RISC-V-based SM4 algorithm acceleration calculation method

Abstract

The invention discloses an SM4 algorithm accelerated calculation method based on RISC-V. The SM4 algorithm accelerated calculation method comprises the following steps: step 1, acquiring corresponding plaintext and key data; 2, building an SM4 algorithm calculator based on an RISC-V platform, and setting a data processing area and an algorithm optimization area in an SM4 algorithm accelerator; step 3, taking the plaintext and the key data as input, storing and preprocessing the input plaintext and key data through a data processing area, generating an initialization vector through a system used for operating an SM4 algorithm, and obtaining a counter value of system operation; step 4, the algorithm optimization area reads key data and system parameters and executes a key expansion algorithm, and the expanded key is stored; and 5, the algorithm optimization area takes the expanded secret key and the counter value as input data and executes an encryption algorithm, so that the round function operation of the SM4 algorithm is accelerated. According to the method, the problem that the data processing capability is low when the SM4 algorithm is realized by hardware is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of encryption algorithm optimization, and specifically to a RISC-V-based SM4 algorithm accelerated calculation method. Background Art

[0002] RISC-V is a completely open source computer CPU architecture. Its biggest feature is that it has a rich set of instruction extensions for developers to choose from in different development scenarios. Compared with complex instruction set architectures, RISC-V, as a streamlined instruction set architecture, has better energy efficiency than the former in some special scenarios and fields. RISC-V's own open source, modularity, low power consumption and other characteristics make it the choice of more and more developers in chip design for the Internet of Things, mobile devices, etc.

[0003] The SM4 algorithm is a block cipher standard in the national secret algorithm. It is also a symmetric encryption algorithm, which means that the encryption and decryption of the SM4 algorithm share a set of keys and the encryption and decryption processes are symmetrical. The algorithm stipulates that the block length of the ciphertext and the key is 128 bits. In addition, the algorithm includes key expansion and encryption / decryption algorithms, in which both key expansion and encryption / decryption algorithms involve linear transformation and nonlinear transformation, and the processing processes of the two are also similar. The SM4 algorithm has high security and can be adapted to most security application scenarios.

[0004] Since encryption algorithms are required to protect sensitive data in some application scenarios, the chip's performance will be compromised when processing this data. Therefore, if the encryption algorithm is optimized, the chip can ensure data security while taking into account its own performance.

[0005] With the widespread application of the SM4 algorithm, more and more people have joined the research of SM4 encryption software and hardware acceleration technology. For example, the paper "A Fast Software Implementation Method of the National Secret SM4 Algorithm Based on Composite Domain" published in the Journal of Cryptography in 2023 found a composite domain for the S-box software implementation of the SM4 algorithm and proposed a fast software implementation method for SM4. However, the SM4 algorithm involves a large number of XOR and shift operations, which means that multiple instructions are required at the bottom layer to implement this process. Therefore, how to reduce the XOR operations in the SM4 algorithm has become a problem that needs to be solved at present. Summary of the invention

[0006] The purpose of the present invention is to fill the deficiencies of the above-mentioned prior art and provide an accelerated calculation method for the SM4 algorithm based on RISC-V to solve the problem of inefficient data processing capability when the SM4 algorithm is implemented in hardware.

[0007] In order to solve the above technical problems, the technical solution of the present invention is:

[0008] A RISC-V-based SM4 algorithm accelerated calculation method, the steps comprising:

[0009] S1. Set up a data processing area and an algorithm optimization area in the SM4 algorithm accelerator;

[0010] S2. The data processing area receives the input plaintext and key data, saves them to the vector register group and performs preprocessing;

[0011] S3. The key expansion algorithm is preferentially executed in the algorithm optimization area, and the expanded key is saved in the key cache area;

[0012] S4. The algorithm optimization area executes the encryption algorithm, reads the key, and accelerates the implementation of the round function in the encryption.

[0013] Preferably, a data processing area and an algorithm optimization area are set in the SM4 algorithm accelerator, as follows:

[0014] The SM4 algorithm accelerator is based on the RISC-V platform and supports the RISC-V basic instruction set and extended instruction set to operate on it.

