A hardware implementation method and application of SM4 S-box based on redundant tower domain

Abstract

The application discloses a kind of SM4 S box hardware implementation method and application based on redundant tower area, belong to information security technical field, including: using redundant tower area to express AES S box, and using little end order to express affine transformation;Give the conversion relationship between the S box of AES and SM4, and express affine transformation and constant offset using little end order;Based on step 1 and step 2, give the SM4 S box expression based on redundant tower area;Combined with the mask implementation of three-stage inverse of redundant tower area, complete the complete SM4 hardware design.The application first maps SM4 S box to the redundant tower area implementation framework of AES S box, by optimizing and merging multiple affine transformation layers and constant offset, realize high compact RTF-SM4.The S box is very easy to combine with mask class and double-track class and other gate-level side channel attack protection schemes, realize compact and anti-side channel attack SM4 hardware implementation, ensure the side channel security of encryption hardware.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of information security, and particularly relates to an SM4 S-box hardware implementation method based on a redundant tower field and application, and is mainly used for ensuring the side channel security of encryption hardware. BACKGROUND

[0002] SM4 is a commercial block cipher standard (GB / T 32907) independently designed by China, and plays a core role in the power grid information security system. In view of the characteristics of limited terminal resources, high real-time requirements and large deployment scale of the power grid, it is urgent to design a low-area and high-efficiency SM4 implementation.

[0003] In order to ensure the high efficiency of SM4 implementation, an efficient nonlinear component S-box implementation scheme needs to be used to reduce hardware overhead. Existing S-box implementation schemes include two types: lookup table type implementation method and calculation type implementation method. The lookup table type implementation method stores the S-box in the LUT lookup table, and realizes the S-box function by inquiring the LUT lookup table. The advantage of this method is fast speed, and the disadvantage is large area. The calculation type implementation method first represents the S-box operation as a polynomial in a finite field, and then constructs the S-box operation by using finite field modular multiplication, modular addition and other basic operations. Although the calculation speed of this implementation method is not as fast as LUT, it saves area compared with the LUT method.

[0004] The calculation type implementation method can be divided into polynomial basis calculation, normal basis calculation, tower field (composite field) calculation and redundant tower field calculation. On the basis of the original polynomial basis and normal basis calculation, in the prior art, a literature published in 2005 [Canright D. A very compact S-box for AES [C] / / Cryptographic Hardware and Embedded Systems- CHES 2005. Springer, 2005: 441-455.] gives a kind of efficient tower field method (Tower Field Approach), which converts the field into a tower field in the calculation process, such as or or On the basis of tower field calculation, a literature published in 2015 [Ueno R, Homma N, Sugawara Y, et al. Highly efficient In 2015, the authors of the paper “Inversion Circuit Based on Redundant GF Arithmetic and Its Application to AES Design [C] / / Cryptographic Hardware and Embedded Systems-CHES 2015. Springer, 2015:63-80.” proposed a redundant tower field implementation method. In 2018, a redundant tower field-based ISW mask type AES hardware design method was proposed in the prior art, which combines the redundant tower field technology and the ISW mask. On the Kintex7 device, compared with the low-entropy mask scheme, the area is reduced by 63.11%, and the area-time product is reduced by 48.35%. It can be seen that when the redundant tower field technology is applied to the AES S-box, the mask implementation scheme has a significant advantage in area and area-time product.

[0005] If the redundant tower field technology is applied to the SM4 S-box, not only can the existing AES S-box mask technology be directly used, but also the area of the SM4 S-box can be reduced. However, the application of the RTF technology to the side channel protection of SM4 still faces severe challenges. The fundamental reason is that although the S-boxes of SM4 and AES are both operated on , their algebraic structures are different, resulting in different irreducible polynomials, affine transformation matrices before and after inversion, and constant offsets. This results in the inability to unify the S-boxes of the two through simple mapping, and the RTF architecture needs to be adapted accordingly.

[0006] The irreducible polynomial on which SM4 is defined in the finite field is , while the irreducible polynomial used by AES is .

[0007] For the conversion problem of the S-boxes of the two, the OSR company gave an equivalence relationship model based on affine transformation in the AES and SM4 S-box composite field implementation method. This model realizes the mathematical mapping of the S-box of AES to the S-box of SM4 by introducing the pre-affine transformation D1, the post-affine transformation D2, and the constant offsets c1 and c2. However, the affine transformation is in big-endian representation, which cannot be uniformly represented with the affine transformation in the redundant tower field.

