Low-delay S box construction method and device, electronic equipment and storage medium

Abstract

The invention relates to a low-delay S box construction method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a low-delay circuit structure, the low-delay circuit structure comprises logic gates or a combination of the logic gates in a logic library, and the logic gates comprise a single-input logic gate, a two-input logic gate and a multi-input logic gate; based on the low-delay circuit structure, determining a target circuit structure which meets a given delay requirement and meets a safety requirement; and constructing an S box based on the target circuit structure. By using the method disclosed by the invention, the efficiency of constructing the S box is improved. Moreover, the low-delay circuit in the invention covers logic gates of a single-input logic gate, a two-input logic gate and a multi-input logic gate in a logic library, so that the possibility of finding a circuit structure with lower delay is improved, and the delay of the S box is reduced.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to a low-latency S-box construction method and device, electronic equipment, and storage medium. Background Art

[0002] S-boxes are widely used in modern block ciphers and hash functions. In block ciphers, S-boxes are usually used as the only nonlinear component to provide confusion and ensure the security of the entire cryptographic algorithm. S-boxes can be regarded as Boolean functions with n-bit input and m-bit output, called n×m S-boxes, and n-bit S-boxes when n=m. When n and m are large, almost all S-boxes are nonlinear and have good cryptographic strength.

[0003] Constructing a low-latency S-box is an important part of the design of block cipher algorithms. There are two methods for constructing a low-latency S-box. One is to find its low-latency implementation given an S-box that meets the security characteristics, and then construct an S-box with the same effect as the given S-box but lower latency. This method relies on the estimation of delay. At present, it is mainly based on the estimation method of gate depth. It is necessary to traverse all required S-boxes and their low-latency implementations, which is relatively inefficient. The other is to construct based on a low-latency Boolean function (circuit structure), but due to the high complexity, the related technology only determines the low-latency circuit structure based on 3 or a few logic gates. The low latency of this circuit structure needs further verification. It is only a low latency within a certain range, not a real low latency. Therefore, there is still room for reducing the latency of the S-box constructed using this low-latency circuit. Summary of the invention

[0004] In view of this, the present disclosure proposes a low-latency S-box construction solution.

[0005] According to one aspect of the present disclosure, a low-latency S-box construction method is provided, comprising: obtaining a low-latency circuit structure, the low-latency circuit structure comprising a logic gate or a combination of logic gates in a logic library, the logic gate comprising: a single-input logic gate, a two-input logic gate, and a multi-input logic gate; based on the low-latency circuit structure, determining a target circuit structure that meets a given delay requirement and meets safety requirements; based on the target circuit structure, constructing an S-box.

[0006] In one possible implementation, based on the low-latency circuit structure, determining a target circuit structure that meets a given delay requirement and meets safety requirements includes: traversing and using the logic gates to replace substructures of non-critical paths in the low-latency circuit structure to obtain multiple replaceable circuit structures; screening the low-latency circuit structure and the replaceable circuit structure to obtain the target circuit structure.

[0007] In a possible implementation, the screening of the low-latency circuit structure and the replaceable circuit structure to obtain the target circuit structure includes: selecting a first circuit structure that meets the balance requirement and the full dependency requirement; determining the first truth table corresponding to each substructure of the first circuit structure, wherein, in the case of obtaining the first truth table of the same level, the lexicographic order of the first truth table obtained first is less than the lexicographic order of the first truth table obtained later; based on the first truth table, determining the truth table of the first circuit structure; when the truth table of a single first circuit structure is different from the truth tables of all the second circuit structures in the equivalent pool, adding the single first circuit structure as the second circuit structure to the equivalent pool; when the truth table of a single first circuit structure is the same as the truth table of at least one second circuit structure in the equivalent pool, abandoning the single first circuit structure.

[0008] In a possible implementation, the low-latency circuit structure and the replaceable circuit structure are screened to obtain the target circuit structure, including: combining the second circuit structures according to the number of output bits n of the S-box to be constructed to obtain multiple first structure combinations, wherein a single first structure combination has n second circuit structures, and n is a positive integer; performing linearity screening on the first structure combinations to obtain second structure combinations that meet linearity conditions; performing differential distribution screening on the second structure combinations to obtain third structure combinations that meet full differential distribution probability conditions; and using the circuit structures in each of the third structure combinations as the target circuit structure.

[0009] In one possible implementation, the linearity screening of the first structure combination to obtain the second structure combination that meets the linearity condition includes: when the first linearity of a single second circuit structure within a single first structure combination, or the second linearity of at least two second circuit structures spliced ​​together, does not meet the linearity condition, abandoning the single first structure combination.

[0010] In one possible implementation, obtaining a low-latency circuit structure includes: combining the logic gates in the logic library and using a single combination as a third circuit structure to obtain multiple third circuit structures; measuring the delay of each third circuit structure; obtaining a target delay of the S-box to be constructed and a first number of input data, and determining a third circuit structure whose delay is less than or equal to the target delay and whose number of input data is the first number as the low-latency circuit structure.

