Key expansion structure, key expansion method, hardware encryption module

Abstract

This invention provides a key expansion structure, a key expansion method, and a hardware encryption module. The key expansion structure includes: a control signal generation unit, used to generate control signals based on immediate values ​​in an acquired key expansion instruction, the control signals including a first control signal for determining round constants; a constant lookup table for storing round constants used when generating round keys by executing the key expansion instruction; a constant selection output unit, used to receive the first control signal generated by the control signal generation unit and, according to the indication of the first control signal, select and output the round constant corresponding to each round of key expansion process from the constant lookup table; and a round key generation unit, used to receive the round constants selected and output by the constant selection output unit, to generate round keys based at least on the round constants. The technical solution provided by this invention can improve the performance of the SM4 algorithm in encrypting and decrypting data.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a key expansion structure, a key expansion method, and a hardware encryption module. Background Technology

[0002] SM (State Migration) 4 is a block cipher algorithm. The SM4 algorithm consists of two main parts: a key expansion algorithm and a encryption algorithm. Key expansion instructions are used to implement the key expansion algorithm. The key expansion structure executes the key expansion instructions to generate all round keys from the initial key.

[0003] Before generating the initial key and round keys, the key expansion structure requires extensive use of load instructions to load the round constants (CK0-CK31 and FK0-3) used during the execution of the key expansion instructions from memory into the processor. However, the load instructions are affected by processor resource conflicts, cache hit rates, and inherent latency, leading to a decrease in the data encryption and decryption performance of the SM4 algorithm. Therefore, providing a technical solution to improve the data encryption and decryption performance of the SM4 algorithm has become a pressing technical problem for those skilled in the art. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a key expansion structure, a key expansion method, and a hardware encryption module to improve the performance of the SM4 algorithm in encrypting and decrypting data.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions.

[0006] In a first aspect, embodiments of the present invention provide a key expansion structure, including:

[0007] A control signal generation unit is used to generate control signals based on the immediate values ​​in the acquired key expansion instructions, the control signals including a first control signal for determining the round constant;

[0008] A constant lookup table is used to store round constants, which are used when the key expansion instruction is executed to generate the round key;

[0009] A constant selection output unit is used to receive a first control signal generated by the control signal generation unit, and select and output the round constant corresponding to each round of key expansion process in the constant lookup table according to the indication of the first control signal.

[0010] A round key generation unit is used to receive the round constants selected and output by the constant selection and output unit, so as to generate a round key based at least on the round constants.

[0011] Secondly, embodiments of the present invention provide a key expansion method, including:

[0012] Obtain a key expansion instruction and generate control signals based on the immediate values ​​in the key expansion instruction, the control signals including a first control signal for determining the round constant;

[0013] According to the instruction of the first control signal, the corresponding wheel constant is selected from the pre-stored wheel constants for output; the wheel constants are pre-stored in a constant lookup table;

[0014] The round key is generated based at least on the round constant.

[0015] Thirdly, embodiments of the present invention provide a hardware encryption module, including the key extension structure as described in the first aspect.

[0016] An embodiment of the present invention provides a key expansion structure, comprising: a control signal generation unit, configured to generate a control signal based on an immediate value in an acquired key expansion instruction, the control signal including a first control signal for determining round constants; a constant lookup table, configured to store round constants used when generating round keys by executing the key expansion instruction; a constant selection output unit, configured to receive the first control signal generated by the control signal generation unit and, according to the indication of the first control signal, select and output the round constant corresponding to each round of key expansion process from the constant lookup table; and a round key generation unit, configured to receive the round constants selected and output by the constant selection output unit, and generate round keys based at least on the round constants.

[0017] As can be seen, the technical solution provided by this embodiment of the invention improves the key expansion structure by adding a constant lookup table to store the round constants (CK) during the process of generating round keys using key expansion instructions. In the SM4 algorithm, the round constants used when generating round keys by key expansion instructions are predefined known values, and each time a key expansion instruction is executed, the round constants used in that round need to be loaded from memory using a load instruction based on the key expansion instruction. The large number of round constants results in a significant proportion of time spent loading them, affecting the efficiency of the data encryption / decryption process and the performance of the SM4 algorithm. Therefore, this embodiment of the invention pre-stores the round constants (i.e., stores them in the constant lookup table set in the key expansion structure), thereby avoiding the operation of loading round constants from memory each time a key expansion instruction is executed, accelerating the process of expanding round keys by key expansion instructions, and thus improving the efficiency of the data encryption / decryption process and the performance of the SM4 algorithm. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0019] Figure 1a This is a schematic diagram of the key expansion structure provided in an embodiment of the present invention;

[0020] Figure 1b yes Figure 1a The diagram shown is a structural schematic of the XOR selection output module.

[0021] Figure 2 This is a schematic diagram of the contents of the immediate value imm8' in the original key expansion instruction;

[0022] Figure 3 This is a schematic diagram of the data format of the original key extension structure;

[0023] Figure 4 This is a schematic diagram of the data format of the key expansion instruction provided in an embodiment of the present invention;

[0024] Figure 5 This is a schematic diagram illustrating the function of immediate values ​​in the key expansion instruction provided in this embodiment of the invention;

[0025] Figure 6 This is the correspondence between different values ​​and theoretical constants within a preset bit range provided by the embodiments of the present invention;

[0026] Figure 7 This is another schematic diagram of the key expansion structure provided in the embodiments of the present invention;

[0027] Figure 8 This is another schematic diagram of the key expansion structure provided in the embodiments of the present invention;

[0028] Figure 9 This is another schematic diagram of the key expansion structure provided in the embodiments of the present invention;

[0029] Figure 10 This is a flowchart illustrating the key expansion method provided in an embodiment of the present invention;

[0030] Figure 11 This is another flowchart illustrating the key expansion method provided in this embodiment of the invention;

[0031] Figure 12 This is a schematic diagram of the hardware encryption module provided in an embodiment of the present invention. Detailed Implementation

[0032] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0033] As mentioned in the background, the SM4 algorithm requires multiple load instructions to load round constants from memory during data encryption and decryption, which affects the performance of the SM4 algorithm in data encryption and decryption.