[0008] Therefore, the application of the redundant tower field technology of the AES S-box to the SM4 S-box faces the technical challenges of different irreducible polynomials, affine transformation matrices before and after inversion, and constant offsets. SUMMARY

[0009] The technical problems solved by the present application: the present application provides a redundant tower domain based SM4 S-box hardware implementation method capable of applying AES S-box redundant tower domain design to SM4 S-box, which directly uses the basis and non-inverting gate implementation, and can provide a basic implementation framework for mask type side channel attack protection.

[0010] Technical scheme: in order to solve the above technical problems, the technical scheme adopted by the present application is as follows:

[0011] A redundant tower domain based SM4 S-box hardware implementation method, through the algebraic mapping relationship between SM4 S-box and AES S-box, deduces the implementation framework of SM4 S-box embedded in AES redundant tower domain, further optimizes the affine transformation matrix and constant offset, realizes the compact RTF-SM4 round function, and realizes the SM4 hardware design. Including the following steps:

[0012] Step 1: give the AES S-box represented by redundant tower domain, and the affine transformation is represented by little endian sequence;

[0013] Step 2: give the conversion relationship between the S-boxes of AES and SM4, and the affine transformation and constant offset are represented by little endian sequence;

[0014] Step 3: based on step 1 and step 2, give the redundant tower domain based SM4 S-box representation;

[0015] Step 4: combine the three-stage implementation of redundant tower domain inverse, complete the complete SM4 S-box hardware design, and the specific implementation process is:

[0016] 1) input data;

[0017] 2) perform pre-affine transformation and pre-constant offset on the input data;

[0018] 3) redundant tower domain inverse, or mask type redundant tower domain inverse three stage;

[0019] 4) perform post-affine transformation and post-constant offset to obtain SM4 S-box hardware. Further, in step 1, the inverse based on redundant tower domain representation is:

[0020] ;

[0021] Wherein, Inv(x) represents the inverse operation on the AES S-box, x represents an 8x1 column vector, which is an 8-bit input element represented by polynomial basis (PB) in GF(2 8 ) domain; M1 represents an 8x8 affine transformation matrix, which can map the input x to GF(2 4 ) 2Two 4-bit elements (8 bits in total) on the normal basis (NB) of the tower field; M2 represents an 8x10 affine transformation matrix, which can transform the input in GF(2 5 ) 2 Two 5-bit elements (10 bits in total) on the redundant representation basis (RRB) of the tower field, mapped to an 8-bit element on the polynomial basis of the GF(2 8 ) field.

[0022] The AES S-box based on the redundant tower field representation is:

[0023]

[0024] wherein, S AES represents the S-box of the AES block cipher algorithm, x represents the 8-bit input of the S-box, represented by an 8x1 column vector; y represents the 8-bit output of the S-box, represented by an 8x1 column vector; c represents the 8-bit constant offset, represented by an 8x1 column vector; and A represents an 8x8 affine transformation matrix.

[0025] The affine transformation is represented in little-endian order:

[0026] ;

[0027] wherein, B represents an 8x10 affine transformation matrix, obtained by multiplying the affine transformation matrix A and the affine transformation matrix M2; the 8-bit output y of the S-box is composed of {y7, y6, y5, y4, y3, y2, y1, y0} from high to low, and y0~ y7 represent 8 1-bit elements; the 8-bit input x of the S-box is composed of {x7, x6, x5, x4, x3, x2, x1, x0} from high to low, and x0~ x7 represent 8 1-bit elements.

[0028] Further, in step 2, the conversion relationship between the S-boxes of AES and SM4 is:

[0029] ;

[0030] wherein, S SM4 (x) represents the S-box of the SM4 algorithm, S AES represents the S-box of the AES block cipher algorithm, D1 represents an 8x8 affine transformation matrix, c1 represents an 8x1 column vector, and c2 represents an 8x1 column vector.

