round constant XOR layer p C , using XOR gates, bit splicing operators and inverters to achieve, the bit splicing operator and inverter generate the corresponding round constant RC according to the current round operation counter; linear layer p L , implemented using XOR gates and bit-splicing operators; replacing layer p S , where the linear operation is implemented using XOR gates and inverters, and the nonlinear operation is implemented using DOM-based AND gates ( Figure 8 The AND gate based on DOM is implemented using multipliers, XOR gates and registers.

[0062] The two shares of corresponding input data are sequentially passed through the round constant XOR layer p C , replace layer p S and linear layer p L After that, the output data corresponding to the two shares are XORed to obtain the output data of the current round.

[0063] In the embodiment of the present invention, when the side channel protection level is d1 (d1>1), the round operation module introduces the DOM technology. The round operation input data is divided into d1+1 shares before entering the round operation. These d1+1 shares belong to independent domains respectively. The round operation module includes a round constant XOR layer p C , replace layer p S and linear layer p L , for a round constant XOR layer p containing only nonlinear operations C and linear layer p L , and execute it in d1+1 independent domains respectively. For the replacement layer p including linear and nonlinear operations S , linear operations need to be performed in d1+1 independent domains respectively, and nonlinear operations use DOM-based AND gates and introduced random numbers to achieve cross-domain re-sharing; among them,

[0064] Round constant XOR layer p C , using XOR gates, bit splicing operators and inverters to achieve, the bit splicing operator and inverter generate the corresponding round constant RC according to the current round operation counter; linear layer p L , implemented using XOR gates and bit-splicing operators; replacing layer p S , where linear operations are implemented using XOR gates and inverters, and nonlinear operations are implemented using DOM-based AND gates, which are implemented using multipliers, XOR gates, and registers;

[0065] The data corresponding to d1+1 shares are sequentially passed through the round constant XOR layer p C , replace layer p S and linear layer p L Then, the output data corresponding to d1+1 shares are XORed to obtain the output data of the current round.

[0066] As can be seen, for different levels of side channel protection, the round operation-XOR module framework design is the same, consisting of an 8-way selector MUX4, a 4-way selector MUX5, and a round operation module Permutation. MUX4 and MUX5 are mainly responsible for performing the XOR operation and updating the status data after the a1 / b1 round operation in the Ascon cipher algorithm is completed, while the round operation module Permutation performs the specific round operation p. More specifically:

[0067] When side channel protection is not performed, the most basic framework can be used, such as Figure 7 As shown. That is, the round operation module Permutation in the round operation XOR module consists of the round constant XOR layer p C , replace layer p S and linear layer p LFor each layer, the embodiment of the present invention proposes to use basic components such as XOR gates, AND gates, inverters, etc. to implement them.

[0068] When side channel protection is selected, the embodiment of the present invention introduces DOM technology into the wheel operation module Permutation. Take level 1 side channel protection as an example to illustrate. Figure 8 and Figure 9 As shown. There are two shares and each variable share is associated with domain A and domain B respectively. The specific implementation steps are: 1) Select a 320-bit random number A x As a share, the other share value is 2) For p containing only linear operations c Layer and p L layer, the relevant operations in the basic implementation are performed once in both domain A and domain B; 3) For the nonlinear AND gate p S For the linear operation of the layer, the basic operation can be performed directly in each domain, but note that the reverse gate at the end of x2 only needs to be performed on one share. Cross-domain operation is required, use DOM_AND gate to complete the multiplier operation x i+1 x i+2 . And x i Statistically independent of x i+1 and x i+2 , which can be replaced by Figure 8 R0 in , thus achieving level 1 side channel protection by using only two shares and no random numbers.

[0069] For nonlinear multiplier operation The specific process of using DOM to achieve it is as follows Figure 8 As described above, it includes three steps: calculation, re-sharing and integration.

