Key expansion structure, key expansion method and hardware encryption module

Abstract

The embodiment of the invention provides a key expansion structure, a key expansion method and a hardware encryption module, and the key expansion structure comprises a control signal generation unit which is used for generating a control signal based on an immediate operand in an obtained key expansion instruction, and the control signal comprises a first control signal used for determining a round constant; the constant lookup table is used for storing round constants, and the round constants are used when the secret key expansion instruction is executed to generate a round secret key; the constant selection output unit is used for receiving the first control signal generated by the control signal generation unit and selectively outputting round constants corresponding to each round of key expansion process in the constant lookup table according to the indication of the first control signal; and the round key generation unit is used for receiving the round constant selected and output by the constant selection output unit so as to generate a round key at least based on the round constant. According to the technical scheme provided by the embodiment of the invention, the data encryption and decryption performance of the SM4 algorithm can be improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and specifically to a key expansion structure, a key expansion method, and a hardware encryption module. Background Art

[0002] The SM4 (State Migration) algorithm is a block cipher. It consists of two main components: a key expansion algorithm and an encryption algorithm. Key expansion instructions implement the key expansion algorithm. The key expansion structure executes the key expansion instructions to generate all round keys from the initial key.

[0003] Before generating the initial key and round keys, the key expansion structure needs to use a large number of load instructions to load the round constants (CK0-CK31 and FK0-3) used when executing the key expansion instructions from the memory into the processor. However, the load instruction is affected by internal processor resource conflicts, cache hit rate, and the inherent latency of the load instruction, resulting in a decrease in the performance of the SM4 algorithm for encrypting and decrypting data. Therefore, how to provide a technical solution to improve the performance of the SM4 algorithm for encrypting and decrypting data has become a technical problem that those skilled in the art urgently need to solve. Summary of the Invention

[0004] In view of this, an embodiment of the present invention provides a key expansion structure, a key expansion method, and a hardware encryption module to improve the performance of SM4 algorithm in encrypting and decrypting data.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions.

[0006] In a first aspect, an embodiment of the present invention provides a key extension structure, including:

[0007] a control signal generating unit, configured to generate a control signal based on an immediate value in the acquired key extension instruction, wherein the control signal includes a first control signal for determining a round constant;

[0008] a constant lookup table, used to store round constants, wherein the round constants are used when executing the key extension instruction to generate a round key;

[0009] a constant selection and output unit, configured to receive the first control signal generated by the control signal generation unit, and select and output the round constant corresponding to each round of the key expansion process from the constant lookup table according to an instruction of the first control signal;

[0010] The round key generating unit is configured to receive the round constant selected and output by the constant selecting and outputting unit, and to generate a round key based at least on the round constant.

[0011] In a second aspect, an embodiment of the present invention provides a key expansion method, including:

[0012] Obtaining a key extension instruction and generating a control signal based on an immediate value in the key extension instruction, the control signal including a first control signal for determining a round constant;

[0013] According to the instruction of the first control signal, a corresponding wheel constant is selected and output from pre-stored wheel constants; the wheel constant is pre-stored in a constant lookup table;

[0014] A round key is generated based on at least the round constant.

[0015] In a third aspect, an embodiment of the present invention provides a hardware encryption module, comprising the key expansion structure as described in the first aspect.

[0016] An embodiment of the present invention provides a key expansion structure, comprising: a control signal generating unit, configured to generate a control signal based on an immediate value in an acquired key expansion instruction, the control signal including a first control signal for determining a round constant; a constant lookup table, configured to store round constants, the round constants being used when executing the key expansion instruction to generate a round key; a constant selection and output unit, configured to receive the first control signal generated by the control signal generating unit and, based on an instruction of the first control signal, select and output the round constant corresponding to each round of the key expansion process from the constant lookup table; and a round key generating unit, configured to receive the round constant selected and output by the constant selection and output unit, to generate a round key based at least on the round constant.

[0017] It can be seen that the technical solution provided by the embodiment of the present invention improves the key extension structure in the process of using the key extension structure to execute the key extension instruction to generate the round key, and adds a constant lookup table for storing the round constant (CK). Since in the SM4 algorithm, the round constant used when the key extension instruction generates the round key is a defined known value, and when the key extension instruction is executed in each round, it is necessary to load the round constant used in the round from the memory using a load instruction based on the key extension instruction. The large number of round constants results in a large proportion of time spent loading the round constants, which affects the efficiency of the data encryption and decryption process and the performance of the SM4 algorithm. Based on this, the embodiment of the present invention pre-solidifies and stores the round constants (i.e., stores them in the constant lookup table set in the key extension structure), thereby avoiding the operation of loading the round constant from the memory when the key extension instruction is executed in each round, speeding up the process of the key extension instruction expanding the round key, and thus improving the efficiency of the data encryption and decryption process and the performance of the SM4 algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0019] Figure 1a 1 is a schematic structural diagram of a key expansion structure provided by an embodiment of the present invention;

[0020] Figure 1b yes Figure 1a The structural diagram of the XOR selection output module shown;

[0021] Figure 2 This is a schematic diagram of the contents of the immediate value imm8' in the original key extension instruction;

[0022] Figure 3 It is a diagram of the data format of the original key expansion structure;

[0023] Figure 4 1 is a schematic diagram of the data format of the key extension instruction provided by an embodiment of the present invention;

[0024] Figure 5 1 is a schematic diagram illustrating the function of an immediate value in a key extension instruction provided by an embodiment of the present invention;

[0025] Figure 6 This is the correspondence between different values within the preset bit range and the theoretical constant provided by the embodiment of the present invention;

[0026] Figure 7 is another structural diagram of the key expansion structure provided by an embodiment of the present invention;

[0027] Figure 8 1 is another structural diagram of the key expansion structure provided by an embodiment of the present invention;

[0028] Figure 9 This is another structural diagram of a key expansion structure provided by an embodiment of the present invention;

[0029] Figure 10 1 is a flow chart of a key expansion method provided by an embodiment of the present invention;

[0030] Figure 11 1 is another flowchart of the key expansion method provided by an embodiment of the present invention;

[0031] Figure 12 It is a structural diagram of a hardware encryption module provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0032] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0033] As described in the background, when the SM4 algorithm performs data encryption and decryption, it needs to use load instructions multiple times to load round constants from the memory, which affects the performance of the SM4 algorithm in performing data encryption and decryption.