[0031] The affine transformation and the constant offset are represented in little-endian order:

[0032] ;

[0033] Wherein, y0~ y7 are single-bit inputs, collectively constitute the 8-bit output of the SM4 S-box, expressed in little-endian order, the 8-bit output is composed of {y7, y6, y5, y4, y3, y2, y1, y0} from high to low; x0~ x7 are single-bit elements, collectively constitute the 8-bit input of the SM4 S-box, expressed in little-endian order, the 8-bit output is composed of {x7, x6, x5, x4, x3, x2, x1, x0} from high to low.

[0034] Further, in step 3, the SM4 S-box based on the redundant tower field is expressed as:

[0035] The following formula will substitute the formula of the AES S-box S AES and the formula of the redundant tower field inverse Inv(x) into the relationship between the SM4 S-box and the AES S-box, and then the multiple affine matrices are combined, and the process is as follows:

[0036]

[0037] Let

[0038] The SM4 S-box formula based on the redundant tower field can be obtained, as follows:

[0039] ;

[0040] Wherein, S SM4 represents the S-box of the SM4 algorithm, F1 represents the front affine transformation, F2 represents the rear affine transformation, E1 represents the front constant offset, and E2 represents the rear constant offset.

[0041] Advantages: compared with the prior art, the present application has the following advantages:

[0042] (1) The present application first maps the SM4 S-box into the redundant tower field implementation framework of the AES S-box. By optimizing and combining multiple affine transformation layers and constant offsets, a high-compact RTF-SM4 is finally realized.

[0043] (2) The SM4 S-box based on the redundant tower field directly uses the basis and NOT gate to realize, which can provide a basic implementation framework for mask type and double track type and other gate level side channel attack protection schemes. And the hardware design area and unit area throughput of the SM4 S-box based on the redundant tower field are more advantageous.

[0044] (3) Hardware designers can use this method to realize a low-area SM4 S-box, which can be easily combined with mask type and double track type and other gate level side channel attack protection schemes to realize a compact and anti-side channel attack SM4 hardware implementation, ensure the side channel security of the encryption hardware, and ensure the security of sensitive data. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 The hardware design of the SM4 S-box based on the redundant tower field of the present application;

[0046] Figure 2 The hardware design of the mask type redundant tower field SM4 S-box further implemented based on the present application;

[0047] Figure 3 The TVLA maximum value result corresponding to different sensitive intermediate values. Specifically, the TVLA evaluation maximum value result of SM4 at 100,000 energy traces and 1,000,000 energy traces for different intermediate value bits, the horizontal coordinate represents the 32 intermediate value bits (0,..., 31) of SM4, and the vertical coordinate represents the value of the leakage detection evaluation, which is <4.5, indicating that no information leakage is detected. DETAILED DESCRIPTION

[0048] The present application will be further illustrated below in combination with specific embodiments, which are implemented on the premise of the technical solutions of the present application, and it should be understood that these embodiments are only used to illustrate the present application and not to limit the scope of the present application.

[0049] Embodiment 1

[0050] The hardware implementation method of the SM4 S-box based on the redundant tower field of the present embodiment derives the implementation framework of the SM4 S-box embedded in the AES redundant tower field through the algebraic mapping relationship between the SM4 S-box and the AES S-box, further optimizes the affine transformation matrix and the constant offset, and realizes the compact RTF (Redundant Tower Field) -SM4 round function. It mainly includes four steps of step 1~step 4:

[0051] Step 1: give the AES S-box represented by the redundant tower field, and represent the affine transformation with little-endian sequence;

[0052] Step 2: give the conversion relationship between the S-boxes of AES and SM4, and represent the affine transformation and the constant offset with little-endian sequence;

[0053] Step 3: based on step 1 and step 2, give the SM4 S-box representation based on the redundant tower field.

[0054] Step 4: combine the three-stage implementation of the inverse of the redundant tower field to realize the complete SM4 hardware design.

[0055] The above steps are described in combination with the specific implementation method.

[0056] Step 1: give the AES S-box represented by the redundant tower field, and represent the affine transformation with little-endian sequence;

[0057] The inverse based on the redundant tower field representation is:

[0058] ;

[0059] where Inv(x) denotes the inverse operation on the AES S-box, x denotes an 8x1 column vector, and is an 8-bit input element represented in the polynomial basis (PB) over the GF(2 8 ) field; M1 denotes an 8x8 affine transformation matrix that maps the input x to two 4-bit elements (totaling 8 bits) on the tower field normal basis (NB) over the GF(2 4 ) 2 ) field; M2 denotes an 8x10 affine transformation matrix that maps the input to two 5-bit elements (totaling 10 bits) on the GF(2 5 ) 2 ) field redundantly represented basis (RRB) to an 8-bit element on the polynomial basis over the GF(2 8 ) field.