[0011] In a possible implementation, the logic library includes: an ASIC logic library, and the target circuit structure includes:

[0012] Target circuit structure for constructing a 4-bit S-box:

[0013] NAND2(NAND2(x,x),OAI21(x,x,x));

[0014] NAND2(NAND3(x,x,x),OAI21(x,x,x));

[0015] AOI21(AND2(x,x),AOI21(x,x,x));

[0016] Target circuit structure for constructing a 5-bit S-box:

[0017] OAI21(OAI21(x,x,x),NOR2(x,x),NAND2(x,x));

[0018] OAI21(OAI21(x,x,x),NOR2(x,x),OR2(x,x));

[0019] NAND3(NAND2(x,x),NAND3(x,x,x),NAND2(x,x));

[0020] NAND3(NAND3(x,x,x),NAND3(x,x,x),NAND2(x,x));

[0021] AOI21(AOI21(x,x,x),NAND2(x,x),AND2(x,x));

[0022] Target circuit structure for constructing a 6-bit S-box:

[0023] AOI22(OAI22(x,x,x),OAI21(x,x,x),OAI21(x,x,x),OAI21(x,x,x));

[0024] AOI22(OAI22(x,x,x),OAI21(x,x,x),OAI21(x,x,x),x);

[0025] OAI22(AOI21(x,x,x),AOI21(x,x,x),AOI21(x,x,x),AOI21(x,x,x));

[0026] OAI22(AOI21(x,x,x),AOI21(x,x,x),AOI21(x,x,x),x);

[0027] Among them, x is the input binary data, NAND2 is a two-input NAND gate, OAI21 is a three-input NAND-OR gate, NAND3 is a three-input NAND gate, NOR2 is a two-input NOR gate, OR2 is a two-input OR gate, AOI21 is a three-input AND-NOR gate, AND2 is a two-input AND gate, AOI22 is a four-input AND-NOR gate, and OAI22 is a four-input NAND-OR gate.

[0028] According to another aspect of the present disclosure, a low-latency S-box construction device is provided, comprising:

[0029] A low-latency circuit structure acquisition unit, used to acquire a low-latency circuit structure, wherein the low-latency circuit structure includes a logic gate or a combination of logic gates in a logic library, wherein the logic gate includes: a single-input logic gate, a two-input logic gate, and a multi-input logic gate;

[0030] A target circuit determination unit, configured to determine a target circuit structure that meets a given delay requirement and a safety requirement based on the low-latency circuit structure;

[0031] The S-box construction unit is used to construct an S-box based on a target circuit structure.

[0032] In a possible implementation manner, the target circuit determination unit includes:

[0033] A replaceable circuit structure determination unit, configured to traverse and use the logic gates to replace substructures of non-critical paths in the low-latency circuit structure to obtain a plurality of replaceable circuit structures;

[0034] The first target circuit structure determination subunit is used to screen the low-latency circuit structure and the replaceable circuit structure to obtain the target circuit structure.

[0035] In a possible implementation manner, the replaceable circuit structure determining unit is further configured to:

[0036] Selecting a first circuit structure that meets the balance requirement and the full dependence requirement;

[0037] Determine a first truth table corresponding to each substructure of the first circuit structure, wherein, in the case of obtaining first truth tables at the same level, the lexicographic order of the first truth table obtained first is smaller than the lexicographic order of the first truth table obtained later;

[0038] Based on the first truth table, determining a truth table of a first circuit structure;

[0039] When the truth table of a single first circuit structure is different from the truth tables of all second circuit structures in the equivalent pool, adding the single first circuit structure as a second circuit structure to the equivalent pool;

[0040] When the truth table of a single first circuit structure is identical to the truth table of at least one second circuit structure in the equivalence pool, the single first circuit structure is discarded.

[0041] In a possible implementation manner, the target circuit structure determination subunit is used to:

[0042] According to the number of bits n of the S-box to be constructed, the second circuit structures are combined to obtain a plurality of first structure combinations, wherein a single first structure combination has n second circuit structures, where n is a positive integer;

[0043] Performing linearity screening on the first structural combination to obtain a second structural combination that meets a linearity condition;

[0044] Perform differential distribution screening on the second structural combination to obtain a third structural combination with full differential distribution probability conditions;

[0045] The circuit structure in each of the third structure combinations is used as the target circuit structure.

[0046] In a possible implementation, the linearity screening of the first structural combination to obtain a second structural combination that meets the linearity condition includes:

[0047] When the first linearity of a single second circuit structure within a single first structure combination, or the second linearity of at least two second circuit structures spliced ​​together, does not meet the linearity condition, the single first structure combination is abandoned.

[0048] In a possible implementation, the low-latency circuit structure acquisition unit is used to:

[0049] Combining the logic gates in the logic library and using a single combination as a third circuit structure to obtain a plurality of third circuit structures;

[0050] measuring the delay of each third circuit structure;

[0051] Obtain the target delay of the S-box to be constructed and the first amount of input data,

[0052] A third circuit structure in which a delay is less than or equal to a target delay and the number of input data is the first number is determined as the low-latency circuit structure.

[0053] In a possible implementation, the logic library includes: an ASIC logic library, and the target circuit structure includes:

[0054] Target circuit structure for constructing a 4-bit S-box:

[0055] NAND2(NAND2(x,x),OAI21(x,x,x));

[0056] NAND2(NAND3(x,x,x),OAI21(x,x,x));

[0057] AOI21(AND2(x,x),AOI21(x,x,x));

[0058] Target circuit structure for constructing a 5-bit S-box:

[0059] OAI21(OAI21(x,x,x),NOR2(x,x),NAND2(x,x));

[0060] OAI21(OAI21(x,x,x),NOR2(x,x),OR2(x,x));

[0061] NAND3(NAND2(x,x),NAND3(x,x,x),NAND2(x,x));

[0062] NAND3(NAND3(x,x,x),NAND3(x,x,x),NAND2(x,x));

[0063] AOI21(AOI21(x,x,x),NAND2(x,x),AND2(x,x));

[0064] Target circuit structure for constructing a 6-bit S-box:

[0065] AOI22(OAI22(x,x,x),OAI21(x,x,x),OAI21(x,x,x),OAI21(x,x,x));

[0066] AOI22(OAI22(x,x,x),OAI21(x,x,x),OAI21(x,x,x),x);

[0067] OAI22(AOI21(x,x,x),AOI21(x,x,x),AOI21(x,x,x),AOI21(x,x,x));

[0068] OAI22(AOI21(x,x,x),AOI21(x,x,x),AOI21(x,x,x),x);

[0069] Among them, x is the input binary data, NAND2 is a two-input NAND gate, OAI21 is a three-input NAND-OR gate, NAND3 is a three-input NAND gate, NOR2 is a two-input NOR gate, OR2 is a two-input OR gate, AOI21 is a three-input AND-NOR gate, AND2 is a two-input AND gate, AOI22 is a four-input AND-NOR gate, and OAI22 is a four-input NAND-OR gate.