[0034] For example, the SM4 algorithm requires 32 rounds of operations to encrypt or decrypt a 128-bit data block, corresponding to the generation of 32 round keys. Each round of round key generation requires a round constant, CK, and four fixed constants, FK, are loaded when generating the initial secret key. An additional instruction is required to perform an exclusive-or operation on the fixed constants FK. This results in a total of 36 constants. Typically, a load instruction can load four constants at a time, so a total of nine load instructions are required to load all the constants used by the SM4 algorithm into the processor. Ignoring internal resource conflicts and cache misses, and assuming that a load instruction takes an average of three clock cycles, nine load instructions would require 27 clock cycles. Encrypting or decrypting a data block typically requires 128 clock cycles under ideal conditions. Therefore, load instructions account for over 21% of the time spent loading constants, severely impacting the performance of the SM4 algorithm in encrypting, decrypting, or handling data encryption and decryption.

[0035] Based on this, an embodiment of the present invention provides a key expansion structure to improve the efficiency of the data encryption and decryption process and the performance of the SM4 algorithm.

[0036] Please refer to Figure 1a , Figure 1a It is a structural diagram of a key expansion structure provided by an embodiment of the present invention.

[0037] like Figure 1a As shown, the key expansion structure 1 includes:

[0038] A control signal generating unit 11 is configured to generate a control signal based on an immediate value in the acquired key extension instruction, wherein the control signal includes a first control signal for determining a round constant;

[0039] a constant lookup table 12, for storing round constants, the round constants being used when executing the key extension instruction to generate round keys;

[0040] a constant selection and output unit 13, configured to receive the first control signal generated by the control signal generation unit 11, and select and output the round constant corresponding to each round of the key expansion process from the constant lookup table 12 according to an instruction of the first control signal;

[0041] The round key generating unit 14 is configured to receive the round constant selected and output by the constant selecting and outputting unit 13, and generate a round key based at least on the round constant.

[0042] The constant lookup table 12 stores the aforementioned 32 round constants: CK0 to CK3, thereby achieving the effect of pre-storing the round constants used in each round inside the key extension structure 1, avoiding the execution of a load instruction when executing the key extension instruction in each round to load the round constants from the memory, thereby saving the time spent on executing the load instruction and improving the performance of the SM4 algorithm in data encryption and decryption.

[0043] Since the 32 round constants are pre-stored in the constant lookup table 12, to facilitate the normal acquisition and use of the corresponding round constants during the round key generation process in each round, the embodiment of the present invention uses a constant selection and output unit 13 to receive a first control signal generated based on an immediate number, and then select and output the corresponding round constant from the constant lookup table 12 under the instruction of the first control signal.

[0044] The constant selection output unit 13 can be implemented by a multiplexer (MUX). A MUX is a combinational logic circuit with multiple inputs and a single output, which can select one signal from multiple input signals as an output.

[0045] In order to use the first control signal to select from the constant lookup table 12 storing 32 round constants, the embodiment of the present invention adjusts the bits and function synchronization of the immediate value imm8 used to generate the first control signal.

[0046] In the SM4 algorithm, since a single load instruction loads four constants, each round of key expansion requires the use of the immediate value imm8' in the original key expansion instruction to select the corresponding round constant during execution of the original key expansion instruction. Furthermore, since a single load instruction loads four constants, the control signal generated based on the immediate value imm8' in the original key expansion instruction selects the round constant for that round from among the four round constants. In other words, the immediate value imm8' in the original key expansion instruction has two bits, which can generate a control signal to select the four round constants.

[0047] The immediate value imm8' of the original key extension instruction can be referred to Figure 2 , Figure 2This is a schematic diagram of the contents of the immediate value imm8' in the original key extension instruction.

[0048] like Figure 2 As shown, the immediate value imm8' of the original key extension instruction is 2 bits. When its value is "00", the control signal generated instructs to use CK0 for the initial round of key extension process; when its value is "01", the control signal generated instructs to use CK1 for the second round of key extension process; when its value is "10", the control signal generated instructs to use CK2 for the third round of key extension process; when its value is "11", the control signal generated instructs to use CK3 for the fourth round of key extension process. And so on, until 32 rounds of round key extension are completed.

[0049] Furthermore, because the 32 round constants are pre-stored in the constant lookup table within the key expansion structure 1 in this embodiment of the present invention, it is not necessary to load the round constants based on the execution of a key expansion instruction during each round of key expansion using the key expansion structure 1 provided by this embodiment of the present invention. Therefore, based on the key expansion structure 1 provided by this embodiment of the present invention, the key expansion instruction also has a different data format from the original key expansion instruction, i.e., the key expansion instruction in this embodiment of the present invention no longer contains a portion for loading round constants.

[0050] Please refer to Figure 3 and Figure 4 , Figure 3 This is a diagram of the data format of the original key expansion structure. Figure 4 This is a schematic diagram of the data format of the key extension instruction provided by an embodiment of the present invention.

[0051] The source operands SRC1, SRC2 and destination operand DEST included in the original key extension instruction have a bit width of 128, including 4 DWORD (single word) elements, so the mnemonic of the original key extension instruction can be represented as: SM4RKDEST, SRC1, SRC2, imm8', and its data format is as follows: Figure 3 shown.