[0034] For example, the SM4 algorithm requires 32 rounds of computation to encrypt or decrypt a 128-bit data block, corresponding to the generation of 32 round keys. Each round key generation requires a round constant CK, and the initial key generation requires loading four fixed constants FK, along with an additional instruction to XOR the fixed constants FK. Therefore, a total of 36 constants are needed. Typically, a single load instruction can load four constants at a time, requiring nine load instructions to load all the constants used by the SM4 algorithm into the processor. Ignoring internal resource conflicts and cache misses, and assuming an average load instruction takes 3 clock cycles, nine load instructions would require 27 clock cycles. Since encrypting or decrypting a data block typically requires 128 clock cycles under ideal conditions, the time spent loading constants accounts for over 21% of the total processing time, severely impacting the performance of the SM4 algorithm in encrypting / decrypting data or handles.

[0035] Based on this, embodiments of the present invention provide a key extension structure to improve the efficiency of data encryption and decryption processes and the performance of the SM4 algorithm.

[0036] Please refer to Figure 1a , Figure 1a This is a schematic diagram of the key extension structure provided in an embodiment of the present invention.

[0037] like Figure 1a As shown, the key expansion structure 1 includes:

[0038] The control signal generation unit 11 is used to generate a control signal based on the immediate value in the acquired key expansion instruction, the control signal including a first control signal for determining the round constant;

[0039] Constant lookup table 12 is used to store round constants, which are used when the key expansion instruction is executed to generate the round key;

[0040] The constant selection output unit 13 is used to receive the first control signal generated by the control signal generation unit 11, and select and output the round constant corresponding to each round of key expansion process in the constant lookup table 12 according to the indication of the first control signal.

[0041] Round key generation unit 14 is used to receive the round constant selected and output by constant selection output unit 13, so as to generate a round key based at least on the round constant.

[0042] The constant lookup table 12 stores the aforementioned 32 round constants: CK0 to CK3, thereby achieving the effect of pre-storing the round constants used in each round into the key expansion structure 1. This avoids the operation of executing a loading instruction to load the round constants from memory when executing the key expansion instruction in each round, thus saving the time spent executing the loading instruction and improving the data encryption and decryption performance of the SM4 algorithm.

[0043] Since 32 round constants are stored in constant lookup table 12 in advance, in order to facilitate the normal acquisition and use of the corresponding round constants in the process of generating round keys in each round, a constant selection output unit 13 is adopted in this embodiment of the invention to receive a first control signal generated based on immediate values, and thereby select and output the corresponding round constant from constant lookup table 12 under the instruction of the first control signal.

[0044] The constant selection output unit 13 can be implemented using a multiplexer (MUX). A MUX is a multi-input, single-output combinational logic circuit that can select one signal from multiple input signals as the output.

[0045] In order to enable the selection in the constant lookup table 12 storing 32 round constants using the first control signal, the bits of the immediate value imm8 used to generate the first control signal and the function synchronization are adjusted in this embodiment of the invention.

[0046] In the SM4 algorithm, since a single load instruction loads four constants, each round of key expansion during the execution of the original key expansion instruction also requires the selection of the corresponding round constant using the immediate value `imm8'` from the original key expansion instruction. Furthermore, because a single load instruction loads four constants, the control signal generated based on the immediate value `imm8'` in the original key expansion instruction is to select the round constant to be used in that round from these four round constants. In other words, the immediate value `imm8'` in the original key expansion instruction has two bits, which can generate the control signal to select the four round constants.

[0047] The immediate value imm8' of the original key expansion instruction can be found in [reference]. Figure 2 , Figure 2This is a schematic diagram of the contents of the immediate value imm8' in the original key expansion instruction.

[0048] like Figure 2 As shown, the immediate value imm8' of the original key expansion instruction is 2 bits. When its value is "00", the generated control signal indicates that CK0 is used for the initial round of key expansion; when its value is "01", the generated control signal indicates that CK1 is used for the second round of key expansion; when its value is "10", the generated control signal indicates that CK2 is used for the third round of key expansion; when its value is "11", the generated control signal indicates that CK3 is used for the fourth round of key expansion. And so on, until 32 rounds of key expansion are completed.

[0049] Meanwhile, since the 32 round constants are pre-stored in a constant lookup table within the key extension structure 1 in this embodiment of the invention, it means that during each round key extension process using the key extension structure 1 provided in this embodiment of the invention, it is not necessary to load the round constants based on the execution of key extension instructions. Therefore, based on the key extension structure 1 provided in this embodiment of the invention, the data format of the key extension instructions is also different from that of the original key extension instructions; that is, the key extension instructions in this embodiment of the invention no longer include the part for loading round constants.

[0050] Please refer to Figure 3 and Figure 4 , Figure 3 This is a schematic diagram of the data format of the original key extension structure. Figure 4 This is a schematic diagram of the data format of the key expansion instruction provided in an embodiment of the present invention.

[0051] The source operands SRC1 and SRC2, and the destination operand DEST in the original key expansion instruction are all 128 bits wide, comprising four DWORD (single word) elements. Therefore, the mnemonic for the original key expansion instruction can be represented as: SM4RKDEST,SRC1,SRC2,imm8', with the data format as follows: Figure 3 As shown.