[0015] The data processing area is provided with a plaintext vector register group, a key vector register group, and a CTR vector register;

[0016] Preferably, the algorithm optimization area is provided with an algorithm acceleration area, a key cache area, and a vector register group.

[0017] Preferably, the data processing area receives input plaintext and key data, saves the plaintext data into a plaintext vector register group, and saves the key data into a key vector register group.

[0018] As a preferred embodiment, the pretreatment is as follows:

[0019] S21. Grouping data through the RV32V extended instruction set;

[0020] S22. Save the CTR values ​​corresponding to the data groups into the CTR vector register group, and group them according to the method described in S21.

[0021] Preferably, the data is grouped by the RV32V extended instruction set by setting the length and width of the vector elements by the RV32V extended instruction set to achieve the division of the plaintext data into c1, c2, c3, c4 data groups, and the division of the key data into k1, k2, k3, k4 data groups.

[0022] As a preference, the key expansion algorithm is preferentially executed in the algorithm optimization area, and the expanded key is saved in the key cache area, as follows:

[0023] The key expansion algorithm process is similar to the encryption algorithm process, and the acceleration process of the XOR and bit shift operations of the data is the same as the encryption optimization process;

[0024] Preferably, the key cache area is composed of a standard register group.

[0025] Preferably, the S4. algorithm optimization area executes the encryption algorithm, reads the key, and accelerates the implementation of the round function in the encryption, as follows:

[0026] S41: Set the vector register to save the intermediate data after shifting in the SM4 encryption / decryption algorithm and the key expansion algorithm;

[0027] S42: Use the vxor and vsll instructions in RV32V to accelerate the calculation of XOR and displacement of multiple sets of data with a single instruction.

[0028] Preferably, the accelerated calculation operation of implementing the XOR and displacement of multiple sets of data with a single instruction through the vxor and vsll instructions in RV32V is specifically as follows:

[0029] In the SM4 algorithm, the back-end data G0 processed by the S-box needs to be shifted left by 2 bits, 10 bits, 18 bits, and 24 bits respectively.

[0030] The displacement data is described by G1, G2, G3 and G4 respectively. G1 and G3 are stored in the v1 vector register, and G2 and G4 are stored in the v2 vector register. First, the data in v1 and v2 are XORed, and the result is saved in v1. The result of the logical left shift in v1 is saved in v2. Next, v1 and v2 are XORed and the result is saved in the v3 vector register. In this way, two sets of identical intermediate results G7 are saved in the v3 register. Finally, G7 is XORed with G0 and k1 to obtain k5, and then the v0 register is shifted.

[0031] The present invention has the following characteristics and beneficial effects:

[0032] The above technical solution can reduce the large number of XOR and shift operations involved in the SM4 algorithm, and the vector extension instruction set in RISC-V can realize parallel computing of data. In addition, as a streamlined instruction set, the RISC-V instruction set can effectively reduce the hardware overhead in reading and translating instructions in the process of implementing the SM4 algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0034] Figure 1 This is a flow chart of a RISC-V-based SM4 algorithm accelerated computing method and device described in the present invention.

[0035] Figure 2 This is a specific process of optimizing encryption in a RISC-V-based SM4 algorithm accelerated computing method and device described in the present invention. DETAILED DESCRIPTION

[0036] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0037] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings.

[0038] On the contrary, the present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention as defined by the claims. Further, in order to make the public have a better understanding of the present invention, some specific details are described in detail in the detailed description of the present invention below. Those skilled in the art can fully understand the present invention without the description of these details.

[0039] The present invention provides a RISC-V-based SM4 algorithm accelerated calculation method, such as Figure 1 As shown, the following steps are included:

[0040] Step 1: Obtain the corresponding plaintext and key data;

[0041] Step 2: Build an SM4 algorithm calculator based on the RISC-V platform. The RISC-V platform supports the RV32V basic instruction set and extended instruction set to operate the SM4 algorithm accelerator. The basic instruction set includes vxor and vsll instructions.

[0042] Furthermore, a data processing area and an algorithm optimization area are set in the SM4 algorithm accelerator.

[0043] Specifically, the data processing area is provided with a plaintext vector register group, a key vector register group, and a CTR vector register, and the algorithm optimization area is provided with an algorithm acceleration area, a key cache area, and a vector register group.