[0052] Among them, the source operand SRC1 is used to provide the part of the SM4 algorithm for inputting the initial secret key or the intermediate key (input generation secret key) updated after the key expansion process of each round is completed. Taking the key expansion process of the initial round as an example, SRC1 provides the initial key: K3~K0; the source operand SRC2 is used to provide the part of the CK round constant in the SM4 algorithm. Taking the key expansion process of the initial round as an example, SRC1 provides CK3~CK0, and then selects the round constant used in the round based on the immediate number imm8': CK0; the destination operand DEST is used to output the generated round secret key of each round. Taking the key expansion process of the initial round as an example, the destination operand outputs K4 from K4~K1 updated after the key expansion process of the initial round is completed. Each time the original key expansion instruction is run, a round constant needs to be selected from the four CK round constants loaded based on the load instruction. For example, using Figure 2 The immediate value imm8' shown selects the CK round constant required for each round for operation, thereby generating the round key of the round.

[0053] In the embodiment of the present invention, since the operation of loading the round constant is no longer performed, the key expansion instruction no longer includes the SRC2 part for providing the round constant. Figure 4 As shown, the key extension instruction provided by the embodiment of the present invention includes a source operand SRC and a destination operand DEST. The mnemonic of the corresponding key extension instruction can be expressed as: SM4RKIDEST, SRC, imm8. It can be seen that the key extension instruction provided by the embodiment of the present invention does not include the source operand SRC2, so that when the key extension instruction is executed in each round, the operation of loading the round constant is no longer executed, saving the time of executing the load instruction to load the round constant.

[0054] It can be seen that the technical solution provided by the embodiment of the present invention improves the key extension structure in the process of using the key extension structure to execute the key extension instruction to generate the round key, and adds a constant lookup table for storing the round constant (CK). Since in the SM4 algorithm, the round constant used when the key extension instruction generates the round key is a defined known value, and when the key extension instruction is executed in each round, it is necessary to load the round constant used by the round from the memory using a load instruction based on the key extension instruction. The large number of round constants results in a large proportion of time spent loading the round constants, affecting the efficiency of the data encryption and decryption process and the performance of the SM4 algorithm. Based on this, the embodiment of the present invention pre-solidifies and stores the round constants (i.e., stores them in the constant lookup table set in the key extension structure), thereby avoiding the operation of loading the round constant from the memory when the key extension instruction is executed in each round, speeding up the process of the key extension instruction expanding the round key, and thus improving the efficiency of the data encryption and decryption process and the performance of the SM4 algorithm.

[0055] Based on the above content, it can be seen that when the load instruction loads constants, in addition to loading the round constant CK, it is also necessary to load the fixed constants FK3~FK0 once. Therefore, in order to further improve the performance of SM4 in data encryption and decryption, the embodiment of the present invention also pre-solidifies and stores the fixed constants in the key expansion structure 1. At the same time, based on the operation of the key expansion structure 1 on the fixed constants, the control signal generated by the control signal generation unit 11 is expanded so that the control signal also includes a second control signal for determining the initial key or the intermediate key; the first control signal is generated based on the value within the preset bit range of the immediate number, and the second control signal is generated based on the value corresponding to the preset bit position in the immediate number.

[0056] For an exemplary key expansion structure containing pre-stored fixed constants, please continue to refer to Figure 1a ,like Figure 1a As shown, the key expansion structure 1 may further include:

[0057] Fixed constant table 15, used to store fixed constants for generating initial keys;

[0058] an XOR selection output module 16 for performing XOR processing on the fixed constants in the fixed constant table 15 and the source operand in the key expansion instruction; and based on the instruction of the received second control signal, selectively outputting the intermediate key updated after each round of the key expansion process, or the initial key generated after the XOR processing; the initial key is used in the initial round of the key expansion process; the source operand is used to provide the input initial key or the intermediate key updated after each round of the key expansion process;

[0059] The round key generation unit 14 is further configured to receive the intermediate key or initial key selected and output by the XOR selection output module 16 to generate a round key based on the round constant and the intermediate key, or to generate a round key based on the round constant and the initial key.

[0060] In the SM4 algorithm's round key generation process, the fixed constant FK and the round constant CK are applied at different stages. The following describes the round key generation formulas used in each round of the SM4 algorithm's key expansion process.

[0061] Round key generation formula:

[0062]

[0063] In the above formula, i represents the number of rounds of key expansion process, i = 0, 1, 2, ... 31; K i+4 represents the round key generated in each round, T() is a transformation function, including nonlinear transformation processing and linear transformation processing; when i=0, K i ~K i+3is the initial key. When i is not 0, K i ~K i+3 is the intermediate key, CK i Indicates the round constant used in each round of key expansion.

[0064] In the initial round (i=0), K0-K3 are initial keys, which are generated by XORing fixed constants FK3-FK0 and input initial keys (K'3-K'0). The input initial keys are keys provided by the user.

[0065] Based on the above round key generation formula, the fixed constant FK (also known as the system parameter) has a total of four 32-bit words, namely FK0 = (A3B1BAC6), FK1 = (56AA3350), FK2 = (677D9197), and FK3 = (B27022DC). During the initial round key expansion process, the initial key is XORed with the input initial key to generate the initial key: This step helps combine the input initial key with the system parameters, providing a transformed basis for subsequent round key generation.

[0066] The round constant CK is a parameter used in the key expansion process, which consists of 32 32-bit words. i Perform XOR operation with the intermediate value (initial key or intermediate key) to participate in generating the next round key. i The introduction of increases the differences between round keys, making the round keys of each round have unique properties, thereby enhancing the security of the algorithm.