[0070] According to another aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0071] According to another aspect of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, wherein the computer program instructions implement the above method when executed by a processor.

[0072] According to another aspect of the present disclosure, a computer program product is provided, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

[0073] In the disclosed embodiment, the target circuit structure that meets the delay requirements and security requirements is directly screened out in the low-latency circuit to construct the S-box, eliminating the need to traverse all possible implementation methods, thereby improving the efficiency of constructing the S-box. In addition, the low-latency circuit in this application covers several major types of logic gates in the logic library, including single-input logic gates, two-input logic gates, and multi-input logic gates, thereby increasing the possibility of discovering a circuit structure with lower latency and reducing the latency of the S-box.

[0074] Further features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the disclosure and, together with the description, serve to explain the principles of the disclosure.

[0076] Figure 1 A flowchart of a method for constructing a low-latency S-box provided in an embodiment of the present disclosure.

[0077] Figure 2 A schematic diagram of the structure of a low-latency S-box construction device provided in an embodiment of the present disclosure.

[0078] Figure 3A schematic diagram of the structure of an electronic device for constructing a low-latency S-box provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0079] Various exemplary embodiments, features and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0080] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0081] In addition, in order to better illustrate the present disclosure, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present disclosure can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present disclosure.

[0082] Figure 1 The following is a flow chart of a method for constructing a low-latency S-box according to an embodiment of the present disclosure. Figure 1 As shown, the method includes:

[0083] S11, obtaining a low-latency circuit structure, wherein the low-latency circuit structure includes a logic gate or a combination of logic gates in a logic library, wherein the logic gate includes: a single-input logic gate, a two-input logic gate, and a multi-input logic gate.

[0084] The low-latency circuit structure may include logic gates of various inputs in the logic library, which actually includes most or all logic gates in the logic library. For example, it may include an inverter, a buffer, a two-input NAND gate, a two-input NOR gate, a two-input AND gate, a two-input OR gate, a two-input XOR gate, a two-input XNOR gate, a three-input NAND gate, a three-input OR NAND gate, a three-input AND NOR gate, a three-input NOR gate, a three-input AND gate, a three-input OR gate, a two-input selector, a four-input OR NAND gate, a four-input AND NOR gate, a four-input NAND gate, a four-input NOR gate, a four-input AND gate, and a four-input OR gate. Therefore, a low-latency circuit structure can be determined from as many logic gate combinations as possible. In this way, the delay corresponding to the low-latency circuit structure in the embodiment of the present disclosure may be lower, which increases the possibility of using a low-latency circuit structure with lower delay to build an S-box. In cryptography, an S-box (Substitution-box) is a basic component for a symmetric cryptographic algorithm to perform obfuscation calculations.

[0085] S12: Based on the low-latency circuit structure, determine a target circuit structure that meets a given delay requirement and meets security requirements.

[0086] The multiple low-latency circuit structures that can be obtained in S11 may be one or more. These one or more low-latency circuits can be screened according to the delay length, such as screening out circuit structures with delays less than the delay threshold, and determining the safety indicators of these screened circuit structures, and using the circuit structure that meets the safety requirements as the target circuit. The safety requirements here can be to verify the safety of a single circuit structure, and can be to verify the safety of multiple circuit structures after splicing. Safety requirements may include requirements for balance, full dependence, linearity, and differential distribution uniformity.

[0087] S13, construct an S-box based on the target circuit structure.

[0088] In the disclosed embodiment, the target circuit structure that meets the delay requirements and security requirements is directly screened out in the low-latency circuit to construct the S-box; eliminating the need to traverse all possible implementation methods, thereby improving the efficiency of constructing the S-box. In addition, the low-latency circuit in the present application covers several major types of logic gates in the logic library, including single-input logic gates, two-input logic gates, and multi-input logic gates, thereby increasing the possibility of discovering a circuit structure with lower latency than that not found in the related art, and reducing the latency of the S-box.

[0089] In one possible implementation, based on the low-latency circuit structure, determining a target circuit structure that meets a given delay requirement and meets safety requirements includes: traversing and using the logic gates to replace substructures of non-critical paths in the low-latency circuit structure to obtain multiple replaceable circuit structures; screening the low-latency circuit structure and the replaceable circuit structure to obtain the target circuit structure.

[0090] The low-latency circuit structure may include one or more logic gates, so it can be a one-layer structure, a two-layer structure, or a multi-layer structure. In the case where the low-latency circuit structure is a multi-layer structure, the low-latency circuit structure can be composed of a critical path and a non-critical path, and each node on the path can be a logic gate. A single node or multiple nodes on the same path can constitute a substructure. The critical path is the path with the longest duration, and replacing the substructure on the non-critical path will not affect the delay of the low-latency circuit structure.

[0091] Therefore, each logic gate in the logic library can be traversed to replace the substructure in the non-critical path. Therefore, multiple replaceable circuit structures can be obtained for a low-latency circuit structure. The delay of these replaceable circuit structures is the same as that of the low-latency circuit. In this way, replaceable circuit structures with the same delay as the low-latency circuit structure can be determined, expanding the selection range of the target circuit structure. The possibility of accurately determining the target circuit structure is improved.