[0052] In this algorithm, the source operand SRC1 provides the initial key or the intermediate key (input generated key) updated after each round of key expansion in the SM4 algorithm. For example, in the initial round of key expansion, SRC1 provides the initial keys: K3 to K0. The source operand SRC2 provides the CK round constants in the SM4 algorithm. Again, in the initial round of key expansion, SRC1 provides CK3 to CK0, and then selects the round constant CK0 based on the immediate value imm8'. The destination operand DEST outputs the generated round key for each round. For example, in the initial round of key expansion, the destination operand outputs K4 from K4 to K1, updated after the initial round of key expansion. Each time the original key expansion instruction is executed, a round constant needs to be selected from the four CK round constants loaded based on the loading instruction. For example, using... Figure 2 The immediate number imm8' shown selects the CK round constant required for each round for calculation, thereby generating the round key for that round.

[0053] In this embodiment of the invention, since the operation of loading the round constant is no longer performed, the key expansion instruction no longer includes the SRC2 part used to provide the round constant. For example... Figure 4 As shown, the key expansion instruction provided in this embodiment of the invention includes a source operand SRC and a destination operand DEST. The mnemonic for the corresponding key expansion instruction can be represented as: SM4RKIDEST, SRC, imm8. It can be seen that the key expansion instruction provided in this embodiment of the invention does not include the source operand SRC2. Therefore, when executing the key expansion instruction in each round, the operation of loading the round constant is no longer performed, saving the time spent loading the round constant by executing the loading instruction.

[0054] As can be seen, the technical solution provided by this invention improves the key expansion structure by adding a constant lookup table to store round constants (CK) during the process of generating round keys using key expansion instructions. In the SM4 algorithm, the round constants used when generating round keys by key expansion instructions are predefined known values, and each time a key expansion instruction is executed, the round constants used in that round need to be loaded from memory using a load instruction based on the key expansion instruction. The large number of round constants results in a significant portion of the time spent loading round constants, affecting the efficiency of the data encryption / decryption process and the performance of the SM4 algorithm. Therefore, this invention pre-stores the round constants (i.e., stores them in the constant lookup table set in the key expansion structure), thereby avoiding the operation of loading round constants from memory each time a key expansion instruction is executed, accelerating the process of expanding round keys by key expansion instructions, and thus improving the efficiency of the data encryption / decryption process and the performance of the SM4 algorithm.

[0055] As described above, when loading constants in the loading instruction, in addition to loading the round constant CK, it is also necessary to load fixed constants FK3 to FK0 once. Therefore, to further improve the data encryption and decryption performance of SM4, this embodiment of the invention also pre-stores the fixed constants in the key extension structure 1. Simultaneously, based on the operation of the fixed constants in the key extension structure 1, the control signal generated by the control signal generation unit 11 is extended, so that the control signal also includes a second control signal for determining the initial key or intermediate key; the first control signal is generated based on a value within a preset bit range in the immediate number, and the second control signal is generated based on the value corresponding to the preset bit position in the immediate number.

[0056] For an example, please refer to the key expansion structure that includes pre-stored fixed constants. Figure 1a ,like Figure 1a As shown, the key expansion structure 1 may further include:

[0057] Table 15, a set of fixed constants, is used to store the fixed constants for generating the initial key.

[0058] The XOR selection output module 16 is used to perform XOR processing on the fixed constants in the fixed constant table 15 and the source operands in the key expansion instructions; and based on the indication of the received second control signal, selects to output either the intermediate key updated after each round of key expansion process, or the initial key generated after the XOR processing; the initial key is applied to the key expansion process of the initial round; the source operands are used to provide the input initial key or the intermediate key updated after each round of key expansion process;

[0059] The round key generation unit 14 is further configured to receive the intermediate key or initial key selected and output by the XOR selection output module 16, so as to generate a round key based on the round constant and the intermediate key, or generate a round key based on the round constant and the initial key.

[0060] In the round key generation process of the SM4 algorithm, the fixed constant FK and the round constant CK are applied at different stages. The following explanation focuses on the round key generation formula upon which each round of key expansion in the SM4 algorithm depends.

[0061] Round key generation formula:

[0062]

[0063] In the above formula, i represents the number of rounds in the key expansion process, i = 0, 1, 2, ... 31; K i+4 This represents the round key generated in each round, where T() is a transformation function, including nonlinear and linear transformations; when i = 0, K i ~K i+3As the initial key, K is used when i is not 0. i ~K i+3 CK is the intermediate key. i This represents the round constant used in each round of key expansion.

[0064] In the initial round (i=0), K0 to K3 are the initial keys, generated by XORing the fixed constants FK3 to FK0 with the input initial keys (K'3 to K'0). The input initial keys are keys provided by the user.

[0065] Based on the above round key generation formula, with a fixed constant FK (also called the system parameter), there are four 32-bit words: FK0 = (A3B1BAC6), FK1 = (56AA3350), FK2 = (677D9197), and FK3 = (B27022DC). During the initial round key expansion, an XOR operation is performed with the input initial key to generate the initial key: This step helps to combine the initial input key with system parameters, providing a transformed basis for the generation of subsequent round keys.

[0066] The round constant CK is a parameter used in the key expansion process, consisting of 32 32-bit words. In each round of key expansion, CK... i XORing the key with an intermediate value (initial key or intermediate key) generates the round key for the next round. CK i The introduction of this feature increases the diversity between round keys, giving each round key unique properties and thus enhancing the security of the algorithm.

