A hardware implementation device and method compatible with ascon cryptographic algorithm family

Abstract

The application relates to a hardware implementation device and method compatible with the Ascon algorithm family, and belongs to the fields of digital integrated circuit design optimization and cryptography. The method divides Ascon-128 encryption and decryption, Ascon-128a encryption and decryption, Ascon-hash and Ascon-hash a into four processing stages, namely, initialization processing, related data processing, input data processing and termination processing, and performs pipeline processing on the four processing stages to improve the data throughput rate, improves the hardware deployment efficiency and compatibility of the Ascon algorithm family, and lays a foundation for efficient deployment of the Ascon algorithm in different application scenarios.

Description

TECHNICAL FIELD

[0001] The present application relates to a hardware implementation device and method compatible with the Ascon family of cryptographic algorithms, belonging to the field of digital integrated circuit design optimization and cryptography. BACKGROUND

[0002] With the widespread application of Internet of Things technology, from smart home to industrial monitoring, from implantable medical devices to vehicle systems, countless miniature intelligent terminals are changing people's way of life and work. These devices usually have limited processing power, tight storage space, and limited energy supply, but they are responsible for collecting and transmitting a large amount of sensitive data. If these sensitive data are stolen or tampered with, it may lead to serious consequences. Therefore, a lightweight, efficient and secure encryption scheme is needed.

[0003] Ascon algorithm is a lightweight authentication encryption and hash algorithm developed by a team of cryptographers from Graz University of Technology, Infineon Technologies and Radboud University. Compared with existing algorithms, Ascon provides a more comprehensive solution, supporting authentication encryption and decryption and hash functions, providing comprehensive security for Internet of Things security. The algorithm performs well in security, resource consumption, operation speed, flexibility and compatibility, and is particularly suitable for secure applications in resource-constrained environments.

[0004] The Ascon family of algorithms is mainly composed of the AEAD (Authenticated Encryption with Associated Data) branch and the hash branch. The AEAD branch is an encryption mode that provides both data confidentiality and integrity protection. Its core principle is to achieve this through a nonce-based encryption authentication process; by generating an authentication tag, it ensures that the data has not been tampered with during transmission, mainly ensuring the integrity and confidentiality of data in Internet of Things devices and mobile communications applications. The main algorithms in this branch are Ascon-128 and Ascon-128a. The hash branch generates a fixed-length hash value to ensure data integrity, mainly used in data integrity and identity verification scenarios. The main algorithms in this branch are Ascon-hash and Ascon-hasha.

[0005] Although the Ascon algorithm family has been mature in software algorithm design, the hardware compatibility and design optimization of the algorithm family still need to be supplemented. Safiullah Khan proposed a full-expansion architecture and a round processing architecture to implement the Ascon algorithm family in the article "Scalable and efficient hardware architectures for authenticated encryption in IoT applications[J]. IEEE Internet of Things Journal, 2021, 8(14): 11260-11275." The full-expansion architecture is a single-cycle complete encryption implemented by a combination circuit without intermediate registers, which improves performance. The round processing architecture performs multiple rounds of permutation in a single cycle, dynamically balancing throughput and area, and improving the throughput-area ratio. Although this scheme implements Ascon-128 and Ascon-128a algorithms, the encryption and decryption algorithms are calculated by two independent modules, resulting in additional hardware overhead, and the algorithm is not compatible with the hash branch. SY-NAM TRAN proposed a high-performance, low-latency hardware architecture suitable for the Ascon algorithm in the article "A hardware architecture of NIST lightweight cryptography applied in IPSec to secure high-throughput low-latency IoT networks[J]. IEEE Access, 2023, 11: 89240-89248." and introduced the implementation of the architecture in FPGA and the evaluation method of IPSec ESP protocol. Although this method uses the same module to implement Ascon-128a encryption and decryption modes, it does not implement Ascon-128 and Ascon hash modes.In the article "Asic implementation of ascon lightweight cryptography for iot applications[J]. IEEE Transactions on Circuits and Systems II: Express Briefs, 2024.", NGUYEN K D implements the Ascon encryption algorithm using a RISC-V SoC, achieves a maximum frequency of 294MHz, and first measures the Ascon implementation on a physical chip; this method can implement Ascon-128 encryption and decryption, Ascon-128a encryption and decryption, Ascon-Hash and other 5 modes, but the implementation mode is still a modular design, and the permutation module is called in the module of different operation modes, without optimization and fusion of different algorithms; It will still cause the consumption of additional hardware resources.

