Realization method of PRESENT encryption and decryption table look-up type threshold

Abstract

The invention discloses a table look-up threshold implementation method for PRESENT encryption and decryption, and belongs to the field of password hardware design. The method comprises an input selection layer, a round function first layer, a round function second layer, a round function third layer, a round function fourth layer and a round function fifth layer. The method comprises the following steps: firstly, performing secondary decomposition derivation of S-box inversion based on S-box secondary decomposition of an encrypted part; and then deriving and decrypting the threshold implementation of the nonlinear function F-1 of the part. On the basis of S box decomposition of an encryption part, S box inversion decomposition of a decryption part is given, a table look-up encryption and decryption threshold implementation mode is also given, and the method is suitable for an application scene needing bidirectional operation of encryption and decryption at the same time; the method can be applied to multiple hardware platforms such as an FPGA (Field Programmable Gate Array) and an ASIC (Application Specific Integrated Circuit) to realize PRESENT.

Description

Technical Field

[0001] The invention belongs to the field of cryptographic hardware design, and in particular relates to a table lookup type threshold implementation method for PRESENT encryption and decryption. Background Art

[0002] During operation, cryptographic hardware will generate various forms of information leakage, such as energy consumption, electromagnetic radiation, execution time, cache access mode, etc. The analysis methods that use these information leaks to recover sensitive information such as keys are collectively referred to as side channel attacks (or side channel analysis). After nearly 30 years of development, side channel attacks have been proven to be applicable to attacking all or most of the symmetric and asymmetric cryptographic algorithm implementations on various types of hardware platforms such as FPGAs, smart cards, processors, and graphics processing units, posing a serious threat to the security of chips. Therefore, the design of cryptographic hardware that resists side channel attacks is essential. With the development of side channel attack technology, the security threats caused by side channel attacks are increasing, which has attracted the attention of international scholars in academia and industry. In 2012, the International Organization for Standardization (ISO) issued the international standard cryptography ISO / IEC19790 "Technical Requirements for Cryptographic Module Security", which regards non-invasive attacks mainly based on side channel attacks as a separate security domain and gives four security levels. Influenced by the actual attack security threats and the common security requirements of international and national standards, whether or not to resist side channel attacks has become one of the problems that cryptographic hardware must face.

[0003] The ultra-lightweight block cipher algorithm PRESENT in the existing technology is designed for resource-constrained environments (such as RFID tags and sensor networks). In 2019, the PRESENT algorithm was selected as a lightweight cryptographic algorithm, and its corresponding international standard is ISO / IEC 29192-2:2019.

[0004] Based on the design idea of ​​multi-party secure computing in the prior art, a glitch-free masking scheme, Threshold Implementation (TI), is proposed. Threshold implementation does not provide a definite algorithm, but clarifies three core constraints: correctness, incompleteness, and uniformity. In other words, any construction that meets these conditions can be regarded as a threshold implementation scheme. In the threshold implementation, the number of shared factors is determined by t(d+1), where t is the algebraic degree of the nonlinear function and d is the order of resistance to side channel attacks. Threshold implementation (TI) solves the glitch problem in mask hardware design well and can avoid first-order leakage.

[0005] In the prior art, for PRESENT encryption, a masking scheme is combined with a hiding scheme to provide an affine calculation type threshold implementation scheme, which is suitable for hardware implementation. In the prior art, for PRESENT encryption, a table lookup type threshold implementation scheme is provided by pre-calculating the table lookup result corresponding to the nonlinear part, which is suitable for software implementation. The above-mentioned prior arts only provide threshold implementations for PRESENT encryption, but not for PRESENT decryption, and there is no table lookup type threshold implementation scheme for hardware implementation.

[0006] However, the threshold implementation scheme of PRESENT decryption is also indispensable. On the one hand, since the PRESENT algorithm adopts the SPN structure, the nonlinear function of the decryption part is different from the function of the encryption part. Therefore, the protection scheme of the decryption part cannot be directly obtained from the protection scheme of the encryption part; on the other hand, from the perspective of algorithm integrity, the decryption part is also susceptible to side channel attacks. For the integrity and availability of data, in most scenarios such as secure communication, data storage, user authentication, security protocols, key distribution, and end-to-end encryption, two-way operations of encryption and decryption are involved. Therefore, the present invention provides an encryption and decryption threshold implementation scheme for the PRESENT cryptographic algorithm, including two implementation methods: calculation type and table lookup type. Summary of the invention

[0007] In response to the problems mentioned in the background technology, the present invention proposes an encryption and decryption threshold implementation scheme for the PRESENT cryptographic algorithm, which solves the problem that the existing PRESENT only provides the encryption threshold implementation. It is suitable for application scenarios that require bidirectional operations of encryption and decryption at the same time, and can resist first-order side channel attacks and high-order zero-offset side channel attacks.