[0092] In a possible implementation, the screening of the low-latency circuit structure and the replaceable circuit structure to obtain the target circuit structure includes: selecting a first circuit structure that meets the balance requirement and the full dependency requirement; determining the first truth table corresponding to each substructure of the first circuit structure, wherein, in the case of obtaining the first truth table of the same level, the lexicographic order of the first truth table obtained first is less than the lexicographic order of the first truth table obtained later; based on the first truth table, determining the truth table of the first circuit structure; when the truth table of a single first circuit structure is different from the truth tables of all the second circuit structures in the equivalent pool, adding the single first circuit structure as the second circuit structure to the equivalent pool; when the truth table of a single first circuit structure is the same as the truth table of at least one second circuit structure in the equivalent pool, abandoning the single first circuit structure.

[0093] For the convenience of the following description, the low-latency circuit structure and the replaceable circuit structure are named as candidate circuit structures. In the embodiment of the present disclosure, the input data can be matched with each input line of the candidate circuit structure in various combinations. For example: the candidate circuit structure has two input lines. For the convenience of distinction, the two input lines are named input line L1 and input line L2. In addition, there are two input data, a1 and a2. The combination of input data can be (a1, a2) and (a2, a1). Among them, in the brackets of the input data combination form, the first input data is input into the candidate circuit structure through the input line L1, and the second input data is input into the candidate circuit structure through the input line L2. Then, the output values ​​corresponding to each candidate circuit can be obtained. The second number of output values ​​with a statistical value of 0, and the third number of output values ​​with a numerical value of 1. The balance requirement can be a requirement for the second number and the third number. For example, it can be preset that when the second number is equal to the third number, it means that the candidate circuit structure meets the balance requirement. Balance screening of candidate circuits can screen out circuit structures with good resistance to statistical attacks.

[0094] In the embodiments of the present disclosure, one or more input data may be changed, and the change of the output data may be determined. The change situations may include: situation one: as long as (one or more) input data changes, the output data may change; situation two: some input data changes, which may cause the output data to change; situation three: the input data change will not cause the output data to change. The full dependency requirement may be a description of the sensitivity of the output data to the change of the input data. For example: it can be preset that when the above situation one is met, it means that the candidate circuit structure meets the full dependency requirement. The circuit structure screened out by the full dependency requirement has a more complex input-output relationship and a higher nonlinearity.

[0095] In this way, the candidate circuit structures can be screened using the balance requirements and the full dependency requirements to obtain one or more first circuit structures. The first circuit structure can be a one-level circuit structure, a two-level circuit structure, or a multi-level circuit structure. In the case where the first circuit structure is a one-level circuit structure, the substructure of the first circuit structure is the first circuit structure itself. In the case where the first circuit structure is a two-level circuit structure or a multi-level circuit structure, the substructure of the first circuit structure is a part of the first circuit structure. Exemplarily: in the case where the first circuit structure is a three-level circuit structure, each circuit structure of the first level can be a substructure, and each circuit structure of the second level can be a substructure. For example: the first circuit structure is as follows:

[0096] NAND2(OAI21(INV(x), NAND(x), INV(x)), NAND2(INV(x), INV(x))), then the substructure of the first circuit structure can be: INV(x), NAND(x), OAI21(INV(x), NAND(x), INV(x)), and NAND2(INV(x), INV(x)).

[0097] Each substructure of the first circuit structure can correspond to a first truth table. The first truth table of the first level can be combined in various combinations for input data and input into the first level structure to determine each output data, and then the input data and the output data are formed according to the corresponding relationship. The first truth table of the second level and above can be a truth table obtained by combining the first truth tables of the lower level and performing the logic gate operation of the current level on the combined first truth table. The first truth table can correspond to a lexicographic order. Since the order of the first truth tables in the first truth table combination will not affect the truth table finally determined. Therefore, in the case of determining the first truth table of the current level by the first truth table of the lower level, the lexicographic order of the first truth table obtained first can be limited to be less than the lexicographic order of the first truth table obtained later. This will greatly reduce repeated calculations and improve the efficiency of determining the first truth table of the first circuit structure and the substructure of the first circuit structure.

[0098] After determining the first truth table of each substructure, for the first circuit structure of the Nth level, where N is a positive integer, various combinations of the first truth tables of the N-1th level can be used, and the first truth tables in these combinations can be used to perform logic gate operations in the Nth level to determine the truth table of the first circuit structure.

[0099] Exemplarily: the first circuit structure may be NAND2 (NAND2 (x, x), OAI21 (x, x, x)), NAND2 (x, x) corresponds to the first truth table A, and OAI21 (x, x, x) corresponds to the first truth table B. Since it is defined above that the lexicographic order of the first truth table obtained first is less than the lexicographic order of the first truth table obtained later, there is only one combination of the first truth table A and the second truth table B. The first truth table A and the first truth table B are calculated by a NAND gate (NAND2) to determine the truth table of the first circuit structure.

[0100] An equivalence pool can be pre-constructed, and the equivalence pool can store second circuit structures with different truth tables, that is, the second circuit structures in the equivalence pool are not equivalent to each other. The initial state of the equivalence pool can be empty. The truth table of the first circuit structure can be compared with the truth tables of each second circuit structure in the equivalence pool. In the case where the truth table of the first circuit structure is different from the truth table of each second circuit structure in the equivalence pool, the first circuit structure is added to the equivalence pool. If there is at least one second circuit structure in the equivalence pool whose truth table is the same as the truth table of the first circuit structure, it means that the first circuit structure is equivalent to at least one second circuit structure in the equivalence pool, and then the first circuit structure is abandoned.

[0101] In this way, based on the method of the embodiment of the present disclosure, a series of second circuit structures are obtained. These second circuit structures meet the balance requirements, the full dependence requirements, and the security requirements of the S-box. Moreover, these second circuit structures are not equivalent to each other, which reduces the workload of subsequent screening work and improves the efficiency of building the S-box.