[0006] Therefore, the hardware circuit compatible with the two branches of AEAD and hash is of great significance for the efficient deployment of the Ascon algorithm family in Internet of Things devices, so that encryption and decryption algorithms and hash algorithms with different algorithm stages can be implemented on the same hardware circuit, saving the additional overhead introduced during separate design, and supporting different application scenarios.

[0007] However, in fact, although the four algorithm modes of Ascon are based on the same permutation primitive, the number of permutation rounds required by different algorithms, the processing width of the core data block, and the operation process and control logic are completely different; it is necessary to deploy the six different algorithms on the same hardware circuit, which will inevitably require more complex hardware design, consume more computing and storage resources, and increase the hardware circuit area and power consumption; and different algorithms require different control logic, involving the allocation of different hardware resources and the coordination of software resources; the 128-bit wide performance potential in specific modes (such as 128a and ha) cannot be fully utilized, and the compatibility of different algorithms will increase the computational complexity and the consumption of hardware resources, thereby reducing the clock frequency and affecting the final performance.

[0008] Therefore, in order to solve the problems existing in the prior art, it is necessary to design a high-efficiency hardware circuit capable of supporting Ascon-128 encryption and decryption, Ascon-128a encryption and decryption, Ascon-hash, and Ascon-hasha. SUMMARY

[0009] In order to realize the good compatibility of the AEAD and hash branches of the Ascon algorithm family in hardware deployment and further promote the efficient hardware deployment of the Ascon algorithm family, the present application provides a hardware implementation device and method compatible with the Ascon algorithm family.

[0010] The first object of the present application is to provide a hardware implementation device compatible with the Ascon family of cryptographic algorithms, comprising an initialization processing module process_initial, a related data processing module process_A, an input data processing module process_I and a finalization processing module process_final.

[0011] Wherein the initialization processing module process_initial, the related data processing module process_A, the input data processing module process_I and the finalization processing module process_final accept a clock signal clk and a reset signal rstn from outside the device; INIT represents the data output after processing by the initialization processing module process_initial, PA_PI represents the data output after processing by the related data processing module process_A, PI_FINAL represents the data output after processing by the input data processing module process_I; FINAL_PI_ready represents that the finalization processing module process_final is idle, PI_PA_ready represents that the input data processing module process_I is idle, PA_INIT_ready represents that the related data processing module process_A is idle.

[0012] The input of the initialization processing module process_initial is an input data valid signal I_valid_input, a mode selection signal I_mode, related data I_data_A, the length of the related data I_length_A, input data I_data_I, the length of the input data I_length_I, an input key I_data_K, a public information code I_data_N, an authentication tag I_data_T, and a ready signal PA_INIT_ready of the related data processing module process_A.

[0013] The output signal of the initialization processing module process_initial is connected with the input of the related data processing module process_A, the output of the initialization processing module process_initial is the output data valid signal INIT_PA_valid of the related data processing module process_A, the mode selection signal INIT_PA_mode of the related data processing module process_A, the key INIT_PA_data_K of the related data processing module process_A, the output state INIT_PA_data_S of the initialization processing module process_initial, the related data INIT_PA_data_A output by the initialization processing module process_initial, the length INIT_PA_length_A of the related data output by the initialization processing module process_initial, the input data INIT_PA_data_I of the related data processing module process_A, the length INIT_PA_length_I of the input data of the related data processing module process_A and the authentication tag INIT_PA_data_T of the input data of the related data processing module process_A.

[0014] The related data processing module process_A receives the signal output from the initialization processing module process_initial and the ready signal PI_PA_ready of the input data processing module process_I, and outputs the valid signal PA_PI_valid for the input data processing module process_I, the mode selection signal PA_PI_mode of the input data processing module process_I, the key PA_PI_data_K of the input data processing module process_I, the output state PA_PI_data_S of the related data processing module process_A, the input data PA_PI_data_I of the input data processing module process_I, the length PA_PI_length_I of the input data of the input data processing module process_I and the tag input data PA_PI_data_T of the input data processing module process_I;

[0015] The input of the input data processing module process_I is the output of the correlation data processing module process_A and the ready signal FINAL_PI_ready output by the finalization processing module process_final; the output is the output valid signal PI_FINAL_valid of the finalization processing module process_final, the mode selection signal PI_FINAL_mode of the finalization processing module process_final, the key PI_FINAL_data_K of the finalization processing module process_final, the output state PI_FINAL_data_S of the input data processing module process_I, the output data block PI_FINAL_data_O of the input data processing module process_I, the output data block length PI_FINAL_length_O of the input data processing module process_I, and the output tag PI_FINAL_data_T of the input data processing module process_I.