[0008] Technical solution: In order to solve the above technical problems, the technical solution adopted by the present invention is as follows:

[0009] A table lookup threshold implementation method for PRESENT encryption and decryption, comprising an input selection layer, a first round function layer, a second round function layer, a third round function layer, a fourth round function layer and a fifth round function layer;

[0010] The input selection layer: implements input selection of three shared factors in parallel;

[0011] The first layer of the round function: realizes the function of round key addition;

[0012] The second layer of the round function: the encryption layer T and the decryption layer P are implemented in parallel -1 Layer and decrypted A'' -1 layer;

[0013] The third layer of the round function: implements the encrypted A'' layer, the encrypted P layer and the decrypted 2:1 MUX layer in parallel;

[0014] The fourth layer of the round function: the encrypted 2:1 MUX layer and the decrypted T -1 layer;

[0015] The fifth layer of the round function: realizes the output selection of three shared factors;

[0016] First, based on the S-box secondary decomposition of the encrypted part, the secondary decomposition derivation of the S-box inversion is performed;

[0017] Then derive the nonlinear function F of the decryption part -1 The threshold is achieved.

[0018] As a preference, firstly, based on the S-box secondary decomposition of the encrypted part, the specific content of the secondary decomposition derivation of the S-box inversion is:

[0019] The known S-box secondary decomposition based on the encrypted part;

[0020] Based on the S-box decomposition function of PRESENT, the decomposed S-box is expressed as: Among them, A”, A’, A are all 4-bit affine transformations, as follows:

[0021] A=01AB892345EFCD67,A′=0B835ED61A924FC7,A”=C98D6327AFEB0541 Then the S-box is represented as:

[0022]

[0023] Among them, A''=8FDACB9E43160752, Q 12 The expression is:

[0024]

[0025] Where a, b, c, d are 4-bit input data, each letter represents 1 bit of data; e, f, g, h are 4-bit output data, each letter represents 1 bit of data;

[0026] The secondary decomposition derivation of S-box inversion is as follows:

[0027] because By Q 12 F is derived, and the corresponding transformation expression of F is C905AF8D63EB4127;

[0028] The decomposition result of S-box inversion is derived from formula (1), which is:

[0029]

[0030] Among them, S -1 Indicates S-box inversion; F -1 Indicates the inversion of the F function; A -1 Indicates the inverse of the affine transformation A; A" -1 represents the inverse of the affine transformation A”;

[0031] By Q 12 Derived Q 12 Inverse function Q 12 -1 , specifically:

[0032]

[0033] According to formulas (3) and (4), F -1 The corresponding transformation is 2DE9C38F614B07A5.

[0034] As a preferred method, derive the decryption part nonlinear function F -1 The specific contents of the threshold implementation are:

[0035] The threshold implementation of the nonlinear function F in the encrypted part is expressed as T(x i ,x j )=A”((Q 12 ) i,j (A(x i ),A(x j )));

[0036]

[0037] T(x i ,x j ) is inputted as xi and xj, where xi and xj represent the 4-bit inputs of the i-th and j-th shared factors respectively; first, after affine transformation A, we get A(x i ),A(x j ), and as (Q 12 ) i,j The two inputs are (Q 12 ) i,j After the affine transformation A", a corresponding 4-bit shared output T is obtained;

[0038] Derived the nonlinear function F of the decryption part -1 The threshold value of T -1 , the formula is T -1 (x i ,x j )=A -1 (Q12 -1 (A” -1 (x i ),A” -1 (x j ))), specifically:

[0039] According to formula (4) and formula (5), Q is given 12 -1 The corresponding threshold is realized:

[0040]

[0041] Among them, x i , x j Represent the 4-bit input of the i-th and j-th shared factors respectively; first undergo an affine transformation A" -1 , get an A" -1 (x i ),A” -1 (x j ), and as (Q 12 -1 ) i,j The two inputs are (Q 12 -1 ) i,j Operation, and then affine transformation A -1 , and obtain a 4-bit shared output T -1 .

[0042] Preferably, in the first cycle, the input selection layer operation is performed; the input selection layer includes three 2:1MUX layers, the control signal of the 2:1MUX layer is the initial round valid signal f2, in the initial state f2=1, and the initial inputs P1, P2 and P3 are selected as outputs dreg1, dreg2 and dreg3 respectively; in the next 1-62 cycles, f2=0, and the round function inputs dat10_1, dat10_2, dat10_3 are selected as outputs dreg1, dreg2 and dreg3 respectively.

[0043] Preferably, the first layer of the round function includes 3 registers, 1 round key plus addRK and 1 2:1 MUX layer; the outputs of the 3 registers are the 3 outputs of the input selection layer; addRK is a round key addition operation, which means that the round key rk[i], i∈[1,2,…,32] is XORed with the output dreg1 of the first register;

[0044] The control signal of the 2:1MUX layer is the valid signal f1 of the odd cycle. When executed in the even cycle, f1=1, and the data processed by the round key plus addRK is selected as the output dat1_1; when executed in the odd cycle, f1=0, and dreg1 is selected directly as the output dat1_1; from the 1st to the 62nd cycle, dat1_2 is directly equal to dreg2, and dat1_3 is directly equal to dreg3.