[0102] In a possible implementation, the low-latency circuit structure and the replaceable circuit structure are screened to obtain the target circuit structure, including: combining the second circuit structures according to the number of bits n of the S-box to be constructed to obtain multiple first structure combinations, wherein a single first structure combination has n second circuit structures, and n is a positive integer; performing linearity screening on the first structure combinations to obtain second structure combinations that meet linearity conditions; performing differential distribution screening on the second structure combinations to obtain third structure combinations that meet differential distribution probability conditions; and using the circuit structures in each of the third structure combinations as the target circuit structure.

[0103] In the disclosed embodiment, each second circuit structure can be traversed to determine all possible second circuit structure combinations to obtain multiple first structure combinations. The number of second circuit structures in the first structure combination can be equal to the number of bits of the S-box to be constructed.

[0104] Linearity is an indicator that measures the similarity between a Boolean function (circuit structure) and a linear (or affine) function. For an S-box, low linearity means that it is more difficult to be cracked by a linear cryptanalysis attack. In the disclosed embodiment, a linearity threshold can be preset to calculate the linearity of the first structural combination. The lower the linearity, the higher the nonlinearity of the first structural combination, and the stronger the ability of the constructed S-box to resist linear attacks. When the linearity of the first structural combination is not greater than the preset linearity threshold, the first structural combination is determined as the second structural combination.

[0105] The differential distribution characterizes the relationship between the input differential and the output differential of the S-box. In the disclosed embodiment, a differential distribution uniformity threshold may be preset to calculate the uniformity of the differential distribution of the second structural combination. The lower the uniformity of the differential distribution of the second structural combination, the stronger the ability of the constructed S-box to resist differential attacks. In the case where the uniformity of the differential distribution of the second structural combination is less than the preset differential distribution uniformity threshold, the second structural combination is determined as the third structural combination. The circuit structure in the third structural combination may be used as the target circuit structure.

[0106] In the disclosed embodiment, the second circuit structures that have been screened and meet the security requirements of the S-box are combined, and the combination is taken as the overall inspection object, and the combination method is further screened to determine the circuit structure combination that meets the security requirements, and then the circuit structure in the combination is used as the target circuit structure. Not only does a single target circuit structure meet the security requirements of constructing the S-box, but the target circuit structure also meets the security requirements of constructing the S-box after combination, and is a low-latency circuit.

[0107] In one possible implementation, the linearity screening of the first structure combination to obtain the second structure combination that meets the linearity condition includes: when the first linearity of a single second circuit structure within a single first structure combination, or the second linearity of at least two second circuit structures spliced ​​together, does not meet the linearity condition, abandoning the single first structure combination.

[0108] In the disclosed embodiment, the first linearity of the second circuit structure in the first structural combination can be calculated, and the first linearity can be compared with the linearity threshold. In the case where a first linearity is greater than the linearity threshold, the entire first structural combination is abandoned. If all the first linearities are not greater than the linearity threshold, the second circuit structure can be traversed to determine various combinations of the second circuit structure, and then the second linearities of these combinations can be determined, and then the second linearities can be compared with the linearity threshold. In the case where a second linearity is greater than the linearity threshold, the entire first structural combination is abandoned. In the case where all the second linearities are not greater than the linearity threshold, the first structural combination is subjected to differential distribution screening.

[0109] In the disclosed embodiment, the second structural combination can be screened out only by determining the first linearity or the second linearity. That is, in the process of calculating the linearity of the first structural combination, the first structural combination that does not meet the linearity requirement can be screened out without completing all linearity calculations before determining whether to screen out the first structural combination, thereby reducing the amount of calculation and improving the screening efficiency of the target circuit structure.

[0110] In one possible implementation, obtaining a low-latency circuit structure includes: combining the logic gates in the logic library and using a single combination as a third circuit structure to obtain multiple third circuit structures; measuring the delay of each third circuit structure; obtaining a target delay of the S-box to be constructed and a first number of input data, and determining a third circuit structure whose delay is less than or equal to the target delay and whose number of input data is the first number as the low-latency circuit structure.

[0111] The logic library may be an existing common logic library, such as an ASIC logic library, an FPGA logic library, etc. The logic library may be an uncommon logic library developed according to actual needs. According to the functional characteristics, the logic gates may include basic logic gates, compound logic gates, and special compound logic gates. According to the number of input data, the logic gates may include single-input logic gates, two-input logic gates, and multi-input logic gates. The disclosed embodiments do not limit the types of logic gates.

[0112] In one example, the logic gates may include an inverter (INV), a buffer (BUF), a two-input NAND gate (NAND2), a two-input NOR gate (NOR2), a two-input AND gate (AND2), a two-input OR gate (OR2), a two-input XOR gate (XOR2), a two-input XNOR gate (XNOR2), a three-input NAND gate (NAND3), a three-input NAND gate (OAI21), a three-input AND-NOR gate (AOI21), a three-input NOT gate (NOR3), a three-input AND gate (AND3), a three-input OR gate (OR3), a two-input selector (MUX2), a four-input NAND gate (OAI22), a four-input AND-NOR gate (AOI22), a four-input NAND gate (NAND4), a four-input NOR gate (NOR4), a four-input AND gate (AND4), and a four-input OR gate (OR4).

[0113] In the disclosed embodiment, all or most of the logic gates in the logic library can be obtained to increase the number of determined circuit structure categories as much as possible, thereby expanding the selection range to select a low-latency circuit structure with lower latency.

[0114] In the disclosed embodiment, each logic gate can be traversed to obtain possible combinations of logic gates. Exemplarily, multiple groups of quadtrees can be constructed based on the logic gates, a single node of the quadtree is a logic gate, nodes in the same layer are the same logic gates, quadtrees in the same group are the same, quadtrees between groups are different, the first layer of each quadtree is composed of inverters and buffers, and a single node of the quadtree can form a circuit structure of multiple Boolean functions.