[0067] It can be seen that the 32-round key expansion process is equivalent to 32 expansions based on the initial key, thereby generating 32 round keys. The fixed constant FK is only used in the initial round key expansion process to generate the initial key, while the round constant is used in each of the 32 round key expansion processes. Therefore, the embodiment of the present invention further includes a fixed constant table 15 in the key expansion structure 1 for storing fixed constants. Therefore, during the initial round key expansion process, there is no need to load the fixed constant FK from the memory. The fixed constants in the fixed constant table 15 can be directly used to generate the initial key.

[0068] At the same time, based on the above analysis, it can be seen that in the key expansion process of non-initial rounds (i=1, 2, ..., 31), it is not necessary to use the XOR processing result (initial key). Instead, the intermediate key updated after each round of key expansion is used for the next round of key expansion. Combined with the above representation of the intermediate key, it can be seen that as i increases, the intermediate key used in each round of key expansion will also be updated. Each updated intermediate key is updated to the source operand and used in the next round of key expansion.

[0069] To accurately provide the initial key or intermediate key for each round of key expansion, an embodiment of the present invention simultaneously adds an XOR selection output module 16 to the key expansion structure 1, allowing the XOR selection output module 16 to selectively output the initial key or intermediate key based on a second control signal. Since the selection of the initial key or intermediate key corresponds to two situations: the initial round of key expansion and the non-initial round of key expansion, the immediate value used to generate the second control signal can contain two different values, allowing the XOR selection output module 16 to select and output the corresponding result.

[0070] When the second control signal is generated based on an immediate number indicating the key expansion process of the initial round, the XOR selection output module 16 is controlled to select outputting the initial key; when the second control signal is generated based on an immediate number indicating the key expansion process of a non-initial round, the XOR selection output module 16 is controlled to select outputting the intermediate key.

[0071] To implement the XOR selection output module 16 function, please refer to Figure 1b In one implementation, the XOR selection output module 16 may include: an XOR unit 161 and an XOR selection output unit 162 .

[0072] The XOR unit 161 is configured to receive the fixed constants in the fixed constant table 15 and the input initial key, and perform an XOR operation on the fixed constants and the input initial key to generate an initial key;

[0073] The XOR selection output unit 162 is configured to receive the initial key and the intermediate key generated by the XOR unit 161, and select and output the intermediate key or the initial key based on an instruction of the second control signal.

[0074] The XOR unit 161 can be implemented using hardware structures such as an XOR gate, a NAND gate, or a dedicated XOR gate integrated circuit.

[0075] On the basis of the above, in order to accurately select and output the information required for each round of key expansion process based on the control signal generated by the immediate number, in one embodiment, the bit position of the immediate number can be 8 bits, thereby satisfying the selection and output of the round constant, initial key, and intermediate key.

[0076] Specifically, within the preset bit range of the immediate number, different numerical values correspond to different rounds of key expansion processes, so that the first control signal controls the constant selection and output unit to select and output a round constant that matches each round of the key expansion process; the numerical values corresponding to the preset bits of the immediate number include a first value and a second value, the first value indicates that the current key expansion process is an initial round; the second value indicates that the current key expansion process is a non-initial round, so that when the second control signal is the first value, the XOR selection and output unit is controlled to select and output the initial key; when the second control signal is the second value, the XOR selection and output unit is controlled to select and output the intermediate key.

[0077] The functions of different bits of the immediate value imm8 in the key extension instruction provided by the embodiment of the present invention can be referred to Figure 5 , Figure 5 This is a schematic diagram illustrating the function of an immediate value in a key extension instruction provided by an embodiment of the present invention.

[0078] like Figure 5 As shown, the immediate value imm8 in the key extension instruction provided by the embodiment of the present invention has a total of 8 bits, wherein the preset bit range [4:0] is used to provide different numerical values for generating the first control signal, so that the constant selection output unit 13 can select and output the corresponding round constant in the constant lookup table 12 based on the indication of the first control signal.

[0079] The value corresponding to the preset bit 5 is used to generate the second control signal, so that the XOR selection output module 16 can select to output the initial key (K0~K3 when i=0) or the intermediate key (K0~K3 when i=1,...,31) based on the instruction of the second control signal. i ~K i+3 ).

[0080] Please refer to Figure 6 , Figure 6 This is the correspondence between different numerical values within the preset bit range and theoretical constants provided by the embodiment of the present invention.

[0081] like Figure 6 As shown, the preset bit range [4:0] includes 32 different 8-bit values represented in hexadecimal, each of which corresponds to a round constant used in a round of key expansion. Therefore, when generating the first control signal based on a specific value, a unique corresponding round constant can be selected and output in the constant lookup table 12.

[0082] In order to reduce the delay of the key expansion process, in one embodiment, the key expansion structure may further include a first pipeline register.

[0083] Pipeline registers are a set of registers used at various stages in the processor pipeline to store intermediate data and status information. These registers ensure that data is correctly passed and processed throughout the processor's various execution stages. By inserting pipeline registers into the key-extended combinatorial logic path, a long combinatorial logic path can be split into multiple shorter segments, reducing the latency of each segment. This allows for higher clock frequencies, thereby improving overall system performance.

[0084] Please refer to Figure 7 , Figure 7 This is another structural diagram of the key expansion structure provided by an embodiment of the present invention.

[0085] like Figure 7 As shown, the key expansion structure 1 includes a first pipeline register 10A, and the first pipeline register 10A includes an immediate register 101 (imm reg) and a first source operand register 102.

[0086] The immediate value register 101 is used to store the immediate value in the decoded key extension instruction to provide it to the control signal generating unit 11 to generate a control signal;

[0087] The first source operand register 102 is used to store the source operand to provide the intermediate key or the input initial key in the source operand to the XOR selection output module 16.