[0045] Preferably, the second round function layer contains 3 T layers, 3 P layers, -1 Layers and 3 A's -1 layer;

[0046] The T layer represents two 64-bit inputs, which are divided into 16 4-bit inputs and then operated according to the T function;

[0047] P -1 Layer means that the 64-bit input is divided into 16 4-bit inputs in turn, and then divided into 16 4-bit inputs in accordance with P -1 Function to operate;

[0048] A'' -1 Layer means that the 64-bit input is divided into 16 4-bit inputs in sequence, and then A"' -1 =CAF98EBD06354271 function to perform the operation.

[0049] Preferably, the third layer of the round function includes 3 A"' layers, 3 P layers and 3 2:1 MUX layers;

[0050] The A'' layer means that the 64-bit input is divided into 16 4-bit inputs in sequence, and then operated according to the A''=8FDACB9E43160752 function;

[0051] The P layer means that the 64-bit input is divided into 16 4-bit inputs in sequence, and then operated according to the P function;

[0052] The control signal of the 2:1MUX layer is the odd-numbered cycle valid signal f1. When executed in the even cycle, f1=1, and dat5_1, dat5_2, dat5_3 are selected as outputs dat7_1, dat7_2, dat7_3; when executed in the odd cycle, f1=0, and dat6_1, dat6_2, dat6_3 are selected as outputs dat7_1, dat7_2, dat7_3.

[0053] Preferably, the fourth round function layer includes three 2:1 MUX layers, three T -1 layer;

[0054] The control signal of the 2:1MUX layer is the odd-numbered cycle valid signal f1. When executed in the even-numbered cycle, f1=1, and dat3_1, dat3_2, dat3_3 are selected as outputs dat9_1, dat9_2, dat9_3; when executed in the odd-numbered cycle, f1=0, and dat4_1, dat4_2, dat4_3 are selected as outputs dat9_1, dat9_2, dat9_3;

[0055] T -1 The layer represents two 64-bit inputs, which are divided into 16 4-bit inputs, and then divided into 16 4-bit inputs according to T -1 (a,b) function to operate.

[0056] Preferably, the fifth layer of the round function includes three 2:1 MUX layers;

[0057] The control signal of the three 2:1 MUX layers is the encrypted valid signal f. When encrypting, f=1, and dat9_1, dat9_2, dat9_3 are selected as outputs dat10_1, dat10_2, dat10_3; when decrypting, f=0, and dat8_1, dat8_2, dat8_3 are selected as outputs dat10_1, dat10_2, dat10_3.

[0058] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0059] (1) The present invention proposes a table-lookup threshold implementation method for PRESENT encryption and decryption, which uses 64 cycles to complete the encryption threshold implementation and 96 cycles to complete the decryption threshold implementation. The method can provide side channel attack protection for the encryption and decryption of the PRESENT algorithm and can be applied to hardware platforms such as FPGA and ASIC.

[0060] (2) Compared with the reference existing literature [SBM2018] which only gives the software table lookup threshold implementation method of the encryption part, the present invention focuses on the threshold implementation method of the decryption part and adds a register layer. In the same cycle, it is ensured that there is only one nonlinear operation, avoiding glitch leakage attacks, and is suitable for hardware side channel attack protection.

[0061] (3) The present invention provides a PRESENT-TI implementation, using 1693 LUTs and 289 Reg on a Kintex7 device, with an encryption / decryption throughput of 316.46 Mbps and a unit area throughput of 186.92 Kbps / LUT.

[0062] (4) The energy traces collected by the PRESENT-TI IP core of the present invention were evaluated for side channel security on the SAKURA-X development board. Three million energy traces were used to perform test vector leakage evaluation detection. The results showed that the PRESENT-TI IP core proposed by the present invention had no first-order information leakage, and no second-order to fourth-order zero-offset information leakage. Therefore, the PRESENT-TI IP core proposed by the present invention can resist first-order side channel attacks and high-order zero-offset side channel attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a schematic diagram of the circuit design for realizing the table lookup type threshold of PRESENT encryption and decryption of the present invention. DETAILED DESCRIPTION

[0064] The present invention is further illustrated below in conjunction with specific examples. The examples are implemented based on the technical solutions of the present invention. It should be understood that these examples are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0065] The table-lookup threshold implementation method for PRESENT encryption and decryption provided in this embodiment is mainly used in the field of cryptographic hardware design, and has bidirectional operations including encryption and decryption; at the same time, it can resist side channel attacks. This method can be applied to implement PRESENT in various hardware platforms such as FPGA and ASIC, and its specific implementation content includes:

