A design method for a highly adjustable block cipher operating mode

Abstract

This invention relates to a design method for a highly adjustable block cipher operating mode, belonging to the field of information security. This invention uses a handle and internal variables encrypted from the handle to adjust the input, output, and key of the block cipher respectively to encrypt data blocks. The adjustable block cipher proposed in this invention relies solely on the block cipher without using a hash function, thus avoiding the loss of handle information. It can be implemented using standard block algorithms with consistent security, facilitating use in various scenarios. This invention significantly increases the handle length it can accommodate, reaching five times the block length, basically meeting the needs for adjustable block cipher handle length in currently known scenarios.

Description

Technical Field

[0001] This invention belongs to the field of information security, specifically relating to a design method for a highly adjustable block cipher working mode. Background Technology

[0002] Tweakable block ciphers (TBCs) are a primary technology for disk encryption, designing lightweight authentication encryption protocols, and implementing resistance to side-channel attacks. In disk encryption, information such as disk name, address, and encryption time are typically used as handles to achieve the effect of using the same key to encrypt different disks differently. In authentication encryption protocols, publicly available information is used as handles, and TBCs are used to encrypt and obtain authentication codes. This approach offers advantages such as no information loss and low computational overhead, making it a mainstream technology in resource-constrained lightweight scenarios. The main method for lightweight block ciphers to resist side-channel attacks is to use masks to segment and protect the target value. Tweakable block ciphers, because their components include handles, have a natural advantage in cryptographic design as carriers of masks. Currently, all lightweight block cipher candidate schemes in the NIST standard are based on Tweakable block ciphers. Designing Tweakable block ciphers can be done in two ways: ① Directly designing or modifying existing block cipher algorithms according to specific scenario needs (block length, number and length of masks, and hardware / software implementation); ② Designing Tweakable block ciphers by treating standard block cipher algorithms as black boxes and mimicking their working modes.

[0003] Adjustable block ciphers designed according to method ① suffer from a lack of provable security, limiting their security analysis to simple scenarios. This makes it difficult to leverage the advantages of standardized block ciphers and restricts their application to specific design scenarios, hindering reuse. For example, in the design of the HOMA working mode, the arbitrary segmentation of the handle in the SKINNY algorithm is replaced with a fixed length segmentation. Modifying the underlying hardware (Linear Feedback Shift Register, LFSR) results in a new adjustable block cipher—SKINNYee. This algorithm suffers from difficulties in proving security and reuse outside of HOMA. The main problem with method ② is the insufficient handle length. Currently, even the largest provably secure adjustable block cipher, G2, only provides a handle length twice the block size. However, specific scenarios require handle lengths far greater than this; for instance, HOMA requires handle lengths up to five times the block size. Summary of the Invention

[0004] (a) Technical problems to be solved

[0005] The technical problem to be solved by the present invention is how to provide a design method for a highly adjustable block cipher working mode, which increases the length of the adjustment handle while ensuring security, and facilitates its use in specific scenarios.

[0006] (II) Technical Solution

[0007] To address the aforementioned technical problems, this invention proposes a design method for a highly adjustable block cipher operating mode, comprising the following steps:

[0008] S1, Initialization

[0009] Key generation: First, a fixed-length binary string needs to be generated as the key K, which is used to obfuscate the data;

[0010] S2, Encryption Process

[0011] The plaintext is grouped into plaintext blocks. A handle T is input into each plaintext block. The handles are divided into five smaller handles of fixed length. The internal variables corresponding to the five smaller handles are calculated. The plaintext blocks are encrypted using the five smaller handles, the internal variables, and the key K to obtain the corresponding ciphertext blocks. All the ciphertext blocks are linked together in order to form the final ciphertext.

[0012] S3, Decryption Process

[0013] Obtain the ciphertext, key K, and handle T corresponding to each plaintext block. Group the ciphertext into blocks of the same length as during encryption to obtain multiple ciphertext blocks. Divide the handles into five smaller handles of fixed length. Calculate the internal variables corresponding to the five smaller handles. Decrypt the ciphertext blocks using the five smaller handles, internal variables, and key K to obtain the corresponding plaintext blocks. Link all the plaintext blocks together in order to form the final plaintext.

[0014] (III) Beneficial Effects

[0015] This invention proposes a highly adjustable block cipher design method. The proposed adjustable block cipher relies solely on the block cipher itself without using a hash function, thus avoiding the loss of handle information. It can be implemented using standard block algorithms with consistent security, facilitating use in various scenarios. Compared to existing provably secure adjustable block ciphers, the proposed M2 significantly increases the handle length, reaching five times the block length, essentially meeting the handle length requirements for adjustable block ciphers in currently known scenarios. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the adjustable block cipher workflow;

[0017] Figure 2 This is a schematic diagram of the structure of M2 of the present invention. Detailed Implementation

[0018] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0019] The purpose of this invention is to propose an adjustable block cipher with a handle length up to five times the block length, which is provably secure. The block cipher is called only as a black box, and the input and output of the block cipher are protected by internal variables obtained by encrypting the handle. This increases the handle length while ensuring security, making it more convenient for use in specific scenarios.