[0060] The AES S-box based on the redundant tower field representation is:

[0061]

[0062] where S AES denotes the S-box of the AES block cipher algorithm, x denotes the 8-bit input of the S-box, which is represented by an 8x1 column vector; y denotes the 8-bit output of the S-box, which is represented by an 8x1 column vector; c denotes an 8-bit constant offset, which is represented by an 8x1 column vector; and A denotes an 8x8 affine transformation matrix.

[0063] The affine transformations are expressed in the least significant bit first (LSB first) order:

[0064] ;

[0065] where B denotes an 8x10 affine transformation matrix obtained by multiplying the affine transformation matrix A and the affine transformation matrix M2; the 8-bit output y of the S-box is composed of {y7, y6, y5, y4, y3, y2, y1, y0} from high to low, and y0~ y7 denote 8 1-bit elements; the 8-bit input x of the S-box is composed of {x7, x6, x5, x4, x3, x2, x1, x0} from high to low, and x0~ x7 denote 8 1-bit elements.

[0066] Step 2: The conversion relationship between the S-boxes of AES and SM4 is given, and both the affine transformation and the constant offset are expressed in little-endian.

[0067] The conversion relationship between the S-boxes of AES and SM4 is:

[0068]

[0069] The existing affine transformation is expressed in big-endian data. In order to be able to express the affine transformation in the redundant tower field uniformly, the little-endian expression is adopted in the present application. Compared with big-endian, the little-endian expression needs to reverse the order of columns and rows. The specific formula is as follows:

[0070]

[0071] wherein S SM4 (x) represents the S-box of the SM4 algorithm, S AES represents the S-box of the AES block cipher algorithm, D2 represents an 8x8 affine transformation matrix, D1 represents an 8x8 affine transformation matrix, c1 represents an 8x1 column vector, and c2 represents an 8x1 column vector.

[0072] Step 3: Based on steps 1 and 2, the SM4 S-box expression based on the redundant tower field is given.

[0073] The specific content of the SM4 S-box expression based on the redundant tower field is as follows:

[0074] The following formula substitutes the formula S AES of the AES S-box and the formula of the inverse of the redundant tower field Inv(x) into the relationship between the SM4 S-box and the AES S-box, and then combines multiple affine matrices. The process is as follows:

[0075]

[0076] Let

[0077] The SM4 S-box formula based on the redundant tower field can be obtained, as shown below:

[0078]

[0079] wherein S SM4 represents the SM4 S-box, F1 represents the front affine transformation, F2 represents the rear affine transformation, E1 represents the front constant offset, and E2 represents the rear constant offset.

[0080] In the above formula, the front affine transformation F1 is an 8x8 matrix transformation and does not contain nonlinear AND gates, OR gates, and NOT gates, but only contains linear XOR operations. The front constant offset E1 is an 8x1 constant offset.​​​

[0081] Post-affine transformation F2 is an 8-row 10-column matrix transformation and does not contain nonlinear AND gates, OR gates and NOT gates, but only contains linear XOR operations. Post-constant offset E2 is an 8-row 1-column constant offset.

[0082] Step 4: The complete SM4 hardware design is completed by combining the three-stage implementation of the redundant tower field inversion.

[0083] This embodiment adopts three-stage redundant tower field inversion, and the specific implementation manner is referred to the two manners of Embodiment 2 and Embodiment 3.

[0084] Embodiment 2

[0085] This embodiment gives a specific hardware design process of the redundant tower field SM4 S-box, as shown in the following figure, which includes, from the input, the pre-affine transformation and the pre-constant offset, the redundant tower field inversion, the post-affine transformation and the post-constant offset. Figure 1 The specific implementation contents are as follows:

[0086] S1: Pre-affine transformation and pre-constant offset

[0087] The input x is an 8-bit input element represented by a polynomial basis (PB) in the GF(2 8 ) field.

[0088] The pre-affine transformation F1 is an 8-row 8-column matrix transformation and does not contain nonlinear AND gates, OR gates and NOT gates, but only contains linear XOR operations. The pre-constant offset E1 is an 8-row 1-column constant offset.