[0016] The input of the finalization processing module process_final is the output of the input data processing module process_I, and the output is the top-level Ascon_top output valid signal O_valid_output, the top-level Ascon_top output data O_data_O, the length O_length_O of the top-level Ascon_top output data, and the output tag O_data_T of the top-level Ascon_top output data.

[0017] The initialization processing module process_initial is used for performing an or operation on the input key I_data_K, the algorithm feature IV, and the public information code I_data_N in the authentication encryption and decryption mode, then performing a round of permutation operation on the or operation result, and then performing a bitwise exclusive or operation with the key padding_data_K after the 0 padding to obtain the initialization processing module process_initial output state INIT_PA_data_S; in the hash mode, the pre-computation optimization technology is combined to assign the result obtained after the pre-computation optimization to the initialization processing module process_initial output state INIT_PA_data_S;

[0018] The related data processing module process_A is used for data block segmentation on the related data INIT_PA_data_A output by the initialization processing module process_initial, and the number of long bits is supplemented to be a multiple of r, and the data block length is r; when the length of the related data INIT_PA_data_A output by the initialization processing module process_initial is 0, no long bits need to be supplemented in the encryption and decryption mode, and long bits of r need to be supplemented in the hash mode; then, the output state INIT_PA_data_S of the initialization processing module process_initial is subjected to the absorption operation of the related data INIT_PA_data_A output by the initialization processing module process_initial, and finally the output state PA_PI_data_S of the related data processing module process_A is output.

[0019] The input data processing module process_I is used for realizing the plaintext processing of the encryption algorithm, the ciphertext processing of the decryption algorithm and the termination operation of the hash algorithm. First, the input data PA_PI_data_I of the input data processing module process_I of the input data processing module process_I is subjected to the compatible encryption and decryption and the fusion and length supplementing operation of the hash algorithm, then data block segmentation is performed, and finally the data block and the output state PA_PI_data_S of the related data processing module process_A are subjected to b rounds of permutation operation to obtain the output data block PI_FINAL_data_O of the input data processing module process_I and the output state PI_FINAL_data_S of the input data processing module process_I.

[0020] The termination processing module process_final completes the b rounds of permutation operation on the output state PI_FINAL_data_S of the input data processing module process_I in the encryption and decryption mode to obtain the termination state S_FNL, and then the last 128 bits of S_FNL and the last 128 bits of the key PI_FINAL_data_K of the termination processing module process_final of the termination processing module process_final are subjected to exclusive or operation to calculate the output label O_data_T of the top layer Ascon_top output data; in the hash mode, the authentication label is not calculated, and the top layer Ascon_top output data O_data_O is directly output.

[0021] Further, the initialization processing module process_initial includes a permuting operation permu and a pre-stored hash state value; the permuting operation permu is used to perform a permuting operation on the output state INIT_PA_data_S of the initialization processing module process_initial in the authentication encryption / decryption mode, and the pre-stored hash state value is used to assign a corresponding state value to the output state INIT_PA_data_S of the initialization processing module process_initial in the hash mode.

[0022] Further, the correlation data processing module process_A includes a correlation data distribution data_disb_A and a correlation data calculation cal_A; the correlation data distribution data_disb_A is used to perform a padding operation on the received correlation data INIT_PA_data_A output by the initialization processing module process_initial and divide the correlation data into a plurality of data blocks, which are sequentially output to the correlation data calculation cal_A in the order of high bits to low bits for calculation; and the correlation data calculation cal_A is used to perform an exclusive OR and permuting operation on the data blocks divided by the correlation data distribution data_disb_A after receiving the output state INIT_PA_data_S of the initialization processing module process_initial, so as to obtain an output state PA_PI_data_S of the correlation data processing module process_A.

[0023] Further, the input data processing module process_I includes an input data distribution data_disb_I and an input data calculation cal_I; the input data distribution data_disb_I is used to perform a padding operation on the received input data PA_PI_data_I of the input data processing module process_I and divide the input data into a plurality of data blocks, which are sequentially output to the input data calculation cal_I in the order of high bits to low bits for calculation; and the input data calculation cal_I is used to perform an exclusive OR and permuting operation on the data blocks transmitted by the input data distribution data_disb_I after receiving the output state PA_PI_data_S of the correlation data processing module process_A, so as to generate an output state PI_FINAL_data_S of the input data processing module process_I and an output data block PI_FINAL_data_O of the input data processing module process_I.