[0088] exist Figure 7 In the key expansion structure shown, the immediate register 101 stores the specific value of the 8-bit immediate number after decoding, so that it can be based on Figure 5 and Figure 6 The content shown in FIG. 1 makes the control signal generating unit 11 generate a first control signal according to the specific value corresponding to the preset bit range of [4:0] stored in the immediate register 101, so as to provide the first control signal to the constant selection output unit 13. Figure 6 On the other hand, the control signal generating unit 11 can generate a second control signal according to the specific value corresponding to the 5th bit stored in the immediate register 101, and provide it to the XOR selection output module 16, so that the XOR selection output unit 162 can generate a second control signal according to the specific value corresponding to the 5th bit stored in the immediate register 101, so as to provide the second control signal to the XOR selection output module 16. Figure 5 The content shown selects to output: the intermediate key or the initial key obtained after the XOR processing by the XOR unit 161.

[0089] The decoded 8-bit immediate number can be processed by the immediate number expansion module to obtain a specific 8-bit value, and then the control signal generation unit 11 generates a control signal to select the corresponding round constant CK.

[0090] Since the processor's operating frequency determines the length of each clock cycle, the higher the frequency, the shorter the clock cycle, and the corresponding hardware structure needs to complete operations in a shorter time.

[0091] At high operating frequencies, certain operations in the hardware structure may become performance bottlenecks. By adjusting the hardware structure and placing time-consuming operations at the front of the pipeline, the overall delay can be reduced. Therefore, in another key expansion structure provided by an embodiment of the present invention, the arrangement positions of the control signal generation unit 11, the constant lookup table 12, the constant selection output unit 13, the fixed constant table 15, and the XOR selection output module 16 can be adjusted. Please refer to Figure 8 , Figure 8 This is another structural diagram of the key expansion structure provided by an embodiment of the present invention.

[0092] like Figure 8 As shown, when the arrangement positions of the control signal generating unit 11, the constant lookup table 12, the constant selection output unit 13, the fixed constant table 15, and the XOR selection output module 16 are adjusted, the key expansion structure further includes a second pipeline register 10B, and the second pipeline register 10B includes: a round constant register 103 and a second source operand register 104;

[0093] The round constant register (CK) 103 is used to receive and store the round constant selected and output by the constant selection and output unit 13, and provide the round constant to the round key generation unit 14;

[0094] The second source operand register 104 is configured to receive and store the intermediate key or the initial key selected and output by the XOR selection output module 16 , and provide the intermediate key or the initial key to the round key generation unit 14 .

[0095] The operations performed by the control signal generating unit 11, the constant lookup table 12, the constant selection output unit 13, the fixed constant table 15, and the XOR selection output module 16 take a long time, so their layout positions can be adjusted to meet a higher operating main frequency.

[0096] The immediate values used by the control signal generation unit 11 to generate control signals can be provided by an encoder (decoder). The encoder's function is to convert the logic of the key expansion algorithm into signals that the hardware can understand. The output of the encoder can include immediate values, which are used to generate control signals and guide the operation of the hardware logic.

[0097] and Figure 7 compared to, Figure 8 As shown in the second source operand register 104, what is received is the processed result output from the XOR selection output module 16, to avoid the following Figure 7 As shown, the XOR processing and selection output steps that take a long time are performed in the first pipeline register 10A.

[0098] At the same time, since the constant selection and output unit 13 is arranged before the second pipeline register 10B, the selection and output of the round constant can be processed earlier, meeting the requirement of high working main frequency.

[0099] Figure 7 and Figure 8 The structures shown are all based on the initial round of key expansion process. For example, the first source operand register 102 and the second source operand register 104 both display source operand contents K0 to K3 corresponding to the initial round of key expansion process.

[0100] Please refer to Figure 7 or Figure 8 The structure shown in FIG. 1 , the round key generation unit 14 may include:

[0101] a nonlinear processing module 141 configured to process the round constant selected and output by the constant selection and output unit 13 and the intermediate key or initial key selected and output by the XOR selection and output module 16, the intermediate key or initial key having a number other than the current round number, to generate a nonlinear processing result;

[0102] A linear processing module 142 is configured to perform linear processing on the nonlinear processing result to obtain a linear processing result;

[0103] The round key generation module 143 of the current round is used to process the linear processing result to generate the round key of the current round.

[0104] The round key generation unit 14 is a hardware structure corresponding to the calculation part of generating the round key based on the T function and the XOR with the T function in the aforementioned round key generation formula.

[0105] Since the transformation function T includes the following steps:

[0106] Nonlinear transformation (Tau):

[0107] Split the input 32-bit data B into four 8-bit bytes and replace them respectively through S boxes.

[0108] The S-box is a fixed permutation table with 8-bit input and 8-bit output.

[0109] Linear transformation (L'):

[0110] The formula for the linear transformation L' is:

[0111]

[0112] Among them, B<<<13 means that the 32-bit input data B (non-linear processing result) is cyclically shifted left by 13 bits, and B<<<23 means that the 32-bit input data B is cyclically shifted left by 23 bits.

[0113] The result of T function and K i Perform an XOR operation to obtain the round key of the current round.

[0114] Therefore, the round key generation unit 14 formed based on the above principle may include:

[0115] A nonlinear processing module 141 that performs nonlinear operations, a linear processing module 142 that performs linear operations, and a round key generation module 143 for the current round.

[0116] Please continue to refer to Figure 7 or Figure 8 The round key generation unit 14 may further include:

[0117] The third pipeline register 144 includes an XOR selection output result register 1441, which is used to store the intermediate key or initial key selected and output by the XOR selection output module 16, so as to provide the intermediate key or initial key numbered corresponding to the current round number to the linear processing module 142.