[0115] Since the number of input data of a logic gate usually does not exceed four, the number of forks of the tree is determined to be 4. In this way, the quadtree can satisfy the operation of each logic gate. In order to traverse the logic gates in the first logic library to complete the circuit structure formed by the logic gate with itself or with other logic gates; and in order to make the constructed circuit structure fully cover the circuit structure that may be constructed by the first logic library as much as possible; in the embodiment of the present disclosure, the nodes in the same layer of the quadtree are set to the same logic gate. The layers in the quadtree can have the same logic gate or different logic gates.

[0116] In order to simulate the fan-in and fan-out of the circuit structure in the actual application environment, the same quadtree is repeatedly set, and for the convenience of description, multiple quadtrees of the same type are grouped into a group of quadtrees. The quadtrees of each group together constitute all possible circuit structures, which can cover various combinations of logic gates in the first logic library.

[0117] Each node of the first layer of the quadtree can be composed of an inverter and a buffer. The signal data enters the first layer after being input into the quadtree. The first layer can perform inversion processing or buffer processing (enhancement, delay, etc.) on the signal data. In the embodiment of the present disclosure, the probability of each node in the first layer being an inverter or a buffer is equal. Therefore, the inverters and buffers in the first layer of the quadtree are randomly and evenly distributed.

[0118] A single quadtree may include multiple circuit structures, and a branch of a single quadtree may include multiple circuit structures at different levels.

[0119] In this way, each group of quadtrees in the embodiment of the present disclosure can simulate various combinations of logic gates in the first logic library, and can also simulate the operating state of each circuit structure in an actual application environment. Each combination can be used as a third circuit structure.

[0120] In a possible implementation, the number of quadtrees in the same group is the number of quadtree input data in the group, which can more accurately simulate the fan-in and fan-out number of input variables x in an actual environment.

[0121] In a possible implementation, a four-layer quadtree structure is used. The number of layers of the quadtree determines the maximum number of layers of the circuit structure constructed by the quadtree.

[0122] By studying the existing low-latency circuits, it can be found that the critical paths of the existing low-latency circuits basically do not exceed four layers. Therefore, in the disclosed embodiment, the quadtree can be directly limited to a four-layer quadtree, with only inverters and buffers in the first layer, and the inverters and buffers in the first layer are randomly and evenly distributed. In this way, the quadtree structure can be simplified, and the number of determined circuit structures can be reduced while including possible low-latency circuit structures. Moreover, since the level of the quadtree is limited, the probability that the circuit structure determined by the quadtree is a non-low-latency circuit is reduced. When the actual operating environment of the circuit structure can be accurately simulated, redundancy is reduced, the complexity of constructing a low-latency circuit is reduced, and the feasibility of the method is improved.

[0123] In the embodiment of the present disclosure, timing may start from when data is input into the third circuit structure and stop when the third circuit structure outputs data, so as to obtain the delay of a single third circuit structure.

[0124] For example, the same third circuit structure in the same group of quadtrees can be run together to measure the time from input to output of the data in the third circuit structure. The power, voltage, temperature, fan-in and fan-out of the third circuit structure in the actual operating environment are fully considered, so that the measured delay of the first circuit structure is more practical and more accurate.

[0125] The first number represents the number of bits of the S-box to be constructed. The target delay can be the delay of an existing S-box with the same number of bits as the S-box to be constructed. A third circuit structure with a delay less than or equal to the target delay and a first number of input data is used as the low-delay circuit structure. In this way, an S-box with the same number of bits as the existing S-box but the same or lower delay can be constructed, thereby increasing the possibility of determining an S-box with lower delay.

[0126] Using the method in the disclosed embodiment, a total of 240 4-bit S-boxes, 450 5-bit S-boxes, and at least 16 6-bit S-boxes were obtained.

[0127] In a possible implementation, the logic library includes: an ASIC logic library, and the target circuit structure includes:

[0128] Target circuit structure for constructing a 4-bit S-box:

[0129] NAND2(NAND2(x,x),OAI21(x,x,x));

[0130] NAND2(NAND3(x,x,x),OAI21(x,x,x));

[0131] AOI21(AND2(x,x),AOI21(x,x,x));

[0132] Target circuit structure for constructing a 5-bit S-box:

[0133] OAI21(OAI21(x,x,x),NOR2(x,x),NAND2(x,x));

[0134] OAI21(OAI21(x,x,x),NOR2(x,x),OR2(x,x));

[0135] NAND3(NAND2(x,x),NAND3(x,x,x),NAND2(x,x));

[0136] NAND3(NAND3(x,x,x),NAND3(x,x,x),NAND2(x,x));

[0137] AOI21(AOI21(x,x,x),NAND2(x,x),AND2(x,x));

[0138] Target circuit structure for constructing a 6-bit S-box:

[0139] AOI22(OAI22(x,x,x),OAI21(x,x,x),OAI21(x,x,x),OAI21(x,x,x));

[0140] AOI22(OAI22(x,x,x),OAI21(x,x,x),OAI21(x,x,x),x);

[0141] OAI22(AOI21(x,x,x),AOI21(x,x,x),AOI21(x,x,x),AOI21(x,x,x));

[0142] OAI22(AOI21(x,x,x),AOI21(x,x,x),AOI21(x,x,x),x);

[0143] Among them, x is the input binary data, NAND2 is a two-input NAND gate, OAI21 is a three-input NAND-OR gate, NAND3 is a three-input NAND gate, NOR2 is a two-input NOR gate, OR2 is a two-input OR gate, AOI21 is a three-input AND-NOR gate, AND2 is a two-input AND gate, AOI22 is a four-input AND-NOR gate, and OAI22 is a four-input NAND-OR gate.

[0144] The low-latency circuit structure in the embodiment of the present disclosure is selected after fully combining the single-input logic gates, two-input logic gates, and multi-input logic gates in the ASIC logic library. Since the selection range is expanded, the possibility of obtaining a lower-latency circuit structure is increased, so the low-latency circuit structure in the embodiment of the present disclosure has a lower delay than the low-latency circuit structure of the same position in the related art.