[0024] Further, the termination processing module process_final receives the output state PI_FINAL_data_S of the input data processing module process_I, then performs a round of permutation operation on the output state PI_FINAL_data_S of the input data processing module process_I to obtain a termination state S_FNL, and then calculates the output label O_data_T of the top layer Ascon_top output data by performing XOR operation on the last 128 bits of S_FNL and the last 128 bits of the key PI_FINAL_data_K of the termination processing module process_final; in the hash mode, no authentication label is calculated, and the top layer Ascon_top output data O_data_O is directly output.

[0025] A second object of the present application is to provide a method for implementing a hardware device compatible with the Ascon family of cryptographic algorithms, the method comprising:

[0026] (1) The input of the device is a mode selection signal I_mode, an input key I_data_K, a public information code I_data_N, related data I_data_A and the length I_length_A thereof, input data I_data_I and the length I_length_I thereof. The initialization processing module process_initial performs corresponding operations according to the mode selection signal I_mode;

[0027] If it is the encryption and decryption mode, 12 rounds of permutation operation are performed on data_S_init to obtain the output state INIT_PA_data_S of the initialization processing module process_initial;

[0028] If it is the hash mode, the state value stored in the hardware in advance is assigned to the output state INIT_PA_data_S of the initialization processing module process_initial.

[0029] (2) Then, the related data processing module process_A performs calculation on the related data INIT_PA_data_A output by the initialization processing module process_initial and the output state INIT_PA_data_S of the initialization processing module process_initial, and generates the output state PA_PI_data_S of the related data processing module process_A, the related data processing module comprising a related data distribution data_disb_A and a related data calculation cal_A;

[0030] The related data distribution data_disb_A performs padding operation on the received related data INIT_PA_data_A output by the initialization processing module process_initial and divides the related data into a plurality of data blocks A1, A2,..., A s , and outputs the data blocks to the related data calculation cal_A in order from high bit to low bit;

[0031] The related data calculation cal_A receives the state INIT_PA_data_S output by the initialization processing module process_initial, performs XOR and permutation operation on the data blocks transmitted by the related data distribution data_disb_A, generates a new state, and calculates the new state with the next round of related data blocks until the last data block is calculated, and outputs the output state PA_PI_data_S of the related data processing module process_A.

[0032] (3) Then, the input data processing module process_I is used to receive the input data PA_PI_data_I of the input data processing module process_I and the output state PA_PI_data_S of the related data processing module process_A for calculation, generate the output state PI_FINAL_data_S of the processed input data processing module process_I and the output data block PI_FINAL_data_O of the input data processing module process_I without shift processing, and temporarily store the received K and mode, and output all data to the next stage after the processing is completed. The input data processing module includes an input data distribution data_disb_I and an input data calculation cal_I;

[0033] The input data distribution data_disb_I performs padding operation on the received input data PA_PI_data_I of the input data processing module process_I and divides the input data into a plurality of data blocks I1, I2,..., I s , and outputs the data blocks to the input data calculation cal_I in order from high bit to low bit;

[0034] The role of the input data calculation cal_I is to receive the output state PA_PI_data_S of the relevant data processing module process_A, perform XOR and permutation operations with the relevant data block transmitted by the input data distribution data_disb_I, generate a new state and an output data block PI_FINAL_data_O of the input data processing module process_I, and perform calculation on the generated new state and the input data block of the next round until the last data block is calculated. The output state PI_FINAL_data_S of the input data processing module process_I and the output data block PI_FINAL_data_O of the input data processing module process_I are output.

[0035] (4) Finally, the termination processing module process_final receives the output state PI_FINAL_data_S of the input data processing module process_I and the output data block PI_FINAL_data_O of the input data processing module process_I. The termination processing module process_final first performs a shift operation on the output data block PI_FINAL_data_O of the input data processing module process_I until the valid data of the output data block PI_FINAL_data_O of the input data processing module process_I is shifted to the lowest bit of the register to obtain the output data O_data_O of the top layer Ascon_top.

[0036] In the hash mode, the termination processing module process_final only outputs the output data O_data_O of the top layer Ascon_top.

[0037] In the encryption mode, the termination processing module process_final performs bitwise XOR on the input output state PI_FINAL_data_S of the input data processing module process_I and the padding_data_K, and then performs 12 rounds of permutation to form a new state S_FNL. The lowest 128 bits of the generated S_FNL are XORed with the key PI_FINAL_data_K of the termination processing module process_final to generate the output label O_data_T of the output data of the top layer Ascon_top. Finally, the termination processing module process_final outputs the output data O_data_O of the top layer Ascon_top and the output label O_data_T of the output data of the top layer Ascon_top.