[0070] Calculation: Perform the actual multiplication operation, that is, calculate the four multiplication terms A separately x A y 、A x B y 、B x A y and B x B y Among them, A x A y and B x B y To multiply items within the same domain, the operation can be performed directly within domains A and B; A x B y and B x A y For the multiplication of cross-domain terms, it is only calculated and not added to any domain.

[0071] Resharing: Prepares for adding cross-domain terms to domains A and B. The calculated multiplication term is XORed with a random number. This makes the result statistically independent of any other multiplication term and can be added to any domain. Furthermore, an additional register is used to store the reshared multiplication term to address the fault and propagation issues shown in the Boolean mask. The dotted registers are only required in a pipelined architecture.

[0072] Integration: Add the cross-domain term to the specific domain to obtain the multiplication term A under GF(2) q and B q , its specific form is as follows:

[0073]

[0074] Among them, FF out express Figure 8 The output of register FF in the middle. Since each domain only contains the intra-domain combination terms and the cross-domain re-shared terms by adding random numbers, an attacker needs to combine two or more intermediate signals to obtain information related to variables x or y, thus achieving first-level side channel protection.

[0075] Higher-order side channel protection is similar to level one, but consumes more resources. For example, to implement level d1 side channel protection, the linear portion of the round operation must be executed once in each of the d1+1 domains. The nonlinear DOM_AND operation requires d1(d1+1) / 2 random numbers, d1+1 flip-flops, and more XOR gates. The specific process is shown in the following formula.

[0076]

[0077] Furthermore, Figure 10 The overall operation flow of the Ascon cryptographic algorithm is given, and the parameters involved in each instance mode of the ASCON cryptographic algorithm are given as shown in Table 1.

[0078] Table 1 Parameters involved in the ASCON cryptographic algorithm

[0079]

[0080] If the instance mode type is Ascon-128 / Ascon-128a, the corresponding operation process includes four stages: initialization, associated data, plaintext, and finalization. The specific parameters are shown in Table 1. The operation flow chart is as follows: Figure 10 The black and blue lines are shown in the figure. For example, Ascon processes 320 bits of state data S in each round, S is generated by the external state data S r and internal state data It consists of two parts, corresponding to the rate and capacity in the sponge structure. The more specific implementation of the Ascon lightweight cryptographic algorithm Ascon-128 / Ascon-128a is as follows Figure 11 As shown. Includes:

[0081] Preliminary preparation: Pad the associated data A and plaintext data P to s and t blocks respectively. For associated data A, if its initial length is 0, no padding is performed; otherwise, the padding bit string is {100...0}, so that the sum of the lengths of associated data A and the padded data is an integer multiple of the block length r. For plaintext data P, directly pad the bit string so that the total length after padding is an integer multiple of the block length.

[0082] The plaintext data and associated data transmitted into the system are directly stored in the I_FIFO, which is configured using the IP core provided by vivado; the remaining random numbers, keys, random numbers, etc. are placed in cascade registers.

[0083] Initialization Phase: First, the initialization state is input. This state consists of the IV, the encryption key Key, and the random number Nonce. At this point, the round operation counter is set to 0. Then, when round operation p (the counter increments by 1 after each p operation) is completed, the last k bits of the state data S are XORed with the key using an XOR circuit. This concludes the initialization phase. Since this is authenticated encryption mode, the cipher enters the associated data phase. Here, || represents the concatenation of two strings.

[0084]

[0085] Related data stage: group the populated related data into groups A i Same as external status data S r The XOR operation is performed, and the data after each operation is subjected to rounds of operations b1 and p before being XORed with the next group to complete the corresponding processing. After processing all groups, the last bit of the state data S is flipped using an inverter. After that, the cipher enters the plaintext stage.

[0086]

[0087] Plaintext stage: group the filled plaintext with the external state data S in sequence r Perform XOR operation and use the data after operation as the input data of round operation. After continuous b1 round operations p, the cipher can process the next plaintext group. r After XORing with the last plaintext block, the cipher enters the finalization phase. iSame as external status data S r The value after the XOR operation is the ciphertext C i On the contrary, if the group input here is ciphertext data, the result after XOR is plaintext data, which is the decryption operation. i It will be transferred to the O_FIFO memory for storage and subsequent reading.