[0066] S1: First, based on the S-box secondary decomposition of the encrypted part, the secondary decomposition derivation of the S-box inversion is performed;

[0067] S11: known S-box secondary decomposition based on the encrypted part;

[0068] by Taking the secondary decomposition of as an example, based on the S-box decomposition function of PRESENT, the decomposed S-box can be expressed as: Among them, A”, A’, A are all 4-bit affine transformations, as follows:

[0069] A=01AB892345EFCD67,A′=0B835ED61A924FC7,A”=C98D6327AFEB0541 Then the S-box can be expressed as follows:

[0070]

[0071] Among them, A''=8FDACB9E43160752, Q 12 The expression is:

[0072]

[0073] Among them, a, b, c, d are 4-bit input data, and each letter represents 1 bit of data; e, f, g, h are 4-bit output data, and each letter represents 1 bit of data.

[0074] S12: Perform secondary decomposition derivation for S-box inversion;

[0075] because So we can use Q 12 F is derived, and the corresponding transformation of F can be expressed as C905AF8D63EB4127.

[0076] The decomposition result of the S-box inversion can be derived from formula (1), which is:

[0077]

[0078] Among them, S -1 Indicates S-box inversion; F -1 Indicates the inversion of the F function; A -1 Indicates the inverse of the affine transformation A; A" -1 represents the inverse of the affine transformation A'.

[0079] By Q 12 It can be deduced that Q 12 Inverse function Q 12 -1 , as shown in formula (4):

[0080]

[0081] According to formulas (3) and (4), F -1 The corresponding transformation is 2DE9C38F614B07A5.

[0082] S2: Give the nonlinear function F of the decryption part -1 Threshold implementation method of ;

[0083] S21: Threshold realization of the known encrypted part nonlinear function F;

[0084] The threshold implementation of the nonlinear function F in the encrypted part is expressed as T(x i ,x j )=A”(Q 12 (A(x i ),A(x j ))).

[0085]

[0086] T(x i ,x j) is inputted as xi and xj, where xi and xj represent the 4-bit inputs of the i-th and j-th shared factors respectively; first, after affine transformation A, we get A(x i ),A(x j ), and as (Q 12 ) i,j The two inputs are (Q 12 ) i,j The specific calculation process is shown in formula (5); after affine transformation A", a corresponding 4-bit shared output T is obtained. This is T(x i ,x j )=A”(Q 12 (A(x i ),A(x j )))The corresponding calculation process can be used to derive the truth table of 8-bit input and 4-bit output.

[0087] S22: Derivation of the nonlinear function F for the decryption part -1 The threshold value of T -1 , the formula is T -1 (x i ,x j )=A -1 (Q 12 -1 (A” -1 (x i ),A” -1 (x j ))), specifically:

[0088] According to formula (4) and formula (5), Q is given 12 -1 The corresponding threshold implementation (ThresholdImplementation, TI):

[0089]

[0090] Among them, x i , x j Represents the 4-bit input of the i-th and j-th shared factors respectively. First, it undergoes an affine transformation A" -1 , get an A" -1 (x i ),A” -1 (x j ), and as (Q 12 -1 ) i,j The two inputs are (Q 12 -1 ) i,j Operation, and then affine transformation A -1, and obtain a 4-bit shared output T -1 This is T -1 (x i ,x j )=A -1 (Q 12 -1 (A” -1 (x i ),A” -1 (x j ))) The corresponding calculation process can be used to derive the truth table of 8-bit input and 4-bit output;

[0091] A -1 =016789EF4523CDAB

[0092] A” -1 =CF65ED47218B03A9

[0093] A'' -1 =CAF98EBD06354271

[0094] In order to avoid information leakage caused by input correlation, register operations are added after nonlinear operations. S3: A complete table-lookup threshold implementation method for PRESENT encryption and decryption is given.

[0095] A'' -1 =CAF98EBD06354271

[0096] Table 1 PRESENT encryption and decryption threshold implementation

[0097]

[0098]

[0099] Among them, rk[i]←KeySchedule(k) represents the key generation of PRESENT, which is consistent with the traditional key generation, except that each round of key is kept for 2 cycles, and Register represents adding a register layer to the output of the previous step.

[0100] In this embodiment, Taking the quadratic decomposition of as an example, the S-box decomposition function based on PRESENT is the prior art, and the referenced publicly published literature is as follows: [SMG2015] Pascal Sasdrich, Amir Moradi, Tim Güneysu. Affine Equivalence and Its Application to Tightening Threshold Implementations. SAC 2015: 263-276.

[0101] In this embodiment, T(x i ,x j )=A”(Q 12 (A(x i ),A(x j ))) The corresponding truth table is the prior art, and the referenced publicly published literature is as follows: [SBM2018] Pascal Sasdrich, René Bock, Amir Moradi. Threshold Implementation in Software-Case Study of PRESENT. COSADE 2018: 227-244.