[0038] In the decryption mode, the termination processing module process_final will perform bitwise XOR operation on the input data processing module process_I output state PI_FINAL_data_S and padding_data_K, and then perform 12 rounds of permutation to form a new state S_FNL, and then perform bitwise XOR operation on the lowest 128 bits of the generated S_FNL and the key PI_FINAL_data_K of the termination processing module process_final to generate the output label O_data_T of the output data of the top Ascon_top; the termination processing module process_final will compare whether the output label O_data_T of the output data of the top Ascon_top and the output label PI_FINAL_data_T of the input data processing module process_I are consistent, and if consistent, the value of the output data O_data_O is output, and if inconsistent, -1 is output.

[0039] The present application has the following advantages:

[0040] The application discloses a hardware implementation device and method compatible with Ascon cryptographic algorithm family, by analyzing the initialization stages of Ascon-128 encryption and decryption, Ascon-128a encryption and decryption, Ascon-hash, Ascon-hasha, and combining with pre-computation optimization technology, the different initialization stages of these algorithms are converted into unified initialization processing; then, through padding and segmentation of related data I_data_A (the same padding operation is performed on data A with a data length not being 0 in different modes), the fusion of the associated data processing stage of the encryption and decryption algorithm and the absorption information stage of the hash algorithm is completed; then, through fusion padding operation on input data I_data_I, the fusion and unification of the plaintext processing of the encryption algorithm, the ciphertext processing of the decryption algorithm and the termination processing of the hash algorithm are realized; finally, the termination processing module completes the termination output of the encryption and decryption algorithm and the hash algorithm according to different mode information. The six algorithms are uniformly divided into four processing stages: initialization processing, related data processing, input data processing and termination processing; each processing stage supports different processing stages of the encryption and decryption algorithm and the hash algorithm, and the four processing stages are processed in pipeline to improve the data throughput rate; the hardware deployment efficiency and compatibility of the Ascon algorithm family are improved, and the foundation for efficient deployment of the Ascon algorithm in different application scenarios is laid. BRIEF DESCRIPTION OF DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description only constitute some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort based on these drawings.

[0042] Figure 1 A top-level architecture schematic diagram of a hardware implementation device compatible with the Ascon family of cryptographic algorithms is provided in the present application.

[0043] Figure 2 A hardware pipeline schematic diagram of a hardware implementation device compatible with the Ascon family of cryptographic algorithms is provided in the present application.

[0044] Figure 3 A mode and algorithm comparison schematic diagram of a hardware implementation device and method compatible with the Ascon family of cryptographic algorithms is provided in the present application.

[0045] Figure 4 A hash mode pre-computation state value schematic diagram in a hardware implementation device and method compatible with the Ascon family of cryptographic algorithms is provided in the present application.

[0046] Figure 5 A permutation operation permu structure diagram in a hardware implementation device and method compatible with the Ascon family of cryptographic algorithms is provided in the present application.

[0047] Figure 6 A process_initial structure diagram of an initialization processing module in a hardware implementation device compatible with the Ascon family of cryptographic algorithms is provided in the present application.

[0048] Figure 7 A process_A structure diagram of a related data processing module in a hardware implementation device compatible with the Ascon family of cryptographic algorithms is provided in the present application.

[0049] Figure 8 A data_disb_A shift register shift output flowchart diagram of related data distribution in a hardware implementation device and method compatible with the Ascon family of cryptographic algorithms is provided in the present application.

[0050] Figure 9 A process_I structure diagram of an input data processing module in a hardware implementation device compatible with the Ascon family of cryptographic algorithms is provided in the present application.

[0051] Figure 10 A process_final structure diagram of a termination processing module in a hardware implementation device compatible with the Ascon family of cryptographic algorithms is provided in the present application. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0053] Example 1

[0054] This embodiment provides a hardware implementation device compatible with the Ascon cryptographic algorithm family, such as... Figure 1 As shown, the device includes an initialization processing module process_initial, a related data processing module process_A, an input data processing module process_I, and a termination processing module process_final;

[0055] The initialization module `process_initial`, the related data processing module `process_A`, the input data processing module `process_I`, and the termination module `process_final` receive clock signals `clk` and reset signals `rstn` from outside the device. `INIT` represents the data processed and output by the initialization module `process_initial`, `PA_PI` represents the data processed and output by the related data processing module `process_A`, and `PI_FINAL` represents the data processed and output by the input data processing module `process_I`. `FINAL_PI_ready` indicates that the termination module `process_final` is idle, `PI_PA_ready` indicates that the input data processing module `process_I` is idle, and `PA_INIT_ready` indicates that the related data processing module `process_A` is idle.