[0145] Figure 2 The schematic diagram of the structure of a low-latency S-box construction device provided by the embodiment of the present disclosure. Figure 2 As shown, the device 20 comprises:

[0146] A low-latency circuit structure acquisition unit 21 is used to acquire a low-latency circuit structure, wherein the low-latency circuit structure includes a logic gate or a combination of logic gates in a logic library, wherein the logic gate includes: a single-input logic gate, a two-input logic gate, and a multi-input logic gate;

[0147] A target circuit determination unit 22, configured to determine a target circuit structure that meets a given delay requirement and a safety requirement based on the low-latency circuit structure;

[0148] The S-box construction unit 23 is used to construct an S-box based on the target circuit structure.

[0149] In a possible implementation, the target circuit determination unit 22 includes:

[0150] A replaceable circuit structure determination unit, configured to traverse and use the logic gates to replace substructures of non-critical paths in the low-latency circuit structure to obtain a plurality of replaceable circuit structures;

[0151] The first target circuit structure determination subunit is used to screen the low-latency circuit structure and the replaceable circuit structure to obtain the target circuit structure.

[0152] In a possible implementation manner, the replaceable circuit structure determining unit is further configured to:

[0153] Selecting a first circuit structure that meets the balance requirement and the full dependence requirement;

[0154] Determine a first truth table corresponding to each substructure of the first circuit structure, wherein, in the case of obtaining first truth tables at the same level, the lexicographic order of the first truth table obtained first is smaller than the lexicographic order of the first truth table obtained later;

[0155] Based on the first truth table, determining a truth table of a first circuit structure;

[0156] When the truth table of a single first circuit structure is different from the truth tables of all second circuit structures in the equivalent pool, adding the single first circuit structure as a second circuit structure to the equivalent pool;

[0157] When the truth table of a single first circuit structure is identical to the truth table of at least one second circuit structure in the equivalence pool, the single first circuit structure is discarded.

[0158] In a possible implementation manner, the target circuit structure determination subunit is used to:

[0159] According to the number of bits n of the S-box to be constructed, the second circuit structures are combined to obtain a plurality of first structure combinations, wherein a single first structure combination has n second circuit structures, where n is a positive integer;

[0160] Performing linearity screening on the first structural combination to obtain a second structural combination that meets a linearity condition;

[0161] Perform differential distribution screening on the second structural combination to obtain a third structural combination with full differential distribution probability conditions;

[0162] The circuit structure in each of the third structure combinations is used as the target circuit structure.

[0163] In a possible implementation, the linearity screening of the first structural combination to obtain a second structural combination that meets the linearity condition includes:

[0164] When the first linearity of a single second circuit structure within a single first structure combination, or the second linearity of at least two second circuit structures spliced ​​together, does not meet the linearity condition, the single first structure combination is abandoned.

[0165] In a possible implementation, the low-latency circuit structure acquisition unit 21 is used to:

[0166] Combining the logic gates in the logic library and using a single combination as a third circuit structure to obtain a plurality of third circuit structures;

[0167] measuring the delay of each third circuit structure;

[0168] Obtain the target delay of the S-box to be constructed and the first amount of input data,

[0169] A third circuit structure in which a delay is less than or equal to a target delay and the number of input data is the first number is determined as the low-latency circuit structure.

[0170] In a possible implementation, the logic library includes: an ASIC logic library, and the target circuit structure includes:

[0171] Target circuit structure for constructing a 4-bit S-box:

[0172] NAND2(NAND2(x,x),OAI21(x,x,x));

[0173] NAND2(NAND3(x,x,x),OAI21(x,x,x));

[0174] AOI21(AND2(x,x),AOI21(x,x,x));

[0175] Target circuit structure for constructing a 5-bit S-box:

[0176] OAI21(OAI21(x,x,x),NOR2(x,x),NAND2(x,x));

[0177] OAI21(OAI21(x,x,x),NOR2(x,x),OR2(x,x));

[0178] NAND3(NAND2(x,x),NAND3(x,x,x),NAND2(x,x));

[0179] NAND3(NAND3(x,x,x),NAND3(x,x,x),NAND2(x,x));

[0180] AOI21(AOI21(x,x,x),NAND2(x,x),AND2(x,x));

[0181] Target circuit structure for constructing a 6-bit S-box:

[0182] AOI22(OAI22(x,x,x),OAI21(x,x,x),OAI21(x,x,x),OAI21(x,x,x));

[0183] AOI22(OAI22(x,x,x),OAI21(x,x,x),OAI21(x,x,x),x);

[0184] OAI22(AOI21(x,x,x),AOI21(x,x,x),AOI21(x,x,x),AOI21(x,x,x));

[0185] OAI22(AOI21(x,x,x),AOI21(x,x,x),AOI21(x,x,x),x);

[0186] Among them, x is the input binary data, NAND2 is a two-input NAND gate, OAI21 is a three-input NAND-OR gate, NAND3 is a three-input NAND gate, NOR2 is a two-input NOR gate, OR2 is a two-input OR gate, AOI21 is a three-input AND-NOR gate, AND2 is a two-input AND gate, AOI22 is a four-input AND-NOR gate, and OAI22 is a four-input NAND-OR gate.

[0187] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0188] The embodiment of the present disclosure also provides a computer-readable storage medium on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor. The computer-readable storage medium can be a volatile or non-volatile computer-readable storage medium.