[0102] The threshold implementation includes an input selection layer, a first round function layer, a second round function layer, a third round function layer, a fourth round function layer, and a fifth round function layer. Figure 1 shown.

[0103] Input selection layer: Implements input selection of three shared factors in parallel.

[0104] The first layer of round function: realizes the function of round key addition.

[0105] The second round function layer: the encryption layer T and the decryption layer P are implemented in parallel -1 Layer and decrypted A'' -1 layer.

[0106] The third round function layer: the encrypted A”’ layer, the encrypted P layer and the decrypted 2:1 MUX layer are implemented in parallel.

[0107] The fourth round function layer: the encrypted 2:1 MUX layer and the decrypted T are implemented in parallel -1 layer.

[0108] The fifth layer of the round function: implements the output selection of three shared factors.

[0109] Input selection layer: In the first cycle, the input selection layer operation is performed. The input selection layer includes three 2:1MUXs (2-to-1 multiplexers). The control signal of the 2:1MUX is the initial round valid signal f2. In the initial state, f2=1, and the initial inputs P1, P2, and P3 on the left are selected as the outputs dreg1, dreg2, and dreg3 respectively; in the next 1-62 cycles, f2=0, and the round function inputs dat10_1, dat10_2, and dat10_3 on the right are selected as the initial round outputs dreg1, dreg2, and dreg3 respectively. P1, P2, and P3 are the three shared factor inputs of the threshold implementation circuit, respectively, where P2 and P3 are 64-bit random numbers. P is a 64-bit plaintext. Represents XOR operation; dat10_1, dat10_2, dat10_3 are the inputs of the round function.

[0110] In the 2nd to 63rd cycles, each cycle executes the first layer of the round function, the second layer of the round function, the third layer of the round function, the fourth layer of the round function, the fifth layer of the round function and the input selection layer in sequence.

[0111] The first layer of the round function: contains 3 registers, 1 round key plus addRK and 1 multiplexer 2:1MUX. The outputs of the 3 registers are the 3 outputs of the input selection layer, namely dreg1, dreg2 and dreg3; the control signal of 2:1MUX is the odd-numbered cycle valid signal f1. When executing the 2nd, 4th, 6th, ..., 62nd cycle, f1=1, and the data processed by the round key plus addRK is selected as the output dat1_1; when executing the 3rd, 5th, ..., 63rd cycle, f1=0, and dreg1 is selected directly as the output dat1_1. In the first to the 62nd cycle, dat1_2 is directly equal to dreg2, and dat1_3 is directly equal to dreg3.

[0112] addRK is a round key addition operation, which means that the round key rk[i], i∈[1,2,…,32] is XOR-ed with the output dreg1 of the first register.

[0113] The second layer of round function: contains 3 T layers, 3 P -1 Layer, 3 A's -1 Layer, specific input such as Figure 1 shown.

[0114] The T layer represents two 64-bit inputs, which are divided into 16 4-bit inputs, and then operated 16 times according to the T function to obtain 16 4-bit outputs, which are combined into a 64-bit output. T is a truth table for 8-bit input and 4-bit output. The details are shown below.

[0115] As shown in Table 2, the input of the T function is 4 bits a and 4 bits b, a total of 8 bits of input, and the values ​​in the table are 4-bit outputs for different values ​​of a and b. The numbers in the table are all expressed in 16-bit progression.

[0116] Table 2 Truth table of T function

[0117]

[0118]

[0119] P -1 Layer means that the 64-bit input is divided into 16 4-bit inputs in turn, and then divided into 16 4-bit inputs in accordance with P -1 Function to operate.

[0120] P -1 The calculation of the function is shown in Table 3, which means that the 1-bit data corresponding to the input position x is moved to the output P -1 (x) at the corresponding position.

[0121] Table 3 P -1 The result of the function

[0122] x 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 <![CDATA[P -1 (x)]]> 0 4 8 12 16 20 24 28 32 36 40 44 48 52 56 60 x 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 <![CDATA[P -1 (x)]]> 1 5 9 13 17 21 25 29 33 37 41 45 49 53 57 61 x 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 <![CDATA[P -1 (x)]]> 2 6 10 14 18 22 26 30 34 38 42 46 50 54 58 62 x 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 <![CDATA[P -1 (x)]]> 3 7 11 15 19 23 27 31 35 39 43 47 51 55 59 63

[0123] A'' -1 Layer means that the 64-bit input is divided into 16 4-bit inputs in sequence, and then A"' -1 =CAF98EBD06354271 function is used for operation, and the specific table is shown below.

[0124] Table 4 A”' -1 Truth table of a function

[0125] x 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 <![CDATA[A”' -1 (x)]]> C A F 9 8 E B D 0 6 3 5 4 2 7 1

[0126] The third layer of the round function: contains 3 A"' layers, 3 P layers and 3 2:1 MUXs. The specific input is as follows Figure 1 shown.