[0056] The inputs to the initialization module process_initial are the input data validity signal I_valid_input, the mode selection signal I_mode, the related data I_data_A and its length I_length_A, the input data I_data_I and its length I_length_I, the input key I_data_K, the public information code I_data_N, the authentication tag I_data_T, and the ready signal PA_INIT_ready from the related data processing module process_A. Among them, the mode selection signal I_mode is a 6-bit wide one-hot code signal that indicates the mode for executing the Ascon algorithm.

[0057] The output signal of the initialization processing module process_initial is connected with the input of the related data processing module process_A, the output of the initialization processing module process_initial is the output data valid signal INIT_PA_valid of the related data processing module process_A, the mode selection signal INIT_PA_mode of the related data processing module process_A, the key INIT_PA_data_K of the related data processing module process_A, the output state INIT_PA_data_S of the initialization processing module process_initial, the related data INIT_PA_data_A output by the initialization processing module process_initial, the length INIT_PA_length_A of the related data output by the initialization processing module process_initial, the input data INIT_PA_data_I of the related data processing module process_A, the length INIT_PA_length_I of the input data of the related data processing module process_A and the authentication tag INIT_PA_data_T of the input data of the related data processing module process_A.

[0058] The related data processing module process_A receives the signal output from the initialization processing module process_initial and the ready signal PI_PA_ready of the input data processing module process_I, and outputs the valid signal PA_PI_valid for the input data processing module process_I, the mode selection signal PA_PI_mode of the input data processing module process_I, the key PA_PI_data_K of the input data processing module process_I, the output state PA_PI_data_S of the related data processing module process_A, the input data PA_PI_data_I of the input data processing module process_I, the length PA_PI_length_I of the input data of the input data processing module process_I and the tag input data PA_PI_data_T of the input data processing module process_I;

[0059] The input of the input data processing module process_I is the output of the correlation data processing module process_A and the ready signal FINAL_PI_ready output by the finalization processing module process_final; the output is the output valid signal PI_FINAL_valid of the finalization processing module process_final, the mode selection signal PI_FINAL_mode of the finalization processing module process_final, the key PI_FINAL_data_K of the finalization processing module process_final, the output state PI_FINAL_data_S of the input data processing module process_I, the output data block PI_FINAL_data_O of the input data processing module process_I, the output data block length PI_FINAL_length_O of the input data processing module process_I, and the output tag PI_FINAL_data_T of the input data processing module process_I.

[0060] The input of the finalization processing module process_final is the output of the input data processing module process_I, and the output is the top-level Ascon_top output valid signal O_valid_output, the top-level Ascon_top output data O_data_O, the length O_length_O of the top-level Ascon_top output data, and the output tag O_data_T of the top-level Ascon_top output data.

[0061] The structure of the initialization processing module process_initial is shown in Figure 6 The permu is used to perform an or operation on the input key I_data_K, the algorithm feature IV, and the public information code I_data_N, and then perform an a-round permutation operation on the or operation result, and then perform a bitwise exclusive or operation with the key padding_data_K after 0 padding to obtain the initialization processing module process_initial output state INIT_PA_data_S; the pre-stored hash state value is used in the hash mode to combine the pre-computed optimization technology, and the result obtained after pre-computed optimization is assigned to the initialization processing module process_initial output state INIT_PA_data_S.

[0062] The related data processing module process_A is used for data block segmentation of the related data INIT_PA_data_A output by the initialization processing module process_initial, and padding of the number of long bits to be a multiple of r, and the data block length is r; when the length of the related data INIT_PA_data_A output by the initialization processing module process_initial is 0, no padding is needed in the encryption and decryption mode, and padding of r bits of data block is needed in the hash mode; then, the output state INIT_PA_data_S of the initialization processing module process_initial is subjected to the absorption operation of the related data INIT_PA_data_A output by the initialization processing module process_initial, and finally the output state PA_PI_data_S of the related data processing module process_A is output.

[0063] The structure of the related data processing module process_A is shown in Figure 7 The related data processing module process_A is used for data block segmentation of the related data INIT_PA_data_A output by the initialization processing module process_initial, and padding of the number of long bits to be a multiple of r, and the data block length is r; when the length of the related data INIT_PA_data_A output by the initialization processing module process_initial is 0, no padding is needed in the encryption and decryption mode, and padding of r bits of data block is needed in the hash mode; then, the output state INIT_PA_data_S of the initialization processing module process_initial is subjected to the absorption operation of the related data INIT_PA_data_A output by the initialization processing module process_initial, and finally the output state PA_PI_data_S of the related data processing module process_A is output.