[0067] As can be seen, the 32-round key expansion process is equivalent to 32 expansions based on the initial key, thereby generating 32 round keys. The fixed constant FK only applies to the initial round key expansion process and is used to generate the initial key, while the round constants apply to each of the 32 rounds of key expansion. Therefore, in this embodiment of the invention, a fixed constant table 15 is added to the key expansion structure 1 to store the fixed constants. Thus, during the initial round key expansion process, it is not necessary to load the fixed constant FK from memory; the fixed constants in the fixed constant table 15 can be used directly to generate the initial key.

[0068] Furthermore, based on the above analysis, it can be seen that in the key expansion process outside the initial round (i = 1, 2, ..., 31), the XOR processing result (initial key) is not needed. Instead, the intermediate key updated after each round of key expansion is used for the next round of key expansion. Combining the above representation of the intermediate key, it can be seen that as i increases, the intermediate key used in each round of key expansion is also updated. Each updated intermediate key is added to the source operand and used in the next round of key expansion.

[0069] To accurately provide the initial key or intermediate key in each round of key expansion, this embodiment of the invention synchronously adds an XOR selection output module 16 to the key expansion structure 1. This allows the XOR selection output module 16 to select and output either the initial key or the intermediate key based on the second control signal. Since the selection of the initial key or intermediate key corresponds to two cases: the key expansion process in the initial round and the key expansion process in non-initial rounds, the immediate value used to generate the second control signal can contain two different values ​​to allow the XOR selection output module 16 to select and output the corresponding result.

[0070] When the second control signal is generated based on an immediate value indicating the key expansion process of the initial round, the XOR selection output module 16 is controlled to select the output of the initial key. When the second control signal is generated based on an immediate value indicating the key expansion process of a non-initial round, the XOR selection output module 16 is controlled to select the output of the intermediate key.

[0071] To implement the function of the XOR selection output module 16, please refer to... Figure 1b In one embodiment, the XOR selection output module 16 may include an XOR unit 161 and an XOR selection output unit 162.

[0072] The XOR unit 161 is used to receive the fixed constants in the fixed constant table 15 and the input initial key, and perform an XOR operation on the fixed constants and the input initial key to generate an initial key;

[0073] The XOR selection output unit 162 is used to receive the initial key generated by the XOR unit 161 and the intermediate key, and select to output the intermediate key or the initial key based on the indication of the second control signal.

[0074] The XOR unit 161 can be implemented using hardware structures such as XOR gate, NAND gate, or dedicated XOR gate integrated circuit.

[0075] Based on the above, in order to accurately select the information required for each round of key expansion process based on the control signal generated by the immediate number, in one embodiment, the immediate number can be 8 bits, thereby satisfying the selection output of round constant, initial key, and intermediate key.

[0076] Specifically, within the preset bit range of the immediate number, different values ​​correspond to different rounds of key expansion processes, such that the first control signal controls the constant selection output unit to select and output a round constant that matches the key expansion process of each round; the values ​​corresponding to the preset bits of the immediate number include a first value and a second value, where the first value indicates that the current key expansion process is the initial round; the second value indicates that the current key expansion process is not the initial round, such that when the second control signal is the first value, it controls the XOR selection output unit to select and output the initial key; when the second control signal is the second value, it controls the XOR selection output unit to select and output the intermediate key.

[0077] The function of different bits in the immediate value imm8 in the key expansion instruction provided in this embodiment of the invention can be found by referring to... Figure 5 , Figure 5 This is a schematic diagram illustrating the function of immediate values ​​in the key expansion instruction provided in this embodiment of the invention.

[0078] like Figure 5 As shown, the immediate value imm8 in the key expansion instruction provided in this embodiment of the invention has 8 bits, of which the preset bit range [4:0] is used to provide different values ​​for generating the first control signal, so that the constant selection output unit 13 can select and output the corresponding round constant in the constant lookup table 12 based on the indication of the first control signal.

[0079] The value corresponding to the preset bit 5 is used to generate the second control signal, so that the XOR selection output module 16 can select to output the initial key (K0~K3 when i=0) or the intermediate key (K when i=1,...,31) based on the indication of the second control signal. i ~K i+3 ).

[0080] Please refer to Figure 6 , Figure 6 This is the correspondence between different values ​​and theoretical constants within a preset bit range provided in the embodiments of the present invention.

[0081] like Figure 6 As shown, within the preset bit range [4:0], there are 32 different values ​​represented in hexadecimal (8 bits), each corresponding to a round constant used in a round of key expansion. Therefore, when generating the first control signal based on a specific value, the uniquely corresponding round constant can be selected and output from the constant lookup table 12.

[0082] To reduce the latency of the key expansion process, in one embodiment, the key expansion structure may further include a first pipeline register.

[0083] Pipeline registers are a set of registers used at various stages of the processor pipeline to store intermediate data and status information. These registers ensure that data is correctly passed and processed at each stage of processor execution. By inserting pipeline registers into key-expanded combinational logic paths, long combinational logic paths can be divided into multiple shorter segments, thereby reducing the latency of each segment. This allows for higher clock frequencies, thus improving overall system performance.

[0084] Please refer to Figure 7 , Figure 7 This is another schematic diagram of the key expansion structure provided in the embodiment of the present invention.

[0085] like Figure 7 As shown, the key expansion structure 1 includes a first pipeline register 10A, which includes an immediate register 101 (imm reg) and a first source operand register 102.

[0086] The immediate register 101 is used to store the immediate values ​​in the decoded key expansion instruction, so as to provide them to the control signal generation unit 11 to generate control signals;

[0087] The first source operand register 102 is used to store the source operands so as to provide the intermediate key or the input initial key in the source operands to the XOR selection output module 16.