[0044] It should be noted that in this embodiment, the plaintext and key data in the SM4 algorithm are both input with word length, and the 128-bit data plaintext is split into 4 groups of 32-bit data by bit, and the 128-bit data key is split into 4 groups of 32-bit key groups by bit. The encryption algorithm and the key algorithm process the input plaintext and key data respectively.

[0045] Step 3: Take the plaintext and key data as input, save and preprocess the input plaintext and key data through the data processing area, and generate an initialization vector through the system for running the SM4 algorithm, and obtain the counter value of the system operation.

[0046] Specifically, the plaintext data is saved in a plaintext vector register group, and the key data is saved in a key vector register group.

[0047] Furthermore, the pretreatment method is:

[0048] The plaintext data and key data in the plaintext vector register group and the key vector register group are grouped through the RV32V extended instruction set. At the same time, the counters in the system are initialized using the initialization vector. Then, the CTR values ​​are obtained in sequence according to the plaintext grouping, and the CTR values ​​(counter values) are saved in the CTR vector register.

[0049] Specifically, the grouping method is: the grouping method is: setting the length and width of the vector elements through the RV32V extended instruction set, dividing the plaintext data in the plaintext vector register group into c1, c2, c3, and c4 data groups, and dividing the key data in the key vector register group into k1, k2, k3, and k4 data groups.

[0050] Step 4: the algorithm optimization area reads the key data and system parameters and executes the key expansion algorithm, and saves the expanded key to the key cache area;

[0051] Specifically, the method of the key expansion algorithm is: first read the grouped key data, perform XOR calculation on the grouped key data and the system parameters for running the SM4 algorithm to obtain multiple groups of data, and input the multiple groups of data after XOR calculation into the round function of the SM4 algorithm. In the round function, the multiple groups of data are processed through multiple rounds to output the expanded key. Furthermore, in the key expansion algorithm, the processing method of each round of the round function includes:

[0052] XOR calculation is performed on the input data stream and the fixed parameters generated by the system;

[0053] The result obtained by XOR calculation is used for data obfuscation through the S box in the SM4 algorithm;

[0054] Finally, the obfuscated data is subjected to data shift and XOR operations to output the expanded key.

[0055] Specifically, in this embodiment, the initial key group is represented as (k'1, k'2, k'3, k'4), and it is XORed with the system parameter group (Sk1, Sk2, Sk3, Sk4) to obtain the initial data group (Di, Di+2, Di+3, Di+4), where i (1<=i<=32) represents the number of rounds executed by the round function, and i=1 at the initial time. When the initial data group enters the round function, D i No processing for now, D i+1 , D i+2 , D i+3 and fixed parameter C i Perform three XORs, namely:

[0056]

[0057] Split SBOX_IN into 4 groups of 8-bit data and input them into Sbox for data obfuscation. Finally, the data is merged into 32-bit data R 0 .

[0058] The processed 32-bit data is circularly shifted left by 13 and 23 bits respectively, and the obtained data is recorded as R 1 , R 2 And do the following:

[0059]

[0060] Generating Di+4 in this way requires three XOR operations. Using the above method, the XOR operation will be reduced by one. The above operation is repeated until i=32.

[0061] Step 5: The algorithm optimization area uses the expanded key and counter value as input data and executes the encryption algorithm. During this process, the algorithm optimization area accelerates the round function operation of the SM4 algorithm.

[0062] Specifically, the specific method for executing the encryption algorithm is: first read the expanded key and counter value, and input them into the round function in the SM4 algorithm. In the round function, the key data must undergo multiple rounds of processing and output the final encryption result.

[0063] Furthermore, in the encryption process, each round of the round function includes:

[0064] Enter the expanded key and perform XOR calculation on the grouped plaintext data;

[0065] The calculated results are then obfuscated by the S-box in the SM4 algorithm;

[0066] Shift and XOR the obfuscated data;

[0067] After multiple rounds of processing, the XOR data is reversed and XORed with the corresponding plaintext group to obtain the final encryption result.