[0064] The input data processing module process_I is used for implementing plaintext processing of an encryption algorithm, ciphertext processing of a decryption algorithm and termination operation of a hash algorithm. Firstly, the input data PA_PI_data_I of the input data processing module process_I is subjected to compatible encryption and decryption and fusion padding operation of a hash algorithm, then data block segmentation is performed, and finally b rounds of permutation operation are performed on the data block and the output state PA_PI_data_S of the related data processing module process_A to obtain the output data block PI_FINAL_data_O of the input data processing module process_I and the output state PI_FINAL_data_S of the input data processing module process_I.

[0065] The structure of the input data processing module process_I is shown in Figure 9 The input data distribution data_disb_I is used to pad the received input data I and divide it into multiple data blocks, which are output in sequence from high to low to the input data calculation cal_I for calculation. The input data calculation cal_I performs XOR and permutation operations on the data blocks transmitted by the input data distribution data_disb_I and the relevant data processing output state S_A transmitted by the relevant data processing module, to generate the input data processing state S_I and the output data O data block. The generation O_ready_process_I is used to generate the idle signal PI_PA_ready of the input data processing module process_I. The register is used to temporarily store the input data of the relevant data processing module process_I.

[0066] The termination processing module process_final receives the output state PI_FINAL_data_S of the input data processing module process_I and the output data block PI_FINAL_data_O of the input data processing module process_I. The input data processing module process_final first performs a shift operation on the output data block PI_FINAL_data_O of the input data processing module process_I, until the valid data of the output data block PI_FINAL_data_O of the input data processing module process_I is shifted to the lowest bit of the register, to obtain the output data O_data_O of the top layer Ascon_top.

[0067] The structure of the termination processing module process_final is shown in Figure 10 The termination processing module process_final first performs a shift operation on the output data block PI_FINAL_data_O of the input data processing module process_I.

[0068] If it is in the hash mode, the result after the shift is directly selected by the selector to the output data block O_data_O.

[0069] If in the encryption mode, the process_final module performs a zero padding operation on the input key PI_FINAL_data_K of the process_final module, then performs a bitwise XOR operation on the result after the zero padding and the output state PI_FINAL_data_S of the input data processing module process_I, and then inputs the result into permu to perform 12 rounds of permutation to form a new state S_FNL, performs a bitwise XOR operation on the lowest 128 bits of the generated S_FNL and the key PI_FINAL_data_K of the process_final module, generates an output tag O_data_T of the top-level Ascon_top output data, and simultaneously merges the output tag O_data_T of the top-level Ascon_top output data and the result after the shifting of the output data block PI_FINAL_data_O of the input data processing module process_I, and outputs the output data O_data_O of the top-level Ascon_top through the selector.

[0070] If in the decryption mode, the process_final module compares whether the output tag O_data_T of the top-level Ascon_top output data and the output tag PI_FINAL_data_T of the input data processing module process_I are consistent, if consistent, selects the result after the shifting through the two-stage selector and outputs the result to the output data block O_data_O, and if inconsistent, outputs -1.

[0071] Embodiment Two

[0072] The embodiment provides a use method of a hardware implementation device compatible with an Ascon cryptographic algorithm family. The method is based on the device implementation described in the embodiment one, and the method comprises the following steps:

[0073] For the Ascon-128 / 128a encryption algorithm, I_data_K, I_data_N, I_data_A, I_length_A, I_data_I and I_length_I correspond to an input key K, a public information code N, a related data value, a length of the related data, a value of plaintext and a length of the plaintext respectively; I_data_T is input as 0; O_data_O and O_length_O represent a value and a length of output ciphertext C respectively; and O_data_T represents a calculated authentication tag value.

[0074] For Ascon-128 / 128a decryption algorithm, I_data_K, I_data_N, I_data_A, I_length_A, I_data_I, I_length_I, I_data_T correspond to the input key K, the value of public information code N, the value of related data A, the effective length of related data A, the value of ciphertext C, the effective length of ciphertext C, and the value of input authentication tag T respectively; O_data_O and O_length_O represent the value and effective length of output plaintext P respectively, and if the input authentication tag does not match the calculated authentication tag, both O_data_O and O_length_O output -1; O_data_T is fixed as 0.