[0020] This invention proposes a design method for a highly adjustable block cipher operating mode, the method comprising:

[0021] M2 is an adjustable block cipher designed as a black box. It shares structural similarities with block ciphers in its operation mode, encrypting data blocks by adjusting the inputs, outputs, and key using a handle and internal variables encrypted from the handle. The specific implementation below is described using a framework similar to that of block ciphers:

[0022] S1, Initialization

[0023] Key generation: First, a fixed-length binary string needs to be generated as the key K, which is used to obfuscate the data.

[0024] S2, Encryption Process

[0025] The plaintext is divided into blocks. A handle T is input into each plaintext block. The handles are divided into five smaller handles of fixed length. The internal variables corresponding to the five smaller handles are calculated. The plaintext blocks are encrypted using the five smaller handles, the internal variables, and the key K to obtain the corresponding ciphertext blocks. All ciphertext blocks are then linked together in sequence to form the final ciphertext. Specifically, this includes:

[0026] S21. Grouping: The plaintext is grouped into multiple plaintext blocks according to a fixed length.

[0027] S22, Input Handle T: For each plaintext block, input a binary string as a handle. The length of this string shall not exceed five times the fixed length. If the handle for each plaintext block is 0, the encryption mode is weakened to ECB block cipher.

[0028] S23. Handle preprocessing: If the length of T is not five times the fixed length, then pad the binary string with 0s until it is five times the fixed length, and then divide it into five small handles t1, t2, t3, t4, t5 according to the fixed length.

[0029] S24. Calculate the internal variables: For t1, t3, t5, use key K to directly encrypt to obtain the corresponding internal variables y1, y3, y5. For t2, t4, first XOR with key K and then encrypt the result with key K to obtain the corresponding internal variables y2, y4.

[0030] S25. Calculate the key and encrypt: The key actually used when encrypting each plaintext block is the generated key K, the small handles t1, t5 and the result z of the XOR operation of the internal variables y2, y3, y4; the plaintext block is XORed with the internal variables y1, y2 to obtain x, and the XOR result x is encrypted; the encrypted result y is XORed with the internal variables y4, y5 to obtain the ciphertext block c corresponding to the plaintext block.

[0031] S26. Output Ciphertext: Link all ciphertext blocks together in sequence to form the final ciphertext.

[0032] S3, Decryption Process

[0033] Obtain the ciphertext, key K, and handle T corresponding to each plaintext block. Group the ciphertext into blocks of the same length as during encryption, resulting in multiple ciphertext blocks. Divide the handles into five smaller handles of fixed length. Calculate the internal variables corresponding to the five smaller handles. Decrypt the ciphertext blocks using the five smaller handles, the internal variables, and key K to obtain the corresponding plaintext blocks. Link all the plaintext blocks together in sequence to form the final plaintext. Specifically,

[0034] S31. Receive information: Obtain the ciphertext, key K, and handle T corresponding to each plaintext block.

[0035] S32. Grouping: Divide the ciphertext into groups of the same length as when it was encrypted, to obtain multiple ciphertext blocks.

[0036] S33. Handle preprocessing: If the length of T is not five times the fixed length, then pad the binary string with 0s to five times the fixed length, and then divide it into five small handles t1, t2, t3, t4, and t5 according to the fixed length.

[0037] S34. Calculate internal variables: For t1, t3, and t5, use key K to directly encrypt to obtain the corresponding internal variables y1, y3, and y5. For t2 and t4, first XOR with key K and then encrypt the result using key K to obtain the corresponding internal variables y2 and y4.

[0038] S35. Calculate the key and decrypt: The key actually used for decrypting each ciphertext block is the generated key K, the small handles t1 and t4, and the result z of the XOR operation of the internal variables y2, y3, and y4; the ciphertext block is then XORed with the internal variables y4 and y5, and the XOR result is decrypted; the decryption result is XORed with the internal variables y1 and y2 to obtain the plaintext block corresponding to the ciphertext block.

[0039] S36. Output Ciphertext: Link all plaintext blocks together in sequence to form the final plaintext.

[0040] Features and precautions of this invention

[0041] 1. Parallelization: The process of calculating internal variables and the encryption and decryption of each plaintext block can be performed in parallel, improving the efficiency of encryption and decryption.

[0042] 2. Security: The security of M2 depends on the choice of encryption algorithm and the confidentiality of the key. The appropriate encryption standard can be selected according to the specific security requirements of the scenario. The handle, on the other hand, does not need to be kept secret, and it can be proven that even if an adversary can control the handle, they cannot use it to attack the key.