[0118] Among them, Figure 7 In the structure shown, the intermediate key or initial key received by the XOR selection output result register 1441 is directly provided by the XOR selection output module 16; Figure 8 In the structure shown, the intermediate key or the initial key received by the XOR selection output result register 1441 is indirectly provided by the second source operand register 104.

[0119] Please continue to refer to Figure 7 or Figure 8 In one embodiment, the linear processing module 142 may include:

[0120] A first operation module (B<<<13) 1421 is used to perform a left rotation on the nonlinear processing result of the nonlinear processing module 141 to obtain a first operation result;

[0121] A second bit operation module (B<<<23) 1422 is used to perform a left rotation on the nonlinear processing result of the nonlinear processing module 141 to obtain a second bit operation result;

[0122] A first linear XOR module 1423 is configured to perform an XOR operation on the first bit operation result and the second bit operation result to generate a first linear processing result;

[0123] A second linear XOR module 1424 is configured to perform an XOR process on the nonlinear processing result and the intermediate key or initial key selected and output by the XOR selection output module 16, the intermediate key or initial key numbered corresponding to the current round number, to generate a second linear processing result; the first linear processing result and the second linear processing result form a linear processing result;

[0124] The nonlinear processing module 141 includes:

[0125] A round constant XOR module 1411 is configured to perform XOR processing on the round constant and the intermediate key or initial key whose number does not correspond to the current round number, to generate a round constant XOR result, and the round constant XOR result is used to generate the nonlinear processing result;

[0126] The round key generation module 143 of the current round is used to process the linear processing result to generate the round key of the current round, including:

[0127] An exclusive OR operation is performed on the first linear processing result and the second linear processing result to generate a round key for the current round.

[0128] The intermediate key or initial key corresponding to a number other than the current round number is the intermediate key or initial key corresponding to i=i+1, i+2, or i+3. For example, in the key expansion process of the initial round (i=0), the XOR selection output unit 162 selects to output the initial keys K0, K1, K2, and K3, and the initial keys corresponding to the number other than the current round number are K1, K2, and K3. Based on the nonlinear processing formula in the aforementioned T function, K1, K2, and K3 are used to perform an XOR operation with CK0, and then the result of the XOR operation (round constant XOR result) is subjected to a nonlinear transformation to obtain a nonlinear processing result.

[0129] In order to perform nonlinear transformation on the round constant XOR result, please continue to refer to Figure 7 or Figure 8 In one embodiment, the nonlinear processing module 141 further includes:

[0130] a replacement box 1412 for performing a nonlinear transformation on the round constant XOR result to generate a nonlinear processing result;

[0131] The third pipeline register 144 further includes:

[0132] The first non-linear processing result register 1441 is used to store the non-linear processing result.

[0133] The replacement box 1412 may be the aforementioned S-box that performs nonlinear transformation.

[0134] Based on the calculation process of the round key generation formula, the key expansion process is divided into stages. The third pipeline register 144 can divide the linear processing and nonlinear processing processes, and store the nonlinear processing results after the nonlinear processing is completed, which is convenient for use in the linear processing process.

[0135] The S-box is a key component in the SM4 algorithm for implementing nonlinear transformations. Therefore, to achieve short latency and compact circuits, it is necessary to design and optimize these S-boxes. To optimize hardware implementation, reduce hardware complexity, and increase computational speed, one implementation involves splitting the S-box.

[0136] Please refer to Figure 9 , Figure 9 This is another structural diagram of the key expansion structure provided by an embodiment of the present invention.

[0137] like Figure 9 As shown, the key expansion structure includes two S-boxes: a first replacement box 1413 and a second replacement box 1414; the first replacement box 1413 is used to perform a partial nonlinear transformation on the round constant XOR result to generate an intermediate nonlinear processing result; the second replacement box 1414 is used to perform a nonlinear transformation on each of the intermediate nonlinear processing results to generate a nonlinear processing result;

[0138] The third pipeline register 144 further includes:

[0139] The second non-linear processing result register 1443 is used to store the intermediate non-linear processing result to provide it to the second replacement box 1414 .

[0140] An embodiment of the present invention further provides a key expansion method, which is implemented based on the key expansion structure provided in the above embodiment.

[0141] Please refer to Figure 10 , Figure 10 The figure is a flow chart of a key expansion method provided by an embodiment of the present invention.

[0142] like Figure 10 As shown, the method includes the following steps:

[0143] Step S100: Obtain a key extension instruction, and generate a control signal based on an immediate value in the key extension instruction, wherein the control signal includes a first control signal for determining a round constant.

[0144] The data format of the key extension instruction is as follows Figure 4 Each time a key expansion instruction is executed, a round of round key expansion generation is performed.

[0145] Step S101: According to the instruction of the first control signal, a corresponding wheel constant is selected and output from pre-stored wheel constants; the wheel constant is pre-stored in a constant lookup table.

[0146] The wheel constant is CK i (i=0,...31).

[0147] Step S102: Generate a round key based at least on the round constant.

[0148] It can be seen that the technical solution provided by the embodiment of the present invention pre-stores the round constants in a constant lookup table set in the key extension structure, thereby avoiding the operation of loading the round constants from the memory when executing the key extension instruction in each round, speeding up the process of expanding the round key by the key extension instruction, and thus improving the efficiency of the data encryption and decryption process and the performance of the SM4 algorithm.

[0149] Please refer to Figure 11 , Figure 11 This is another flowchart of the key expansion method provided by an embodiment of the present invention.

[0150] like Figure 11 As shown, the method includes the following steps:

[0151] Step S200: Acquire a key extension instruction, and generate a control signal based on an immediate value in the key extension instruction; the control signal includes a first control signal and a second control signal.

[0152] The first control signal is used to determine the round constant; the second control signal is used to determine the initial key or the intermediate key.