[0189] An embodiment of the present disclosure further proposes an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0190] The embodiments of the present disclosure also provide a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

[0191] Figure 3 The schematic diagram of the structure of an electronic device for constructing a low-latency S-box provided by an embodiment of the present disclosure. For example, the electronic device 1900 can be provided as a server or a terminal device. Figure 3 , the electronic device 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions executable by the processing component 1922, such as an application. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0192] The electronic device 1900 may also include a power supply component 1926 configured to perform power management of the electronic device 1900, a wired or wireless network interface 1950 configured to connect the electronic device 1900 to a network, and an input / output interface 1958 (I / O interface). The electronic device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server 2003. TM , Mac OS X TM , Unix TM ,Linux TM , FreeBSD TM or similar.

[0193] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the electronic device 1900 to perform the above method.

[0194] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0195] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0196] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0197] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0198] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0199] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0200] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0201] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0202] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A low-latency S-box construction method, characterized in that: include: Acquire a low-latency circuit structure, the low-latency circuit structure comprising a logic gate or a combination of logic gates in a logic library, the logic gate comprising: a single-input logic gate, a two-input logic gate, and a multi-input logic gate; Based on the low-latency circuit structure, determining a target circuit structure that meets a given latency requirement and meets security requirements; Based on the target circuit structure, construct an S-box.

2. The method according to claim 1, characterized in that The step of determining a target circuit structure that meets a given delay requirement and a safety requirement based on the low-latency circuit structure includes: Traversing and using the logic gates to replace substructures of non-critical paths in the low-latency circuit structure to obtain multiple replaceable circuit structures; The low-latency circuit structure and the replaceable circuit structure are screened to obtain the target circuit structure.

3. The method according to claim 2, characterized in that The step of screening the low-latency circuit structure and the replaceable circuit structure to obtain the target circuit structure includes: Selecting a first circuit structure that meets the balance requirement and the full dependence requirement; Determine a first truth table corresponding to each substructure of the first circuit structure, wherein, in the case of obtaining first truth tables at the same level, the lexicographic order of the first truth table obtained first is smaller than the lexicographic order of the first truth table obtained later; Based on the first truth table, determining a truth table of a first circuit structure; When the truth table of a single first circuit structure is different from the truth tables of all second circuit structures in the equivalent pool, adding the single first circuit structure as a second circuit structure to the equivalent pool; When the truth table of a single first circuit structure is identical to the truth table of at least one second circuit structure in the equivalence pool, the single first circuit structure is discarded.

4. The method according to claim 3, characterized in that The step of screening the low-latency circuit structure and the replaceable circuit structure to obtain the target circuit structure includes: According to the number of bits n of the S-box to be constructed, the second circuit structures are combined to obtain a plurality of first structure combinations, wherein a single first structure combination has n second circuit structures, where n is a positive integer; Performing linearity screening on the first structural combination to obtain a second structural combination that meets a linearity condition; Perform differential distribution screening on the second structural combination to obtain a third structural combination with full differential distribution probability conditions; The circuit structure in each of the third structure combinations is used as the target circuit structure.

5. The method according to claim 4, characterized in that The linearity screening of the first structural combination to obtain a second structural combination that meets the linearity condition includes: When the first linearity of a single second circuit structure within a single first structure combination, or the second linearity of at least two second circuit structures spliced ​​together, does not meet the linearity condition, the single first structure combination is abandoned.

6. The method according to claim 1, characterized in that The obtaining of the low-latency circuit structure comprises: Combining the logic gates in the logic library and using a single combination as a third circuit structure to obtain a plurality of third circuit structures; measuring the delay of each third circuit structure; Obtain the target delay of the S-box to be constructed and the first amount of input data, A third circuit structure in which a delay is less than or equal to a target delay and the number of input data is the first number is determined as the low-latency circuit structure.

7. The method according to claim 1, characterized in that The logic library includes: an ASIC logic library, and the target circuit structure includes: Target circuit structure for constructing a 4-bit S-box: NAND2(NAND2(x,x),OAI21(x,x,x)); NAND2(NAND3(x,x,x),OAI21(x,x,x)); AOI21(AND2(x,x),AOI21(x,x,x)); Target circuit structure for constructing a 5-bit S-box: OAI21(OAI21(x,x,x),NOR2(x,x),NAND2(x,x)); OAI21(OAI21(x,x,x),NOR2(x,x),OR2(x,x)); NAND3(NAND2(x,x),NAND3(x,x,x),NAND2(x,x)); NAND3(NAND3(x,x,x),NAND3(x,x,x),NAND2(x,x)); AOI21(AOI21(x,x,x),NAND2(x,x),AND2(x,x)); Target circuit structure for constructing a 6-bit S-box: AOI22(OAI22(x,x,x),OAI21(x,x,x),OAI21(x,x,x),OAI21(x,x,x)); AOI22(OAI22(x,x,x),OAI21(x,x,x),OAI21(x,x,x),x); OAI22(AOI21(x,x,x),AOI21(x,x,x),AOI21(x,x,x),AOI21(x,x,x)); OAI22(AOI21(x,x,x),AOI21(x,x,x),AOI21(x,x,x),x); Among them, x is the input binary data, NAND2 is a two-input NAND gate, OAI21 is a three-input NAND-OR gate, NAND3 is a three-input NAND gate, NOR2 is a two-input NOR gate, OR2 is a two-input OR gate, AOI21 is a three-input AND-NOR gate, AND2 is a two-input AND gate, AOI22 is a four-input AND-NOR gate, and OAI22 is a four-input NAND-OR gate.

8. A low-latency S-box construction device, characterized in that: include: A low-latency circuit structure acquisition unit, used to acquire a low-latency circuit structure, wherein the low-latency circuit structure includes a logic gate or a combination of logic gates in a logic library, wherein the logic gate includes: a single-input logic gate, a two-input logic gate, and a multi-input logic gate; A target circuit determination unit, configured to determine a target circuit structure that meets a given delay requirement and a safety requirement based on the low-latency circuit structure; The S-box construction unit is used to construct an S-box based on a target circuit structure.

9. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to implement the method described in any one of claims 1 to 7 when executing the instructions stored in the memory.

10. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images