[0068] Furthermore, the intermediate data after shifting in the encryption / decryption algorithm and the key expansion algorithm are saved through vector registers, and the vxor and vsll instructions in RV32V are used to perform accelerated calculation operations of XOR and shifting on multiple groups of data saved after shifting.

[0069] Specifically, in this embodiment, the encryption algorithm execution process is:

[0070] The input plaintext group is represented as (M i , M i+1 , M i+2 , M i+3 ), where i (1<=i<=32) represents the number of rounds executed by the round function, and initially i=1.

[0071] When the initial data packet enters the round function, M i No processing for now, M i+1 , M i+2 , M i+3 and the fixed parameter C of the system i Perform three XORs, namely:

[0072]

[0073] Where D i+4 The key corresponding to the key after key expansion.

[0074] Split SBOX_IN1 into 4 groups of 8-bit data, and input them into Sbox for nonlinear transformation. Finally, the data is merged into 32-bit data MR. 0 .

[0075] The processed 32-bit data is circularly shifted left by 2, 10, 18, and 24 bits respectively, and the obtained data is recorded as MR 1 , MR 2 , MR 3 and MR 4 And do the following:

[0076]

[0077] This generates X i Five XOR operations are required.

[0078] The above operation is repeated until i=32, and the processed data group is obtained. Finally, the data group is transformed in reverse order, and the output ciphertext is obtained after XOR with the corresponding plaintext group.

[0079] Furthermore, the intermediate data after displacement in the encryption / decryption algorithm and the key expansion algorithm are saved through vector registers, and the accelerated calculation operations of XOR and displacement of multiple groups of data with a single instruction are implemented through the vxor and vsll instructions in RV32V.

[0080] Further, such as Figure 2 As shown, first, the algorithm acceleration area shifts the back-end data G0 processed by the S-box to the left by 2 bits, 10 bits, 18 bits, and 24 bits respectively, and the displacement data are described by G1, G2, G3, and G4 respectively;

[0081] Store G1 and G3 in the v1 vector register, store G2 and G4 in the v2 vector register, first XOR the data in the v1 vector register and the v2 vector register, and save the result in the v1 vector register;

[0082] The logical left shift instruction is executed in the v1 vector register, and its result is saved in the v2 vector register. Next, the v1 vector register and the v2 vector register are XORed and the result is saved in the v3 vector register. At this time, two sets of identical intermediate results are saved in the v3 vector register, and the intermediate result is defined as G7. Finally, G7 is XORed with G0 and k1 to obtain k5, and then the v0 vector register is shifted.

[0083] It can be seen from the above embodiments that the RISC-V-based SM4 algorithm accelerated calculation method provided by the present invention can effectively reduce the number of XOR operations mentioned in this case, thereby reducing the algorithm overhead.

[0084] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. For those skilled in the art, various changes, modifications, substitutions and variations of these embodiments including components are made without departing from the principles and spirit of the present invention, and still fall within the scope of protection of the present invention.

Claims

1. A RISC-V-based SM4 algorithm accelerated computing method, characterized in that: The steps include: Step 1: Obtain the corresponding plaintext and key data; Step 2: Build an SM4 algorithm calculator based on the RISC-V platform, and set up a data processing area and an algorithm optimization area in the SM4 algorithm accelerator; Step 3: Take the plaintext and key data as input, save and pre-process the input plaintext and key data through the data processing area, and generate an initialization vector through the system for running the SM4 algorithm, and obtain the counter value of the system operation; Step 4: the algorithm optimization area reads the key data and system parameters and executes the key expansion algorithm, and saves the expanded key; Step 5: The algorithm optimization area uses the expanded key and counter value as input data and executes the encryption algorithm, thereby accelerating the round function operation of the SM4 algorithm.

2. The RISC-V-based SM4 algorithm accelerated computing method according to claim 1, characterized in that: The RISC-V platform supports the RV32V basic instruction set and extended instruction set to operate the SM4 algorithm accelerator, and the basic instruction set includes vxor and vsll instructions.

3. The RISC-V-based SM4 algorithm accelerated computing method according to claim 1, characterized in that: The data processing area is provided with a plaintext vector register group, a key vector register group, and a CTR vector register, and the plaintext data is saved in the plaintext vector register group, and the key data is saved in the key vector register group.