[0153] The first control signal is generated based on a value within a preset bit range in the immediate number, and the second control signal is generated based on a value corresponding to a preset bit position in the immediate number.

[0154] Step S201: Perform an XOR process using a pre-stored fixed constant and a source operand in a key extension instruction; and select and output an intermediate key or an initial key according to the instruction of a second control signal.

[0155] The intermediate key is a key updated after each round of key expansion process; the initial key is a key generated after XOR processing.

[0156] Step S202: According to the instruction of the first control signal, a corresponding wheel constant is selected and output from pre-stored wheel constants; the wheel constant is pre-stored in a constant lookup table.

[0157] Step S203: Generate a round key based on the round constant and the intermediate key, or generate a round key based on the round constant and the initial key.

[0158] The initial key is used in the initial round of key expansion process; the source operand is used to provide the input initial key or the intermediate key updated after each round of key expansion process; the fixed constant is pre-stored in the fixed constant table.

[0159] The second control signal can select to output the initial key or the intermediate key according to the specific value of the preset bit. The first control signal can select the round constant according to the specific value within the preset bit range, so as to meet the use of each round of key expansion process.

[0160] Optionally, performing XOR processing using a pre-stored fixed constant and a source operand in the key extension instruction includes:

[0161] An XOR operation is performed on the fixed constant and the input initial key to generate an initial key.

[0162] The initial key is the key used in the initial round (i=0). In each round of key expansion process except the initial round, the intermediate key updated after the previous round of key expansion process is used.

[0163] Optionally, different numerical values within the preset bit range correspond to different rounds of key expansion processes, so that the first control signal controls the constant selection output unit to select and output a round constant that matches each round of the key expansion process; the numerical values corresponding to the preset bit positions include a first value and a second value, the first value indicates that the current key expansion process is an initial round; the second value indicates that the current key expansion process is non-initial, so that when the second control signal is the first value, the XOR selection output unit is controlled to select and output the initial key; when the second control signal is the second value, the XOR selection output unit is controlled to select and output the intermediate key.

[0164] An embodiment of the present invention also provides a hardware encryption module to implement the SM4 algorithm.

[0165] Please refer to Figure 12 , Figure 12 It is a structural diagram of a hardware encryption module provided by an embodiment of the present invention.

[0166] like Figure 12 As shown, the hardware encryption module includes the key expansion structure 1 as described in any of the above embodiments.

[0167] It can be seen that the hardware encryption module provided by the embodiment of the present invention includes a key extension structure 1. Since a constant lookup table 12 for storing round constants (CK) is added to the key extension structure 1, the round constants can be pre-stored (i.e., stored in the constant lookup table 12 provided in the key extension structure). This avoids the need to load the round constants from the memory during each round of key extension instruction execution, speeding up the process of extending the round key by the key extension instruction, thereby improving the efficiency of the data encryption and decryption process and the performance of the SM4 algorithm.

[0168] The above describes multiple embodiment schemes provided by the embodiments of the present invention. The various optional methods introduced in each embodiment scheme can be combined and cross-referenced with each other without conflict, thereby extending a variety of possible embodiment schemes, which can all be considered as embodiment schemes disclosed and open in the embodiments of the present invention.

[0169] Although the embodiments of the present invention are disclosed above, the present invention is not limited thereto. Any person skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention should be based on the scope defined by the claims.

Claims

1. A key expansion structure, characterized in that: include: a control signal generating unit, configured to generate a control signal based on an immediate value in the acquired key extension instruction, wherein the control signal includes a first control signal for determining a round constant; a constant lookup table, used to store round constants, wherein the round constants are used when executing the key extension instruction to generate a round key; a constant selection and output unit, configured to receive the first control signal generated by the control signal generation unit, and select and output the round constant corresponding to each round of the key expansion process from the constant lookup table according to an instruction of the first control signal; The round key generating unit is configured to receive the round constant selected and output by the constant selecting and outputting unit, and to generate a round key based at least on the round constant.

2. The key expansion structure according to claim 1, wherein: The control signal further includes a second control signal for determining an initial key or an intermediate key; the first control signal is generated based on a value within a preset bit range in the immediate value, and the second control signal is generated based on a value corresponding to a preset bit position in the immediate value; the key expansion structure further includes: A fixed constant table, used to store fixed constants for generating initial keys; an XOR selection output module, configured to perform XOR processing on the fixed constants in the fixed constant table and the source operand in the key expansion instruction; and based on the instruction of the received second control signal, selectively output an intermediate key updated after each round of the key expansion process, or an initial key generated after the XOR processing; the initial key is applied to the initial round of the key expansion process; the source operand is used to provide an input initial key or an intermediate key updated after each round of the key expansion process; The round key generation unit is further configured to receive the intermediate key or the initial key selected and output by the XOR selection output module, and generate a round key based on the round constant and the intermediate key, or generate a round key based on the round constant and the initial key.

3. The key expansion structure according to claim 2, wherein: The XOR selection output module includes: an XOR unit and an XOR selection output unit; The XOR unit is configured to receive the fixed constants in the fixed constant table and the input initial key, and perform an XOR operation on the fixed constants and the input initial key to generate an initial key; The XOR selection output unit is configured to receive the initial key and the intermediate key generated by the XOR unit, and select and output the intermediate key or the initial key based on an instruction of the second control signal.

4. The key expansion structure according to claim 3, wherein: Within the preset bit range of the immediate number, different numerical values correspond to different rounds of key expansion processes, so that the first control signal controls the constant selection and output unit to select and output a round constant that matches each round of the key expansion process; the numerical values corresponding to the preset bits of the immediate number include a first value and a second value, the first value indicating that the current key expansion process is an initial round; the second value indicating that the current key expansion process is a non-initial round, so that when the second control signal is the first value, the XOR selection and output unit is controlled to select and output the initial key; when the second control signal is the second value, the XOR selection and output unit is controlled to select and output the intermediate key.