[0088] exist Figure 7 In the key expansion structure shown, the immediate register 101 stores the specific value of the decoded 8-bit immediate value, thus enabling the key to be expanded based on the key expansion structure. Figure 5 and Figure 6 The content shown allows the control signal generation unit 11 to generate a first control signal based on the specific values ​​corresponding to the preset bit range [4:0] stored in the immediate register 101, and provide it to the constant selection output unit 13, according to... Figure 6 The output selects the corresponding round constant. On the other hand, it can control the signal generation unit 11 to generate a second control signal based on the specific value corresponding to the 5th bit stored in the immediate register 101, and provide it to the XOR selection output module 16, so that the XOR selection output unit 162 can select the corresponding round constant according to... Figure 5 The output shown can be either the intermediate key or the initial key obtained after XOR processing by XOR unit 161.

[0089] The decoded 8-bit immediate value can be processed by the immediate value extension module to obtain the specific 8-bit value, and then the control signal generation unit 11 generates a control signal to select the corresponding round constant CK.

[0090] The processor's clock speed determines the length of each clock cycle. The higher the clock speed, the shorter the clock cycle, and the more quickly the hardware needs to complete operations.

[0091] At high operating frequencies, certain operations in the hardware architecture may become performance bottlenecks. By adjusting the hardware architecture and placing time-consuming operations earlier in the pipeline, overall latency can be reduced. Therefore, in another key expansion structure provided in this embodiment of the invention, the arrangement of the control signal generation unit 11, constant lookup table 12, constant selection output unit 13, fixed constant table 15, and XOR selection output module 16 can be adjusted. Please refer to... Figure 8 , Figure 8 This is another schematic diagram of the key expansion structure provided in the embodiments of the present invention.

[0092] like Figure 8 As shown, when the arrangement of the control signal generation unit 11, constant lookup table 12, constant selection output unit 13, fixed constant table 15, and XOR selection output module 16 is adjusted, the key expansion structure also includes a second pipeline register 10B, which includes: a round constant register 103 and a second source operand register 104.

[0093] The round constant register (CK) 103 is used to receive and store the round constant selected and output by the constant selection output unit 13, and to provide the round constant to the round key generation unit 14.

[0094] The second source operand register 104 is used to receive and store the intermediate key or initial key selected by the XOR selection output module 16, so as to provide it to the round key generation unit 14.

[0095] The operations performed by the control signal generation unit 11, constant lookup table 12, constant selection output unit 13, fixed constant table 15, and XOR selection output module 16 take a long time, so their arrangement can be adjusted to meet higher operating frequencies.

[0096] The immediate values ​​upon which the control signal generation unit 11 generates control signals can be provided by an encoder (decoder). The encoder's role is to convert the logic of the key expansion algorithm into signals that the hardware can understand. The encoder's output can include immediate values, which are used to generate control signals and guide the operation of the hardware logic.

[0097] and Figure 7 compared to, Figure 8 As shown, the second source operand register 104 receives the processed result from the XOR selection output module 16, avoiding issues such as... Figure 7 As shown, the time-consuming XOR processing and output selection steps are performed in the first pipeline register 10A.

[0098] Meanwhile, since the constant selection output unit 13 is positioned before the second pipeline register 10B, the selection output of the round constant can be processed earlier to meet the requirements of high operating frequency.

[0099] Figure 7 and Figure 8 The structures shown all demonstrate the key expansion process of the initial round. For example, the first source operand register 102 and the second source operand register 104 both display the source operand contents K0 to K3 corresponding to the key expansion process of the initial round.

[0100] Please refer to Figure 7 or Figure 8 The structure shown indicates that the round key generation unit 14 may include:

[0101] The nonlinear processing module 141 is used to process the round constant selected and output by the constant selection output unit 13 and the intermediate key or initial key selected and output by the XOR selection output module 16, wherein the intermediate key or initial key whose number is not the current round number, to generate a nonlinear processing result.

[0102] Linear processing module 142 is used to perform linear processing on the nonlinear processing result to obtain a linear processing result;

[0103] The current round key generation module 143 is used to process the linear processing result and generate the current round key.

[0104] The round key generation unit 14 is a hardware structure corresponding to the calculation part of the T function and the XOR operation of the T function to generate the round key in the aforementioned round key generation formula.

[0105] Since the transformation function T includes the following steps:

[0106] Nonlinear transformation (Tau):

[0107] The input 32-bit data B is split into four 8-bit bytes, and each byte is replaced using an S-box.

[0108] The S-box is a fixed permutation table with 8-bit input and 8-bit output.

[0109] Linear transformation (L'):

[0110] The formula for the linear transformation L' is:

[0111]

[0112] Where B<<<13 means to circularly shift the 32-bit input data B (the result of non-linear processing) to the left by 13 bits, and B<<<23 means to circularly shift the 32-bit input data B to the left by 23 bits.

[0113] The results of the T function and K i Performing an XOR operation yields the round key for the current round.

[0114] Therefore, the round key generation unit 14 formed based on the above principle may include:

[0115] The nonlinear processing module 141 performs nonlinear operations, the linear processing module 142 performs linear operations, and the round key generation module 143 for the current round.

[0116] Please continue to refer to this. Figure 7 or Figure 8 The round key generation unit 14 may further include:

[0117] The third pipeline register 144 includes an XOR selection output result register 1441, which is used to store the intermediate key or initial key selected and output by the XOR selection output module 16, so as to provide the intermediate key or initial key corresponding to the current round number to the linear processing module 142.

[0118] Among them, Figure 7 In the structure shown, the intermediate key or initial key received by the XOR selection output result register 1441 is directly provided by the XOR selection output module 16; Figure 8 In the structure shown, the intermediate key or initial key received by the XOR selection output result register 1441 is indirectly provided by the second source operand register 104.