[0127] The A'' layer means that the 64-bit input is divided into 16 4-bit inputs in sequence, and then the operation is performed according to the function A''=8FDACB9E43160752. The specific table is shown below.

[0128] Table 5A Truth table of the "' function

[0129] x 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 A”'(x) 8 F D A C B 9 E 4 3 1 6 0 7 5 2

[0130] The P layer means that the 64-bit input is divided into 16 4-bit inputs in sequence, and then operated according to the P function.

[0131] The calculation of the P function is shown in Table 6, which means that the 1-bit data corresponding to the input position x is moved to the position corresponding to the output P(x).

[0132] Table 6 Truth table of P function

[0133] x 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 P(x) 0 16 32 48 1 17 33 49 2 18 34 50 3 19 35 51 x 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 P(x) 4 20 36 52 5 21 37 53 6 22 38 54 7 23 39 55 x 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 P(x) 8 24 40 56 9 25 41 57 10 26 42 58 11 27 43 59 x 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 P(x) 12 28 44 60 13 29 45 61 14 30 46 62 15 31 47 63

[0134] The control signal of the three 2:1MUXs is the odd-numbered cycle valid signal f1. When the 2nd, 4th, 6th, ..., 62nd cycle is executed, f1=1, and dat5_1, dat5_2, dat5_3 are selected as outputs dat7_1, dat7_2, dat7_3; when the 3rd, 5th, ..., 63rd cycle is executed, f1=0, and dat6_1, dat6_2, dat6_3 are selected as outputs dat7_1, dat7_2, dat7_3.

[0135] The fourth round function layer: contains 3 2:1MUX, 3 T -1 Layer, specific input and output are as follows Figure 1 shown.

[0136] The control signal of the three 2:1MUXs is the odd-numbered cycle valid signal f1. When the 2nd, 4th, 6th, ..., 62nd cycle is executed, f1=1, and dat3_1, dat3_2, dat3_3 are selected as outputs dat9_1, dat9_2, dat9_3; when the 3rd, 5th, ..., 63rd cycle is executed, f1=0, and dat4_1, dat4_2, dat4_3 are selected as outputs dat9_1, dat9_2, dat9_3.

[0137] T -1 The layer represents two 64-bit inputs, which are divided into 16 4-bit inputs, and then divided into 16 4-bit inputs according to T -1 The (a,b) function is operated 16 times, resulting in 16 4-bit outputs, which are combined into a 64-bit output. -1 (a,b) is a function that takes two 4-bit inputs and outputs 4 bits. The specific table lookup implementation is shown below.

[0138] As shown in Table 6, T -1 The input of the function is 4 bits a and 4 bits b, a total of 8 bits of input, and the values ​​in the table are 4-bit outputs for different values ​​of a and b. The numbers in the table are all expressed in 16-bit progression.

[0139] Table 7: T -1 Truth table of a function

[0140]

[0141] The fifth layer of the round function: contains three 2:1 MUXs, with specific input and output as follows Figure 1 shown.

[0142] The control signal of the three 2:1MUXs is the encrypted valid signal f. When encrypting, f=1, and dat9_1, dat9_2, dat9_3 are selected as outputs dat10_1, dat10_2, dat10_3; when decrypting, f=0, and dat8_1, dat8_2, dat8_3 are selected as outputs dat10_1, dat10_2, dat10_3.

[0143] In the 64th cycle, the input selection layer and the first layer of the round function are executed, and dat1_1, dat1_2 and dat1_3 of the first layer of the round function are used as outputs dout1, dout2 and dout3.

[0144] The key generation part is similar to the traditional key generation, except that each round key is kept for two cycles, specifically, rk[1] is used in the 2nd and 3rd cycles, rk[2] is used in the 4th and 5th cycles, ..., rk

[30] is used in the 60th and 61st cycles, rk

[31] is used in the 62nd and 63rd cycles, and rk

[32] is used in the last 64th cycle.

[0145] Experimental results:

[0146] Xilinx ISE Design Suite 14.4 software was used for synthesis and implementation. For fairness, the design goal and strategy were balanced, the optimization goal was speed, the optimization effort was normal, and the hierarchy did not need to be kept. The performance of PRESENT hardware implementation was evaluated on four FPGA devices: Xilinx Kintex7 XC7K160T (using 28nm process), Virtex5 XC5VLX50 (using 65nm process), Xilinx Spartan6 (using 45nm process) and Xilinx Spartan3E XC3S50 (using 90nm process).

[0147] Tables 8 to 11 give the comprehensive results of PRESENT encryption threshold implementation and encryption / decryption threshold implementation on four devices: Kintex7, Virtex5, Spartan6 and Spartan3E. The results include the corresponding key generation.