4. The RISC-V-based SM4 algorithm accelerated computing method according to claim 3, characterized in that: The preprocessing method in step 3 is: grouping the plaintext data and key data in the plaintext vector register group and the key vector register group through the RV32V extended instruction set, and at the same time using the initialization vector to initialize the counter in the system, and then obtaining the counter value in sequence according to the plaintext grouping, and saving the obtained counter value to the CTR vector register.

5. The RISC-V-based SM4 algorithm accelerated computing method according to claim 3, characterized in that: In step 3, the grouping method is: setting the length and width of the vector element through the RV32V extended instruction set, dividing the plaintext data in the plaintext vector register group into c1, c2, c3, and c4 data groups, and dividing the key data in the key vector register group into k1, k2, k3, and k4 data groups.

6. The RISC-V-based SM4 algorithm accelerated computing method according to claim 2, characterized in that: The method of the key expansion algorithm is: first read the grouped key data, perform XOR calculation on the grouped key data and the system parameters used to run the SM4 algorithm to obtain multiple groups of data, and input the multiple groups of data after the XOR calculation into the round function of the key expansion in the SM4 algorithm. In the round function, the multiple groups of data must undergo multiple rounds of processing to output the expanded key.

7. The RISC-V-based SM4 algorithm accelerated computing method according to claim 6, characterized in that: In the key expansion algorithm, the processing method of each round of the round function includes: XOR calculation is performed on the input data stream with the fixed parameters generated by the system used to run the SM4 algorithm; The result obtained by XOR calculation is used for data obfuscation through the S box in the SM4 algorithm; Finally, the obfuscated data is subjected to data shift and XOR operations to output the expanded key.

8. The RISC-V-based SM4 algorithm accelerated computing method according to claim 7, characterized in that: The algorithm optimization area is provided with an algorithm acceleration area, a key cache area, and a vector register group.

9. The RISC-V-based SM4 algorithm accelerated computing method according to claim 8, characterized in that: The key obtained by the key expansion algorithm is saved in the key cache area.

10. The RISC-V-based SM4 algorithm accelerated computing method according to claim 8, characterized in that: In step 5, the specific method of executing the encryption algorithm is: first read the saved counter value and the expanded key, and input them into the round function in the SM4 algorithm. In the round function, the key data must undergo multiple rounds of processing and output the final encryption result.

11. The RISC-V-based SM4 algorithm accelerated computing method according to claim 10, characterized in that: In the encryption process, each round of the round function includes: Enter the expanded key and the grouped counter value for XOR calculation; The result of XOR calculation is obfuscated by the S-box in the SM4 algorithm; Shift and XOR the obfuscated data; After multiple rounds of processing, the XOR data is reversed and XORed with the corresponding plaintext group to obtain the final encryption result.

12. The RISC-V-based SM4 algorithm accelerated computing method according to claim 11, characterized in that: In step 5, the intermediate data after displacement in the encryption / decryption algorithm and the key expansion algorithm are saved through vector registers, and the accelerated calculation operations of XOR and displacement of multiple groups of data by a single instruction are implemented through the vxor and vsll instructions in RV32V.

13. The method for accelerating the calculation of the SM4 algorithm based on RISC-V according to claim 12, characterized in that the specific method of the accelerated calculation operation is: First, the key in the key buffer is processed by the S box in the SM4 algorithm to obtain the data G0, and then the data G0 is shifted left by 2 bits, 10 bits, 18 bits, and 24 bits respectively through the algorithm acceleration area, and the displacement data are described by G1, G2, G3, and G4 respectively; Store G1 and G3 in the v1 vector register, store G2 and G4 in the v2 vector register, first XOR the data in the v1 vector register and the v2 vector register, and save the result in the v1 vector register; The result saved in the v1 vector register executes the logical left shift instruction, and the result of the left shift of the v1 vector register is saved in the v2 vector register. Secondly, the v1 vector register and the v2 vector register are XORed and the result is saved in the v3 vector register. At this time, two sets of identical intermediate results are saved in the v3 vector register, and the intermediate result is defined as G7. Finally, G7 is XORed with G0 and k1 to obtain k5, and then k5 is saved in the v0 vector register, and the v0 vector register is shifted.

Images