[0089] The pre-affine transformation and the pre-constant offset can be combined to calculate, when x[7:0] is the input and y1[7:0] is the output, the hardware implementation is as shown in the following figure.

[0090]

[0091] Wherein, 1'b1 represents 1 bit 1, and ^ represents XOR.

[0092] The output of S1 is x in the tower field x represented by the normal basis is represented by high 4 bits {h4, h3, h2, h1} and low 4 bits {l4, l3, l2, l1}.

[0093] S2: Redundant tower field inversion

[0094] As shown in the following figure, in this embodiment, three-stage implementation of redundant tower field inversion is adopted. Figure 1 Stage 1: The output of S1 is x in the tower field

[0095] ​The x represented by the normal basis can be represented by the high 4 bits {h4, h3, h2, h1} and the low 4 bits {l4, l3, l2, l1}. The stage 1 calculation is and .

[0096] represents the 16th power of the input x, and the output result is represented by the redundant tower field . The output high 5 bits are {l4, l3, l2, l1, 1}, and the low 5 bits are {h4, h3, h2, h1, 1}.

[0097] represents the 17th power of the input x, and the output result is represented by the redundant tower field . The specific calculation method of is as follows:

[0098] .

[0099] where + represents XOR, represents OR, and the omitted symbol between two variables is AND.d 0~ d4 is a single-bit element, representing the output corresponding 5 bits; H i,j = h i + h j , L i,j = l i + l j (1≤i

[0100] Stage 2: In the redundant tower field , the inverse is calculated by PRR (Polynomial Ring Representation), and .

[0101] .

[0102] where e 0~ e4 is a single-bit element, representing the output corresponding 5 bits.

[0103] Stage 3: In the redundant tower field, the multiplication is calculated by RRB, and , and .

[0104]

[0105] where h' = h + e 0~ h'4is a single-bit element, representing corresponding high 5-bit output, F i,j = e i + e j， (1≤i 0~ h'4is replaced by l'4, L 0~ h'4is replaced by l'4, L i,j is replaced by H i,j , l is replaced by h, we get corresponding low 5-bit output, l 0~ l'4.

[0106] S3: Post-affine transformation and post-constant offset

[0107] The post-affine transformation F2 is an 8-row 10-column matrix transformation, and does not contain nonlinear AND gates, OR gates and NOT gates, but only contains linear XOR operations. The post-constant offset E2 is an 8-row 1-column constant offset.

[0108] The post-affine transformation and the post-constant offset can be combined to calculate, when e[9:0] is the input and y[7:0] is the output, the hardware implementation is as follows.

[0109]

[0110] The three-stage method of inverting the redundant tower field S2 can refer to the literature “[Highly Efficient GF(2 8 )Inversion Circuit based on Redundant GF Arithmetic and its Application to AESDesign,” in CHES 2015, ser. LNCS, T. G¨ uneysu and H. Handschuh, Eds., vol.9293. Springer, 2015, pp. 63–80.].

[0111] Embodiment 3

[0112] The SM4 S-box hardware based on the redundant tower field is combined with the side channel attack protection, which is used to ensure the side channel security of the encryption hardware. The S-box can be combined with the mask class and other gate-level side channel attack protection schemes very easily, to realize the compact and side channel attack resistant SM4 hardware implementation, to ensure the side channel security of the encryption hardware, and to ensure the security of the sensitive data.

[0113] Specifically, the embodiment gives a mask protection type redundant tower field SM4 S-box hardware design process (ISW-RTF SM4 for short), as shown in the figure, from the input to include the pre-affine transformation and the pre-constant offset, the mask type redundant tower field inverse three stages, the post-affine transformation and the post-constant offset. The specific implementation is as follows: Figure 2

[0114] S1: Pre-affine transformation and pre-constant offset

[0115] The input here has two variables, input x1 and input x2. The meaning is to split the input x into x1 and x2 two shared factors, which satisfy the following conditions: x1 is a random number, and x2=x^ x1. x is the real input of the SM4 S-box, that is, the 8-bit input element represented by the polynomial basis (PB) of the GF(2 8 ) field. In this way, the leakage of any shared factor information will not leak the real sensitive intermediate value, so that the circuit can resist first-order side channel attacks.