[0088]

[0089] Finalization phase: First, the internal state data The first k bits of data are XORed with the key Key, and the result of the operation is used as the input value of the continuous a1 round operation p to perform the corresponding calculation. After the a1 round operation p is completed, the state data S out The last k bits of data are XORed with the key Key to get the value of the tag. Refers to truncating the last k bits of bit string x.

[0090]

[0091] The specific implementation process of round operation p is as follows: Figure 7 or Figure 9 As shown, no further details are given here.

[0092] Furthermore, if the instance mode type is Ascon-hash / Ascon-hasha, the corresponding operation process includes three stages: initialization, information absorption, and label extrusion. The specific parameters are shown in Table 1. The operation flow chart is as follows: Figure 10 The black and green lines in the figure are shown in the figure. The more specific implementation process of the Ascon lightweight cryptographic algorithm Ascon-hash / Ascon-hasha is as follows Figure 12 As shown. Includes:

[0093] Preliminary preparation: Same as Ascon-128 / Ascon-128a, except that the information padding operation is the same as the plaintext operation.

[0094] Initialization phase: First, 320 bits of data As the input data of the hash algorithm, after a1 rounds of operation p, since it belongs to the hash function mode at this time, the system enters the information absorption stage.

[0095]

[0096] Information absorption stage: for each information block M i , first compare it with the external state data S rPerform XOR operation, then perform b1 round operation p, and then process the next information block until the last information block is processed. At this time, when the external state data S r After XORing with the last information block, the cipher enters the squeeze tag phase.

[0097]

[0098] Squeeze tag: First, perform a1 round operations on the state data, that is, reset the round operation counter counter to count to a1; then, after obtaining r bits of data, perform continuous b1 round operations p to update the state data S until the set l = 256-bit hash value is obtained.

[0099]

[0100] Similarly, the specific implementation process of round operation p is as follows: Figure 7 or Figure 9 As shown, no further details are given here.

[0101] In summary, the secure and efficient hardware implementation system for the Ascon lightweight cryptographic algorithm proposed in the embodiments of the present invention utilizes an optimized ROM-based state machine and DOM-based round operations to achieve a secure and efficient hardware implementation of the Ascon algorithm, integrating both authenticated encryption mode and hash function mode. Compared to existing implementations, the proposed system offers greater flexibility in application scenarios. By replacing the traditional register-based FSM with an optimized ROM-based FSM, it can achieve higher frequencies and throughputs with fewer resources. Furthermore, by introducing DOM technology into round operations, side-channel protection is achieved. Furthermore, the proposed system can be easily extended to higher-order side-channel protection, overcoming the inadequate security and inability to strike a good balance between resource consumption and efficiency of existing implementations. This allows its application in a wider range of resource-constrained embedded devices, such as encryption requirements in network systems, wireless sensor networks, radio frequency identification chips, smart home products, and contactless smart cards. Overall, the proposed system not only meets the functional, area, and throughput requirements of resource-constrained embedded devices, but also plays a key role in ensuring data security, providing a more robust foundation for the Ascon cryptographic algorithm in a wide range of practical applications.

[0102] In the description of the present invention, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, a feature specified as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, "plurality" means two or more, unless otherwise specifically defined.

[0103] Although the present invention is described herein in conjunction with various embodiments, those skilled in the art may understand and implement other variations of the disclosed embodiments by reviewing the specification and accompanying drawings in the process of implementing the claimed invention. In the specification, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple components or steps. The fact that certain measures are described in different embodiments does not mean that these measures cannot be combined to produce good results.

[0104] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention should not be considered to be limited to these descriptions. For those skilled in the art of the present invention, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should be considered to fall within the scope of protection of the present invention.