[0148] Table 8 Comprehensive results of PRESENT implementation on Kintex7

[0149]

[0150] Table 9 Comprehensive results of five PRESENT implementations on Virtex5

[0151]

[0152] Table 10 Comprehensive results of five PRESENT implementations on Spartan6

[0153]

[0154] Table 11 Comprehensive results of five PRESENT implementations on Spartan3

[0155]

[0156] Table 12 gives the ratio of the PRESENT encryption and decryption threshold implementation to the encryption threshold implementation. For the table-lookup threshold implementation, the area of ​​the PRESENT encryption and decryption implementation increases by 0.84 to 1.10 times relative to the PRESENT encryption implementation, and the throughput decreases by 7% to 16%, and the throughput per unit area decreases by 53% to 60%.

[0157] Table 12 Ratio of PRESENT encryption and decryption threshold implementation to encryption threshold implementation

[0158]

[0159]

[0160] The TVLA (Test Vector Leakage Assessment) threshold is set to 4.5. As shown in Table 13, at 100,000 energy traces, 1 million energy traces, and 3 million energy traces, the maximum TVLA value of PRESENT-TI is less than 4.5, passing the first-order TVLA test and the second-order / third-order / fourth-order zero-offset TVLA test. The PRESENT-TI solution can resist first-order side channel attacks and high-order zero-offset side channel attacks. The reason for resisting side channel attacks is that the threshold implementation scheme meets the three properties of correctness, uniformity, and incompleteness, which can ensure that the hardware implementation resists glitch leakage attacks.

[0161] Table 13 TVLA test maximum value achieved by PRESENT threshold

[0162]

[0163] Based on the S-box decomposition of the encryption part, the present invention provides the S-box inverse decomposition of the decryption part, and proposes a table lookup type threshold implementation method for PRESENT encryption and decryption. The present invention provides a table lookup type encryption and decryption threshold implementation method, which is suitable for application scenarios where two-way operations of encryption and decryption are required at the same time. The method can be applied to implement PRESENT in various hardware platforms such as FPGA and ASIC.

[0164] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A table lookup threshold implementation method for PRESENT encryption and decryption, characterized in that: including an input selection layer, a first round function layer, a second round function layer, a third round function layer, a fourth round function layer and a fifth round function layer; The input selection layer: implements input selection of three shared factors in parallel; The first layer of the round function: realizes the function of round key addition; The second layer of the round function: the encryption layer T and the decryption layer P are implemented in parallel -1 Layer and decrypted A'' -1 layer; The third layer of the round function: implements the encrypted A'' layer, the encrypted P layer and the decrypted 2:1 MUX layer in parallel; The fourth layer of the round function: the encrypted 2:1 MUX layer and the decrypted T -1 layer; The fifth layer of the round function: realizes the output selection of three shared factors; First, based on the S-box secondary decomposition of the encrypted part, the secondary decomposition derivation of the S-box inversion is performed; Then derive the nonlinear function F of the decryption part -1 The threshold is achieved.

2. The method for implementing a table lookup threshold for PRESENT encryption and decryption according to claim 1, characterized in that: First, based on the S-box secondary decomposition of the encrypted part, the specific content of the secondary decomposition derivation of the S-box inversion is: The known S-box secondary decomposition based on the encrypted part; Based on the S-box decomposition function of PRESENT, the decomposed S-box is expressed as: Among them, A”, A’, A are all 4-bit affine transformations, as follows: A=01AB892345EFCD67,A′=0B835ED61A924FC7,A”=C98D6327AFEB0541 Then the S-box is represented as: Among them, A''=8FDACB9E43160752, Q 12 The expression is: Where a, b, c, d are 4-bit input data, each letter represents 1 bit of data; e, f, g, h are 4-bit output data, each letter represents 1 bit of data; The secondary decomposition derivation of S-box inversion is as follows: because By Q 12 F is derived, and the corresponding transformation expression of F is C905AF8D63EB4127; The decomposition result of S-box inversion is derived from formula (1), which is: Among them, S -1 Indicates S-box inversion; F -1 Indicates the inversion of the F function; A -1 Indicates the inverse of the affine transformation A; A" -1 represents the inverse of the affine transformation A”; By Q 12 Derived Q 12 Inverse function Q 12 -1 , specifically: According to formulas (3) and (4), F -1 The corresponding transformation is 2DE9C38F614B07A5.