5. The key expansion structure according to claim 4, wherein: Also includes: A first pipeline register, the first pipeline register comprising: a first source operand register and an immediate operand register; The immediate value register is used to store the immediate value in the decoded key extension instruction to provide it to the control signal generating unit to generate a control signal; The first source operand register is used to store the source operand, so as to provide the intermediate key or the input initial key in the source operand to the XOR selection output module.

6. The key expansion structure according to claim 4, wherein: Also includes: A second pipeline register, the second pipeline register comprising: a round constant register and a second source operand register; The round constant register is configured to receive and store the round constant selected and output by the constant selection and output unit, and provide the round constant to the round key generation unit; The second source operand register is used to receive and store the intermediate key or the initial key selected and output by the XOR selection output module, so as to provide the intermediate key or the initial key to the round key generation unit.

7. The key expansion structure according to any one of claims 2 to 6, wherein: The round key generation unit includes: a nonlinear processing module, configured to process the round constant selected and output by the constant selection and output unit and the intermediate key or initial key selected and output by the XOR selection and output module, the intermediate key or initial key having a number other than the current round number, to generate a nonlinear processing result; A linear processing module, configured to perform linear processing on the nonlinear processing result to obtain a linear processing result; The round key generation module of the current round is used to process the linear processing result to generate the round key of the current round.

8. The key expansion structure according to claim 7, wherein: The round key generation unit further includes: The third pipeline register includes an XOR selection output result register, which is used to store the intermediate key or initial key selected by the XOR selection output module to provide the intermediate key or initial key numbered corresponding to the current round number to the linear processing module.

9. The key expansion structure according to claim 8, wherein: The linear processing module includes: a first operation module, configured to perform a left rotation on the nonlinear processing result of the nonlinear processing module to obtain a first operation result; A second bit operation module is used to perform a left rotation process on the nonlinear processing result of the nonlinear processing module to obtain a second bit operation result; A first linear XOR module is used to perform an XOR operation on the first bit operation result and the second bit operation result to generate a first linear processing result; a second linear XOR module, configured to perform XOR processing on the nonlinear processing result and the intermediate key or initial key selected and output by the XOR selection output module, the intermediate key or initial key numbered corresponding to the current round number, to generate a second linear processing result; the first linear processing result and the second linear processing result form a linear processing result; The nonlinear processing module includes: a round constant XOR module, configured to perform XOR processing on the round constant and, among the intermediate keys or initial keys, the intermediate keys or initial keys whose numbers do not correspond to the current round number, to generate a round constant XOR result, wherein the round constant XOR result is used to generate the nonlinear processing result; The round key generation module of the current round is used to process the linear processing result to generate the round key of the current round, including: An exclusive OR operation is performed on the first linear processing result and the second linear processing result to generate a round key for the current round.

10. The key expansion structure according to claim 9, wherein: The nonlinear processing module further includes: a replacement box, used for performing a nonlinear transformation on the round constant XOR result to generate a nonlinear processing result; The third pipeline register further includes: The first nonlinear processing result register is used to store the nonlinear processing result.

11. The key expansion structure according to claim 9, wherein: The nonlinear processing module further includes: A first replacement box is used to perform a partial nonlinear transformation on the round constant XOR result to generate an intermediate nonlinear processing result; a second replacement box, configured to perform nonlinear transformation on each of the intermediate nonlinear processing results to generate a nonlinear processing result; The third pipeline register further includes: The second non-linear processing result register is used to store the intermediate non-linear processing result to provide it to the second replacement box.

12. A key expansion method, characterized in that: include: Obtaining a key extension instruction and generating a control signal based on an immediate value in the key extension instruction, the control signal including a first control signal for determining a round constant; According to the instruction of the first control signal, a corresponding wheel constant is selected and output from pre-stored wheel constants; the wheel constant is pre-stored in a constant lookup table; A round key is generated based on at least the round constant.

13. The key expansion method according to claim 12, wherein: The control signal further includes a second control signal for determining an initial key or an intermediate key; the first control signal is generated based on a value within a preset bit range in the immediate number, and the second control signal is generated based on a value corresponding to a preset bit position in the immediate number; the method further includes: Performing an exclusive-OR operation using a pre-stored fixed constant and a source operand in the key expansion instruction, and selecting, according to an instruction of the second control signal, to output an intermediate key generated in each round of the key expansion process or an initial key generated after the exclusive-OR operation; Generating a round key based at least on the round constant comprises: generating a round key based on the round constant and the intermediate key, or generating a round key based on the round constant and the initial key; The initial key is used in the initial round of key expansion process; the source operand is used to provide the input initial key or the intermediate key updated after each round of key expansion process; the fixed constant is pre-stored in the fixed constant table.

14. The key expansion method according to claim 13, wherein: The XOR processing using a pre-stored fixed constant and a source operand in the key extension instruction includes: An XOR operation is performed on the fixed constant and the input initial key to generate an initial key.

15. The key expansion method according to claim 14, wherein: Different numerical values within the preset bit range correspond to different rounds of key expansion processes, so that the first control signal controls the constant selection output unit to select and output a round constant that matches each round of the key expansion process; the numerical values corresponding to the preset bit positions include a first value and a second value, the first value indicating that the current key expansion process is an initial round; the second value indicating that the current key expansion process is non-initial, so that when the second control signal is the first value, the XOR selection output unit is controlled to select and output the initial key; when the second control signal is the second value, the XOR selection output unit is controlled to select and output the intermediate key.

16. A hardware encryption module, characterized in that: include: The key extension structure according to any one of claims 1 to 11.

Images