[0043] 3. Error propagation: Each plaintext block and ciphertext block does not affect each other during encryption and decryption. Errors generated during transmission will only cause errors in the decryption of the current ciphertext block and will not affect the decryption of other ciphertext blocks.

[0044] 4. Data dependency: The generation of each ciphertext block depends only on the corresponding handle. As long as the handle used is different, even if the same key is used to encrypt the same plaintext, the resulting ciphertext will be different.

[0045] The adjustable block cipher proposed in this invention relies solely on block ciphers without using hash functions, thus avoiding the loss of handle information. It can be implemented using standard block algorithms with consistent security, facilitating use in various scenarios. Compared to existing provably secure adjustable block ciphers, the proposed M2 significantly increases the handle length, reaching five times the block length, essentially meeting the handle length requirements for adjustable block ciphers in currently known scenarios.

[0046] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for designing a highly adjustable block cipher operating mode, characterized in that, The method includes the following steps: S1, Initialization Key generation: First, a fixed-length binary string needs to be generated as the key K, which is used to obfuscate the data; S2, Encryption Process The plaintext is grouped into plaintext blocks. A handle T is input into each plaintext block. The handles are divided into five smaller handles of fixed length. The internal variables corresponding to the five smaller handles are calculated. The plaintext blocks are encrypted using the five smaller handles, the internal variables, and the key K to obtain the corresponding ciphertext blocks. All the ciphertext blocks are linked together in order to form the final ciphertext. S3, Decryption Process Obtain the ciphertext, key K, and handle T corresponding to each plaintext block. Group the ciphertext into blocks of the same length as during encryption to obtain multiple ciphertext blocks. Divide the handles into five smaller handles of fixed length. Calculate the internal variables corresponding to the five smaller handles. Decrypt the ciphertext blocks using the five smaller handles, internal variables, and key K to obtain the corresponding plaintext blocks. Link all the plaintext blocks together in order to form the final plaintext.

2. The design method for a highly adjustable block cipher working mode as described in claim 1, characterized in that, The step of grouping plaintext into plaintext blocks includes: grouping plaintext into blocks of fixed length to obtain multiple plaintext blocks.

3. The method for designing a highly adjustable block cipher working mode as described in claim 2, characterized in that, The step of inputting a handle T for each plaintext block includes: inputting a binary string as a handle for each plaintext block, wherein the length of the string does not exceed five times the fixed length.

4. The design method for a highly adjustable block cipher working mode as described in claim 3, characterized in that, The step of dividing the tuning handle into five smaller tuning handles according to a fixed length includes: if the length of T is not five times the fixed length, then pad the binary string with zeros until it is five times the fixed length, and then divide it into five smaller tuning handles t1, t2, t3, t4, t5 according to the fixed length.

5. The method for designing a highly adjustable block cipher working mode as described in claim 4, characterized in that, The calculation of the internal variables corresponding to the five minor adjustment handles includes: for t1, t3, t5, the corresponding internal variables y1, y3, y5 are obtained by directly encrypting them with key K; for t2, t4, the result is first XORed with key K and then encrypted with key K to obtain the corresponding internal variables y2, y4.

6. The method for designing a highly adjustable block cipher working mode as described in claim 5, characterized in that, The process of encrypting a plaintext block using five minor switches, internal variables, and a key K to obtain a corresponding ciphertext block includes: the actual key used for encrypting each plaintext block is the generated key K, the result of XORing minor switches t1, t5, and internal variables y2, y3, y4 (z); the plaintext block is then XORed with internal variables y1, y2 to obtain x, and the XOR result x is encrypted; the encrypted result y is then XORed with internal variables y4, y5 to obtain the ciphertext block c corresponding to the plaintext block.

7. The method for designing a highly adjustable block cipher working mode as described in claim 6, characterized in that, The process of decrypting the ciphertext block to obtain the corresponding plaintext block using five minor switches, internal variables, and key K includes: the actual key used for decrypting each ciphertext block is the generated key K, the result z of the XOR operation of minor switches t1, t4, and internal variables y2, y3, y5; the ciphertext block is then XORed with internal variables y4, y5, and the XOR result is decrypted; the decryption result is then XORed with internal variables y1, y2 to obtain the plaintext block corresponding to the ciphertext block.

8. The method for designing a highly adjustable block cipher working mode as described in claim 7, characterized in that, The process of calculating the internal variables is carried out in parallel with the encryption process for each plaintext block.

9. The method for designing a highly adjustable block cipher working mode as described in claim 7, characterized in that, The process of calculating internal variables is carried out in parallel with the decryption process of each plaintext block.

10. The method for designing a highly adjustable block cipher working mode as described in claim 7, characterized in that, Choose the appropriate encryption standard based on the specific security requirements of the scenario, while the handle does not need to be kept confidential.

Images