3. The method for implementing a table lookup threshold for PRESENT encryption and decryption according to claim 2, characterized in that: Derivation of the nonlinear function F of the decryption part -1 The specific contents of the threshold implementation are: The threshold implementation of the nonlinear function F in the encrypted part is expressed as T(x i ,x j )=A”((Q 12 ) i,j (A(x i ),A(x j ))); T(x i ,x j ) has an input of x i 、x j , x i 、x j Represent the 4-bit input of the i-th and j-th shared factors respectively; first, after affine transformation A, we get A(x i ),A(x j ), and as (Q 12 ) i,j The two inputs are (Q 12 ) i,j After the affine transformation A", a corresponding 4-bit shared output T is obtained; Derived the nonlinear function F of the decryption part -1 The threshold value of T -1 , the formula is T -1 (x i ,x j )=A -1 (Q 12 -1 (A” -1 (x i ),A” -1 (x j ))), specifically: According to formula (4) and formula (5), Q is given 12 -1 The corresponding threshold is realized: Among them, x i , x j Represent the 4-bit input of the i-th and j-th shared factors respectively; first undergo an affine transformation A" -1 , get an A" -1 (x i ),A” -1 (x j ), and as (Q 12 -1 ) i,j The two inputs are (Q 12 -1 ) i,j Operation, and then affine transformation A -1 , and obtain a 4-bit shared output T -1 .

4. The method for implementing a table lookup threshold for PRESENT encryption and decryption according to claim 1, characterized in that: In the first cycle, the input selection layer operation is performed; the input selection layer includes three 2:1MUX layers, and the control signal of the 2:1MUX layer is the initial round valid signal f2. In the initial state, f2=1, and the initial inputs P1, P2 and P3 are selected as outputs dreg1, dreg2 and dreg3 respectively; in the next 1-62 cycles, f2=0, and the round function inputs dat10_1, dat10_2, dat10_3 are selected as outputs dreg1, dreg2 and dreg3 respectively.

5. The method for implementing a table lookup threshold for PRESENT encryption and decryption according to claim 1, characterized in that: The first layer of the round function contains 3 registers, 1 round key plus addRK and 1 2:1 MUX layer; the outputs of the 3 registers are the 3 outputs of the input selection layer; addRK is the round key addition operation, which means that the round key rk[i], i∈[1,2,…,32] is XORed with the output dreg1 of the first register; The control signal of the 2:1MUX layer is the valid signal f1 of the odd cycle. When executed in the even cycle, f1=1, and the data processed by the round key plus addRK is selected as the output dat1_1; when executed in the odd cycle, f1=0, and dreg1 is selected directly as the output dat1_1; from the 1st to the 62nd cycle, dat1_2 is directly equal to dreg2, and dat1_3 is directly equal to dreg3.

6. The method for implementing a table lookup threshold for PRESENT encryption and decryption according to claim 2, characterized in that: The second layer of the round function contains 3 T layers, 3 P -1 Layers and 3 A's -1 layer; The T layer represents two 64-bit inputs, which are divided into 16 4-bit inputs and then operated according to the T function; P -1 Layer means that the 64-bit input is divided into 16 4-bit inputs in turn, and then divided into 16 4-bit inputs in accordance with P -1 Function to operate; A'' -1 Layer means that the 64-bit input is divided into 16 4-bit inputs in sequence, and then A"' -1 =CAF98EBD06354271 function to perform the operation.

7. The method for implementing a table lookup threshold for PRESENT encryption and decryption according to claim 6, characterized in that: The third layer of the round function contains 3 A”’ layers, 3 P layers and 3 2:1 MUX layers; The A'' layer means that the 64-bit input is divided into 16 4-bit inputs in sequence, and then operated according to the A''=8FDACB9E43160752 function; The P layer means that the 64-bit input is divided into 16 4-bit inputs in sequence, and then operated according to the P function; The control signal of the 2:1MUX layer is the odd-numbered cycle valid signal f1. When executed in the even cycle, f1=1, and dat5_1, dat5_2, dat5_3 are selected as outputs dat7_1, dat7_2, dat7_3; when executed in the odd cycle, f1=0, and dat6_1, dat6_2, dat6_3 are selected as outputs dat7_1, dat7_2, dat7_3.

8. The method for implementing a table lookup threshold for PRESENT encryption and decryption according to claim 7, characterized in that: The fourth layer of the round function contains three 2:1 MUX layers, three T -1 layer; The control signal of the 2:1MUX layer is the odd-numbered cycle valid signal f1. When executed in the even-numbered cycle, f1=1, and dat3_1, dat3_2, dat3_3 are selected as outputs dat9_1, dat9_2, dat9_3; when executed in the odd-numbered cycle, f1=0, and dat4_1, dat4_2, dat4_3 are selected as outputs dat9_1, dat9_2, dat9_3; T -1 The layer represents two 64-bit inputs, which are divided into 16 4-bit inputs, and then divided into 16 4-bit inputs according to T -1 (a,b) function to operate.

9. The method for implementing a table lookup threshold for PRESENT encryption and decryption according to claim 8, characterized in that: The fifth layer of the round function contains three 2:1 MUX layers; The control signal of the three 2:1 MUX layers is the encrypted valid signal f. When encrypting, f=1, and dat9_1, dat9_2, dat9_3 are selected as outputs dat10_1, dat10_2, dat10_3; when decrypting, f=0, and dat8_1, dat8_2, dat8_3 are selected as outputs dat10_1, dat10_2, dat10_3.

Images