[0119] Please continue to refer to this. Figure 7 or Figure 8 In one embodiment, the linear processing module 142 may include:

[0120] The first operation module (B<<<13)1421 is used to perform a left rotation on the nonlinear processing result of the nonlinear processing module 141 to obtain the first operation result;

[0121] The second bit operation module (B<<<23)1422 is used to perform left rotation processing on the nonlinear processing result of the nonlinear processing module 141 to obtain the second bit operation result;

[0122] The first linear XOR module 1423 is used to perform an XOR operation on the first bit operation result and the second bit operation result to generate a first linear processing result.

[0123] The second linear XOR module 1424 is used to perform XOR processing on the intermediate key or initial key with the current round number among the intermediate keys or initial keys selected and output by the nonlinear processing result and the XOR selection output module 16, to generate a second linear processing result; the first linear processing result and the second linear processing result form a linear processing result;

[0124] The nonlinear processing module 141 includes:

[0125] The round constant XOR module 1411 is used to perform XOR processing on the round constant and the intermediate key or initial key whose number is not the current round number, to generate the round constant XOR result, and the round constant XOR result is used to generate the nonlinear processing result;

[0126] The current round key generation module 143 is used to process the linear processing result and generate the current round key, including:

[0127] Perform an XOR operation on the first linear processing result and the second linear processing result to generate the round key for the current round.

[0128] The intermediate or initial key whose number corresponds to a number other than the current round number refers to the intermediate or initial key when i = i+1, i+2, i+3. For example, in the key expansion process of the initial round (i = 0), if the XOR selection output unit 162 selects to output the initial keys K0, K1, K2, K3, then the initial keys corresponding to numbers other than the current round number are K1, K2, K3. Based on the nonlinear processing formula in the aforementioned T function, K1, K2, K3 are XORed with CK0, and then the result of the XOR operation (the XOR result of the round constant) is subjected to a nonlinear transformation to obtain the nonlinear processing result.

[0129] To perform a nonlinear transformation on the XOR result of the round constant, please refer to [reference needed]. Figure 7 or Figure 8 In one embodiment, the nonlinear processing module 141 further includes:

[0130] Replacement box 1412 is used to perform a nonlinear transformation on the XOR result of the wheel constant to generate a nonlinear processing result;

[0131] The third pipeline register 144 also includes:

[0132] The first nonlinear processing result register 1441 is used to store the nonlinear processing result.

[0133] The replacement box 1412 can be the S-box that performs the nonlinear transformation as described above.

[0134] Based on the operation process of the round key generation formula, the key expansion process is divided into stages. The third pipeline register 144 can divide the linear processing and nonlinear processing processes, and store the nonlinear processing result after the nonlinear processing is completed, which is convenient for use in the linear processing process.

[0135] The S-box is a crucial component in the SM4 algorithm for implementing nonlinear transformations. Therefore, to achieve short-latency and compact circuitry, it is necessary to design and optimize the S-box. To optimize hardware implementation, reduce hardware complexity, and improve computational speed, one implementation approach is to split the S-box.

[0136] Please refer to Figure 9 , Figure 9 This is another schematic diagram of the key expansion structure provided in the embodiments of the present invention.

[0137] like Figure 9 As shown, the key expansion structure includes two S-boxes: a first replacement box 1413 and a second replacement box 1414; the first replacement box 1413 is used to perform a partial nonlinear transformation on the XOR result of the round constant to generate an intermediate nonlinear processing result; the second replacement box 1414 is used to perform a nonlinear transformation on each of the intermediate nonlinear processing results to generate a nonlinear processing result.

[0138] The third pipeline register 144 also includes:

[0139] The second nonlinear processing result register 1443 is used to store the intermediate nonlinear processing result for provision to the second replacement box 1414.

[0140] This invention also provides a key expansion method, which is implemented based on the key expansion structure provided in the above embodiments.

[0141] Please refer to Figure 10 , Figure 10 This is a flowchart illustrating a key expansion method provided in an embodiment of the present invention.

[0142] like Figure 10 As shown, the method includes the following steps:

[0143] Step S100: Obtain the key expansion instruction and generate a control signal based on the immediate value in the key expansion instruction, the control signal including a first control signal for determining the round constant.

[0144] The data format of the key expansion instruction is as follows: Figure 4 As shown. Each execution of the key expansion instruction corresponds to the generation of one round of round key expansion.

[0145] Step S101: According to the instruction of the first control signal, select the corresponding wheel constant from the pre-stored wheel constants; the wheel constants are pre-stored in a constant lookup table.

[0146] The wheel constant is CK. i (i = 0, ... 31).

[0147] Step S102: Generate a round key based at least on the round constant.

[0148] As can be seen, the technical solution provided by the embodiments of the present invention stores the round constant in a constant lookup table set in the key expansion structure in advance, thereby avoiding the operation of loading the round constant from the memory when executing the key expansion instruction in each round, speeding up the process of expanding the round key by the key expansion instruction, and thus improving the efficiency of the data encryption and decryption process and the performance of the SM4 algorithm.

[0149] Please refer to Figure 11 , Figure 11 This is another flowchart illustrating the key expansion method provided in this embodiment of the invention.

[0150] like Figure 11 As shown, the method includes the following steps:

[0151] Step S200: Obtain the key expansion instruction and generate a control signal based on the immediate value in the key expansion instruction; the control signal includes a first control signal and a second control signal.

[0152] The first control signal is used to determine the round constant; the second control signal is used to determine the initial key or intermediate key.

[0153] The first control signal is generated based on a value within a preset bit range of the immediate number, and the second control signal is generated based on a value corresponding to a preset bit in the immediate number.