[0116] 8-bit input x1, after pre-affine transformation F1 and pre-constant offset E1, its output α1, α1 is an 8-bit variable, its high four bits and low four bits are in the tower field represented by the normal basis.

[0117] 8-bit input x2, after pre-affine transformation F1, its output α2, α2 is an 8-bit variable, its high four bits and low four bits are in the tower field represented by the normal basis.

[0118] S2: Masked redundant tower field inverse three stages

[0119] The two 8-bit variables α1 and α2 represented by the normal basis output by the S1 stage are taken as the input of the mask type redundant tower field inverse three stages, and the output is α1 -1 and α2 -1 represented by the redundant representation basis RRB.

[0120] This mask type redundant tower field inverse three stages can directly use the reference: [A Compact AES Hardware Implementation Secure Against 1st-Order Side-Channel Attacks. ICCD 2018: 545-552] III Proposed Implementation B. Masked AES S-box, which describes Stage1, Stage2, Stage3 in the literature.

[0121] S3: Post-affine transformation and post-constant offset ​

[0122] The redundancy representation base RRB represented by S2 stage output -1 and -1 As the input of S3, the -1 After the post-affine transformation F2 and the post-constant offset E2, y1 is obtained; and -1 After the post-affine transformation F2, y2 is obtained.

[0123] The mask type redundancy tower field inverse three-stage method can refer to the literature: [A Compact AES Hardware Implementation Secure Against 1st-Order Side-Channel Attacks. ICCD 2018:545-552] for the design of the mask type redundancy tower field inverse three-stage.

[0124] The evaluation results of the SM4 S-box realized by the method of the application are as follows:

[0125] The advantage of the application is that the efficient redundancy tower field is implemented in the SM4 S-box, and the SM4 S-box is realized by using the basis and NOR gate. The SM4 S-box can be combined with the ISW mask and other schemes very easily, and technical advantages are achieved in terms of area and unit area throughput.

[0126] The performance comparison and security evaluation of the SM4 S-box mask implementation (referred to as ISW-RTF SM4) based on the redundancy tower field (RTF) and the SM4 S-box mask implementation (referred to as RSM-LUT SM4) based on the lookup table (LUT) proposed by the application are as follows.

[0127] Table 1 gives the performance comparison of the redundancy tower field mask implementation and the lookup table type mask implementation SM4. On Kintex7, Virtex6 and Spartan6 three FPGA, the LUT usage of ISW-RTF SM4 is reduced by 52% compared with RSM-LUT SM4, and the unit area throughput is increased by 22%-34%. On Spartan3 device, the LUT usage is reduced by 81%, and the unit area throughput is increased by 1.38 times. It can be seen that when the mask scheme is used for protection design, the area and unit area throughput are better than the lookup table type when combined with the redundancy tower field implementation.

[0128] Table 1 Performance comparison of redundancy tower field mask implementation and lookup table type mask implementation

[0129]

[0130] The 31 rounds and 32 rounds of register storage sensitive intermediate values of SM4 are tested by using the collected energy traces of two SM4 implementations, and test vector leakage assessment (TVLA) is performed. Figure 3 The TVLA test maximum value results of different intermediate value bits of SM4 at 100,000 energy traces and 1,000,000 energy traces are given. It can be seen that at 100,000 energy traces and 1,000,000 energy traces, the mask scheme based on the method of the application can protect all bits of the 32-bit round key of SM4.

[0131] The above only describes the preferred embodiments of the present application, and it should be noted that for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should also be considered as the protection scope of the present application.

Claims

1. A hardware implementation method for an SM4 S-box based on redundant tower domains, characterized in that: By leveraging the algebraic mapping relationship between the SM4 S-box and the AES S-box, the implementation framework for embedding the SM4 S-box into the AES redundant tower domain is derived. Further optimization of the affine transformation matrix and constant offset enables a compact RTF-SM4 round function, thus realizing the SM4 S-box hardware design. The specific implementation process is as follows: 1) Input data; 2) Perform a pre-affine transformation and a pre-constant offset on the input data; 3) Redundant tower domain inversion, or masked redundant tower domain inversion in three stages; 4) Perform post-affine transformation and post-constant offset to obtain the SM4 S-box hardware.