Claims

1. A secure and efficient hardware implementation system for the Ascon lightweight cryptographic algorithm, characterized by: The system comprises: The pre-processing module is used to transmit the data required for system operation to the system through the defined input interface according to the user-defined instance mode type, side channel protection level, and current input data type. The instance mode types include authenticated encryption mode and hash function mode. The core module includes a finite state machine module and a round operation-XOR module. The finite state machine module is used to redefine the 7-state FSM required for implementing the authenticated encryption mode and the hash function mode into an FSM containing 4 states by using input multiplexing to combine certain states, and the number of inputs related to each state is reduced from 7 to 3. The 4-state transition and corresponding operation output are implemented according to the redefined FSM. The round operation-XOR module is used to design a corresponding round operation module according to the side channel protection level set by the user. When the side channel protection level is greater than 0, the DOM technology is introduced in the round operation module, and the corresponding XOR operation and round operation are performed on the state data according to the operation output by the finite state machine module and the current system state. The post-processing module is used to store the data processed by the system and send a signal to the outside world indicating that the system operation is completed.

2. The hardware implementation system of the secure and efficient Ascon lightweight cryptographic algorithm according to claim 1 is characterized in that: The authenticated encryption mode includes Ascon-128 and Ascon-128a, and the hash function mode includes Ascon-hash and Ascon-hasha.

3. The hardware implementation system of the secure and efficient Ascon lightweight cryptographic algorithm according to claim 1 is characterized in that: When using the traditional FSM to simultaneously implement the authenticated encryption mode and the hash function mode, seven states are involved. These seven states include the idle state, the initialization state, the associated data state, the plaintext state, the finalization state, the information absorption state, and the squeezed tag state. The seven related input signals involved in the traditional FSM are respectively the encryption start signal, the round operation completion signal, the encryption mode signal, the judgment signal of whether the associated data exists, the judgment signal of whether the processed associated data / information is the last data block, the judgment signal of whether the processed plaintext data block / hash data block is the last data block, and the system completion signal. The four states in the FSM redefined based on the input multiplexing technology include the first state, the second state, the third state, and the fourth state; the first state is a combination of the idle state and the finalized state, the second state is the initialization state, the third state is a combination of the associated data state and the absorbed information state, and the fourth state is a combination of the plaintext state and the squeezed tag state.

4. The secure and efficient hardware implementation system of the Ascon lightweight cryptographic algorithm according to claim 3 is characterized in that: The designed ROM-based finite state machine module includes a 2-way selector MUX1, a 4-way selector MUX2, a 3-way selector MUX3, and a ROM memory; among them, The ROM memory is used to pre-store in each storage unit a first selection signal, a second selection signal, a third selection signal, an operation output corresponding to a current state, and a next jump state of the current state; The 2-way selector MUX1 is configured to select and output a first signal in1 from the encryption start signal and the round operation completion signal according to the first selection signal; The 4-way selector MUX2 is configured to select and output a second signal in2 from among the encryption mode signal, the judgment signal indicating whether the processed associated data / information is the last data block, the judgment signal indicating whether the processed plaintext data block / hash data block is the last data block, and the system completion signal according to the second selection signal; The 3-way selector MUX3 is configured to select and output a third signal in3 from 0, 1, and a judgment signal indicating whether the associated data exists, according to the third selection signal; The ROM memory is also used to retrieve and output corresponding operations from the corresponding storage unit of the ROM memory according to the first signal in1, the second signal in2, the third signal in3 and the current state, and simultaneously update the current state, the first selection signal, the second selection signal and the third selection signal.

5. The hardware implementation system of the secure and efficient Ascon lightweight cryptographic algorithm according to claim 1 is characterized in that: The round operation XOR module includes an 8-way selector MUX4, a 4-way selector MUX5 and a round operation module; wherein, The 8-way selector MUX4 and the 4-way selector MUX5 are responsible for executing the XOR operation and updating the status data required by the Ascon lightweight cryptographic algorithm at each stage, and outputting the updated data as the input data for the current round; The round operation module is used to perform specific round operations on the current round input data.