[0154] Step S201: Perform XOR operation using the pre-stored fixed constants and the source operands in the key expansion instruction; and select to output the intermediate key or the initial key according to the indication of the second control signal.

[0155] The intermediate key is the key updated after each round of key expansion; the initial key is the key generated after XOR processing.

[0156] Step S202: According to the instruction of the first control signal, select the corresponding wheel constant from the pre-stored wheel constants; the wheel constants are pre-stored in a constant lookup table.

[0157] Step S203: Generate a round key based on the round constant and the intermediate key, or generate a round key based on the round constant and the initial key.

[0158] The initial key is used for the key expansion process in the initial round; the source operand is used to provide the input initial key or the intermediate key updated after each round of key expansion; the fixed constant is stored in advance in the fixed constant table.

[0159] The second control signal can select to output either the initial key or an intermediate key based on the specific value of the preset bit positions. The first control signal can select the round constant based on the specific value within the preset bit range, thereby satisfying the needs of each round of key expansion.

[0160] Optionally, the XOR operation using a pre-stored fixed constant and the source operand in the key expansion instruction includes:

[0161] An initial key is generated by performing an XOR operation on the fixed constant and the input initial key.

[0162] The initial key is the key used in the initial round (i=0). In each round of key expansion, except for the initial round, the intermediate key updated after the previous round of key expansion is used.

[0163] Optionally, different values ​​within the preset bit range correspond to different rounds of the key expansion process, such that the first control signal controls the constant selection output unit to select the round constant that matches each round of the key expansion process; the values ​​corresponding to the preset bit bits include a first value and a second value, where the first value indicates that the current key expansion process is the initial round; the second value indicates that the current key expansion process is not the initial round, such that when the second control signal is the first value, it controls the XOR selection output unit to select the initial key; when the second control signal is the second value, it controls the XOR selection output unit to select the intermediate key.

[0164] This invention also provides a hardware encryption module to implement the SM4 algorithm.

[0165] Please refer to Figure 12 , Figure 12 This is a schematic diagram of the hardware encryption module provided in an embodiment of the present invention.

[0166] like Figure 12 As shown, the hardware encryption module includes a key expansion structure 1 as described in any of the foregoing embodiments.

[0167] As can be seen, the hardware encryption module provided in this embodiment of the invention includes a key expansion structure 1. Since a constant lookup table 12 for storing round constants (CK) is added to the key expansion structure 1, the round constants can be pre-stored (i.e., stored in the constant lookup table 12 set in the key expansion structure). This avoids the operation of loading the round constants from memory each time the key expansion instruction is executed, speeding up the process of expanding the round key by the key expansion instruction, thereby improving the efficiency of the data encryption and decryption process and the performance of the SM4 algorithm.

[0168] The foregoing describes multiple embodiments of the present invention. The optional methods described in each embodiment can be combined and cross-referenced without conflict, thereby extending to a variety of possible embodiments. These can all be considered as embodiments disclosed or made public by the present invention.

[0169] While the embodiments of the present invention have been disclosed above, the present invention is not limited thereto. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of the present invention; therefore, the scope of protection of the present invention should be determined by the scope defined in the claims.

Claims

1. A key expansion structure, characterized in that, include: A control signal generation unit is used to generate control signals based on the immediate values ​​in the acquired key expansion instructions, the control signals including a first control signal for determining the round constant; The first control signal is generated based on the value within a preset bit range of the immediate number. Different values ​​within the preset bit range of the immediate number correspond to different rounds of key expansion process, so that the first control signal controls the constant selection output unit to select and output a round constant that matches the key expansion process of each round. A constant lookup table is used to store round constants, which are used when the key expansion instruction is executed to generate the round key. The round constants are pre-frozen in the constant lookup table before the key expansion instruction is executed, thereby avoiding the operation of loading the round constants from memory each time the key expansion instruction is executed. A constant selection output unit is used to receive a first control signal generated by the control signal generation unit, and select and output the round constant corresponding to each round of key expansion process in the constant lookup table according to the indication of the first control signal. A round key generation unit is used to receive the round constants selected and output by the constant selection and output unit, so as to generate a round key based at least on the round constants.

2. The key expansion structure as described in claim 1, characterized in that, The control signal further includes a second control signal for determining the initial key or intermediate key; the second control signal is generated based on the value corresponding to a preset bit in the immediate value; the key expansion structure further includes: A fixed constant table is used to store the fixed constants used to generate the initial key; The XOR selection output module is used to perform XOR processing on the fixed constants in the fixed constants table and the source operands in the key expansion instructions; and based on the indication of the received second control signal, to select and output either the intermediate key updated after each round of key expansion process, or the initial key generated after the XOR processing; the initial key is applied to the key expansion process of the initial round; the source operands are used to provide the input initial key or the intermediate key updated after each round of key expansion process; The round key generation unit is further configured to receive the intermediate key or initial key selected and output by the XOR selection output module, so as to generate a round key based on the round constant and the intermediate key, or generate a round key based on the round constant and the initial key.

3. The key expansion structure as described in claim 2, characterized in that, The XOR selection output module includes: an XOR unit and an XOR selection output unit; The XOR unit is used to receive the fixed constants in the fixed constants table and the input initial key, and to perform an XOR operation on the fixed constants and the input initial key to generate the initial key; The XOR selection output unit is used to receive the initial key and the intermediate key generated by the XOR unit, and select to output the intermediate key or the initial key based on the indication of the second control signal.

4. The key expansion structure as described in claim 3, characterized in that, The values ​​corresponding to the preset bits of the immediate number include a first value and a second value. The first value indicates that the current key expansion process is the initial round; the second value indicates that the current key expansion process is not the initial round, such that when the second control signal is the first value, the XOR selection output unit is controlled to select and output the initial key; when the second control signal is the second value, the XOR selection output unit is controlled to select and output the intermediate key.