2. The hardware implementation method of SM4 S-box based on redundant tower domain according to claim 1, characterized in that, Includes the following steps: Step 1: Give the AES S-box represented using redundant tower domains, and use little-endian representation for affine transformation; Step 2: Give the conversion relationship between the S-boxes of AES and SM4. Affine transformations and constant offsets are represented in little-endian order. Step 3: Based on Step 1 and Step 2, give the SM4 S-box representation based on the redundant tower domain; Step 4: Combine the implementation of the three-stage inversion of the redundant tower domain to complete the complete SM4 hardware design.

3. The hardware implementation method of SM4 S-box based on redundant tower domain according to claim 2, characterized in that: In step 1, the inversion based on the redundant tower domain representation is: ； Where Inv(x) represents the inverse operation on the AES S-box, and x represents the 8-bit input of the S-box, represented by an 8×1 column vector, denoted as GF(2). 8 The 8-bit input elements are represented by a polynomial basis over the GF(2) domain; M1 represents an 8×8 affine transformation matrix that maps the input x to GF(2) domain. 4 ) 2 The two 4-bit elements are represented on the normal basis of the tower domain; M2 represents an 8×10 affine transformation matrix, with the input in GF(2 5 ) 2 Two 5-bit elements on the domain redundancy representation basis are mapped to GF(2). 8 ) is an 8-bit element represented by a polynomial basis over a field.

4. The hardware implementation method of SM4 S-box based on redundant tower domain according to claim 3, characterized in that: The AES S-box based on the redundant tower domain representation is: ； Among them, S AES Let S represent the S-box of the AES block cipher algorithm; y represents the 8-bit output of the S-box, represented by an 8×1 column vector; c represents the 8-bit constant offset, represented by an 8×1 column vector; and A represents the 8×8 affine transformation matrix.

5. The hardware implementation method of SM4 S-box based on redundant tower domain according to claim 3, characterized in that: Affine transformations are all represented in little-endian order: ； Where B represents an 8×10 affine transformation matrix, obtained by multiplying affine transformation matrix A and affine transformation matrix M2; the 8-bit output y of the S-box consists of {y7, y6, y5, y4, y3, y2, y1, y0} from the most significant bit to the least significant bit, where y0~y7 represent 8 1-bit elements; the 8-bit input x of the S-box consists of {x7, x6, x5, x4, x3, x2, x1, x0} from the most significant bit to the least significant bit, where x0~x7 represent 8 1-bit elements.

6. The hardware implementation method of SM4 S-box based on redundant tower domain according to claim 2, characterized in that: In step 2, the conversion relationship between the S-boxes of AES and SM4 is as follows: ； Among them, S SM4 (x) represents the S-box of the SM4 algorithm, S AES Let S represent the S-box of the AES block cipher algorithm, D2 represent the 8×8 affine transformation matrix, D1 represent the 8×8 affine transformation matrix, c1 represent the 8×1 column vector, and c2 represent the 8×1 column vector.

7. The hardware implementation method of SM4 S-box based on redundant tower domain according to claim 6, characterized in that: The affine transformation matrices D1 and D2, and the constant offsets c1 and c2, are all represented in little-endian order. ； Among them, y0~y7 are single-bit elements that constitute the 8-bit output, together forming the 8-bit output of the SM4 S-box. In little-endian order, the 8-bit output consists of {y7, y6, y5, y4, y3, y2, y1, y0} from the most significant bit to the least significant bit. x0~x7 are single-bit elements that together constitute the 8-bit input of the SM4 S-box. In little-endian order, the 8-bit input consists of {x7, x6, x5, x4, x3, x2, x1, x0} from the most significant bit to the least significant bit.

8. The hardware implementation method of SM4 S-box based on redundant tower domain according to claim 2, characterized in that: In step 3, the SM4 S-box based on the redundant tower domain is represented as: Formula S of AES S-box AES Substituting the formula for inverting the redundant tower domain Inv(x) into the relationship between the SM4 S-box and the AES S-box, the multiple affine matrices are merged as follows: ； make ; The SM4 S-box formula based on the redundant tower domain is obtained as follows: ； Among them, S SM4 Let S represent the S-box of the SM4 algorithm, F1 represent the pre-affine transformation, F2 represent the post-affine transformation, E1 represent the pre-constant offset, and E2 represent the post-constant offset.

Images