6. The hardware implementation system of the secure and efficient Ascon lightweight cryptographic algorithm according to claim 5 is characterized in that: When the side channel protection level is level 0, it indicates that no protection measures are added; the round operation module includes a round constant XOR layer p C , replace layer p S and linear layer p L ;in, The round constant XOR layer p C , using an XOR gate, a bit splicing operator and an inverter, the bit splicing operator and the inverter generate the corresponding round constant according to the current round operation counter; the replacement layer p S , implemented using a combinational logic circuit comprising an XOR gate, an AND gate, and an inverter; the linear layer p L , implemented using XOR gates and bit-splicing operators; The current round input data passes through the round constant XOR layer p in turn C , replace layer p S and linear layer p L Finally, the data after rounds of operations are output.

7. The secure and efficient hardware implementation system of the Ascon lightweight cryptographic algorithm according to claim 5 is characterized in that: When the side channel protection level is level 1, the current round input data has been divided into two shares before entering the round operation, and the two shares belong to independent domains respectively; the round operation module introduces DOM technology, and the round operation module includes a round constant XOR layer p C , replace layer p S and linear layer p L , for a round constant XOR layer p containing only nonlinear operations C and linear layer p L , respectively, in two independent domains, for the replacement layer p including linear and nonlinear operations S , linear operations need to be performed in two independent domains respectively, and non-linear operations use DOM-based AND gates to achieve cross-domain re-sharing; The round constant XOR layer p C , using an XOR gate, a bit splicing operator and an inverter, the bit splicing operator and the inverter generate the corresponding round constant according to the current round operation counter; the linear layer p L , implemented using XOR gates and bit-splicing operators; the replacement layer p S , wherein the linear operation is implemented using an XOR gate and an inverter, and the nonlinear operation is implemented using an AND gate based on DOM, and the AND gate based on DOM is implemented using a multiplier, an XOR gate and a register; The two shares of corresponding input data are sequentially passed through the round constant XOR layer p C , replace layer p S and linear layer p L After that, the output data corresponding to the two shares are XORed to obtain the output data of the current round.

8. The hardware implementation system of the secure and efficient Ascon lightweight cryptographic algorithm according to claim 5 is characterized in that: When the side channel protection level is d1 (d1>1), the input data of the current round operation has been divided into d1+1 shares before entering the round operation, and these d1+1 shares belong to independent domains respectively; the round operation module introduces DOM technology, and the round operation module includes a round constant XOR layer p C , replace layer p S and linear layer p L , for a round constant XOR layer p containing only nonlinear operations C and linear layer p L , and execute it in d1+1 independent domains respectively. For the replacement layer p including linear and nonlinear operations S , linear operations need to be performed in d1+1 independent domains respectively, and nonlinear operations use DOM-based AND gates and introduced random numbers to achieve cross-domain re-sharing; among them, The round constant XOR layer p C , using an XOR gate, a bit splicing operator and an inverter, the bit splicing operator and the inverter generate the corresponding round constant according to the current round operation counter; the linear layer p L , implemented using XOR gates and bit-splicing operators; the replacement layer p S , wherein the linear operation is implemented using an XOR gate and an inverter, and the nonlinear operation is implemented using an AND gate based on DOM, and the AND gate based on DOM is implemented using a multiplier, an XOR gate and a register; The data corresponding to d1+1 shares are sequentially passed through the round constant XOR layer p C , replace layer p S and linear layer p L Then, the output data corresponding to d1+1 shares are XORed to obtain the output data of the current round.

9. The secure and efficient hardware implementation system of the Ascon lightweight cryptographic algorithm according to claim 1 is characterized in that: The pre-processing module and the post-processing module are both configured with a first-in-first-out queue FIFO for buffering and storing corresponding data.

Images