5. The key expansion structure as described in claim 4, characterized in that, Also includes: The first pipelined register includes: a first source operand register and an immediate register; The immediate register is used to store the immediate values ​​in the decoded key expansion instruction, so as to provide them to the control signal generation unit to generate control signals; The first source operand register is used to store the source operands so as to provide the intermediate key or the input initial key in the source operands to the XOR selection output module.

6. The key expansion structure as described in claim 4, characterized in that, Also includes: The second pipeline register includes: a round constant register and a second source operand register; The round constant register is used to receive and store the round constant selected and output by the constant selection output unit, and to provide the round constant to the round key generation unit. The second source operand register is used to receive and store the intermediate key or initial key selected by the XOR selection output module, so as to provide it to the round key generation unit.

7. The key expansion structure as described in any one of claims 2-6, characterized in that, The round key generation unit includes: The nonlinear processing module is used to process the round constant selected and output by the constant selection output unit and the intermediate key or initial key selected and output by the XOR selection output module, wherein the intermediate key or initial key whose number is not the current round number, to generate a nonlinear processing result. A linear processing module is used to perform linear processing on the nonlinear processing result to obtain a linear processing result; The current round key generation module is used to process the linear processing result and generate the current round key.

8. The key expansion structure as described in claim 7, characterized in that, The round key generation unit further includes: The third pipeline register includes an XOR selection output result register, which is used to store the intermediate key or initial key selected by the XOR selection output module, so as to provide the intermediate key or initial key corresponding to the current round number to the linear processing module.

9. The key expansion structure as described in claim 8, characterized in that, The linear processing module includes: The first operation module is used to perform a left rotation on the nonlinear processing result of the nonlinear processing module to obtain the first operation result; The second-bit operation module is used to perform a left rotation on the nonlinear processing result of the nonlinear processing module to obtain the second-bit operation result. The first linear XOR module is used to perform an XOR operation on the first bit operation result and the second bit operation result to generate a first linear processing result. The second linear XOR module is used to perform XOR processing on the intermediate key or initial key corresponding to the current round number among the intermediate keys or initial keys selected and output by the nonlinear processing result and the XOR selection output module, to generate a second linear processing result; the first linear processing result and the second linear processing result form a linear processing result; The nonlinear processing module includes: The round constant XOR module is used to perform XOR processing on the round constant and the intermediate key or initial key whose number is not the current round number, to generate the round constant XOR result. The round constant XOR result is used to generate the nonlinear processing result. The current round key generation module is used to process the linear processing result and generate the current round key, including: Perform an XOR operation on the first linear processing result and the second linear processing result to generate the round key for the current round.

10. The key expansion structure as described in claim 9, characterized in that, The nonlinear processing module further includes: The replacement box is used to perform a nonlinear transformation on the XOR result of the wheel constant to generate a nonlinear processing result. The third pipeline register also includes: The first nonlinear processing result register is used to store the nonlinear processing result.

11. The key expansion structure as described in claim 9, characterized in that, The nonlinear processing module further includes: The first replacement box is used to perform a partial nonlinear transformation on the XOR result of the wheel constant to generate an intermediate nonlinear processing result. The second replacement box is used to perform nonlinear transformation on each of the intermediate nonlinear processing results to generate a nonlinear processing result. The third pipeline register also includes: The second nonlinear processing result register is used to store the intermediate nonlinear processing results for provision to the second replacement box.

12. A key expansion method, characterized in that, include: Obtain a key expansion instruction and generate control signals based on the immediate values ​​in the key expansion instruction, the control signals including a first control signal for determining the round constant; The first control signal is generated based on the value within a preset bit range of the immediate number. Different values ​​within the preset bit range of the immediate number correspond to different rounds of key expansion process, so that the first control signal controls the constant selection output unit to select and output a round constant that matches the key expansion process of each round. According to the instruction of the first control signal, the corresponding round constant is selected from the pre-stored round constants; the round constants are pre-stored in a constant lookup table; the round constants are pre-fixed in the constant lookup table before the key expansion instruction is executed, thereby avoiding the operation of loading the round constants from memory each time the key expansion instruction is executed. The round key is generated based at least on the round constant.

13. The key expansion method as described in claim 12, characterized in that, The control signal further includes a second control signal for determining an initial key or an intermediate key; the second control signal is generated based on the value corresponding to a preset bit in the immediate value; the method further includes: The key expansion instruction is XORed with a pre-stored fixed constant and the source operands. Based on the indication of the second control signal, the intermediate key generated in each round of key expansion is selected to be output, or the initial key generated after XORing. The generation of the round key based at least on the round constant includes: A round key is generated based on the round constant and the intermediate key, or a round key is generated based on the round constant and the initial key; The initial key is used for the key expansion process in the initial round; the source operand is used to provide the input initial key or the intermediate key updated after each round of key expansion; the fixed constant is stored in advance in the fixed constant table.

14. The key expansion method as described in claim 13, characterized in that, The XOR operation using a pre-stored fixed constant and the source operand in the key expansion instruction includes: An initial key is generated by performing an XOR operation on the fixed constant and the input initial key.

15. The key expansion method as described in claim 14, characterized in that, The preset bit values ​​include a first value and a second value. The first value indicates that the current key expansion process is the initial round; the second value indicates that the current key expansion process is not the initial round, so that when the second control signal is the first value, it controls the XOR selection output unit to select the output of the initial key; when the second control signal is the second value, it controls the XOR selection output unit to select the output of the intermediate key.

16. A hardware encryption module, characterized in that, include: The key expansion structure as described in any one of claims 1-11.

Images