[0075] For Ascon-Hash / Hasha algorithm, I_data_K and I_data_N are both fixed as 0; I_data_A and I_length_A correspond to the value and effective length of input information M respectively; I_data_I is input as 0, and I_length_I is input as 256; O_data_O and O_length_O correspond to the value and effective length of output hash value H respectively; O_data_O is output as 0.

[0076] The inputs in different working modes are as follows:

[0077] When the device is in Ascon-128 encryption mode, the input 6-bit mode selection signal is 6’b000100;

[0078] When the device is in Ascon-128 decryption mode, the input 6-bit mode selection signal is 6’b010000. The algorithm feature IV of Ascon-128 is 80400𝑐0600000000.

[0079] When the device is in Ascon-128a encryption mode, the input 6-bit mode selection signal is 6’b001000;

[0080] When the device is in Ascon-128a decryption mode, the input 6-bit mode selection signal is 6’b100000, and the algorithm feature IV of Ascon-128a is 80800𝑐0800000000.

[0081] When the device is in Ascon-hash mode, the input 6-bit mode selection signal is 6’b000001;

[0082] When the device is in Ascon-hasha mode, the input 6-bit mode selection signal is 6’b000010.

[0083] The data is inputted continuously for 5 times, and the pipeline stage in the device is as shown in Figure 2 FIG. 2, wherein the upper part of the processing module is the input data, and the lower part is the output data. The initialization processing module process_initial receives the input data K, A, I, T, and outputs S, K, A, I, T after processing to the correlation data processing module process_A. The correlation data processing module process_A outputs S, K, I, T after processing to the input data processing module process_I. The input data processing module process_I outputs S, K, O after processing to the termination processing module process_final, and finally outputs O and T. Each processing stage is converted to an idle state after outputting the processing result, and if the input is valid, the next round of input data is processed.

[0084] The mode selection in the device is as shown in Figure 3 FIG. 3, which supports 6 algorithm modes: Ascon-Hash, Ascon-Hasha, Ascon-128 encryption, Ascon-128a encryption, Ascon-128 decryption, and Ascon-128a decryption. Here, the selected mode is represented by a 6-bit one-hot code array m.

[0085] Figure 5 The workflow of the permu permutation operation module in the device is presented. In Ascon-128 encryption and decryption, Ascon-128a encryption and decryption, Hash, and Hasha, 6 rounds, 8 rounds, and 12 rounds of permutation operations are used, each of which includes constant addition operation, S-box substitution operation, and linear diffusion operation. The core module includes the constant addition layer p C , substitution layer p S , and linear diffusion layer p L , and each round of permutation operation needs to process the state S through the permutation core module. The permu controls the number of times of permutation core operation. When mode is 2’b01, the module performs 6 rounds of permutation core operation; when mode is 2’b10, the module performs 8 rounds of permutation core operation; and when mode is 2’b11, the module performs 12 rounds of permutation core operation. For the control signal, the permutation module defines the flag signals pc_flg, ps1_flg, fs2_flg, pl_flg, and flg, as well as the count signal cnt. Among them, pc_flg represents p C the completion signal of the operation, ps1_flg represents p SThe completion signal of the operation, ps2_flg is pulled high one cycle later than ps1_flg, aiming at temporarily storing the state S after the substitution operation, pl_flg indicates p L The completion signal of the operation, flg indicates the signal of the completion of one round of P operation. pc_flg is pulled high when the input or flg signal is detected to be high, ps1_flg is pulled high when the pc_flg signal is detected to be high, ps2_flg is pulled high when the ps1_flg signal is detected to be high, pl_flg is pulled high when the ps2_flg signal is detected to be high, flg is pulled high when the pc_flg, ps1_flg, fs2_flg and pl_flg are all detected to be high, the count signal cnt+1, after being pulled high for 2 cycles, ps1_flg, fs2_flg, pl_flg and flg are pulled low for the next round of operation. When cnt is full of rounds (6 or 8 or 12), the result is output. For the data register signal, three 320-bit registers state, state1 and state2 are defined in the module. When reading data, S is stored in state, and the substitution operation is performed p C When the operation is performed, the constant addition result is stored in state, and the substitution operation is performed p S When the operation is performed, the state state is temporarily stored in state1, and the S-box substitution result is first stored in state2. When pc_flg, ps1_flg and fs2_flg are high and pl_flg is low, the state in state2 is stored in state, and the substitution operation is performed p L When the operation is performed, the diffusion result is directly stored in state. After the substitution operation of all rounds is completed, the output of the state S is performed.

[0086] When the running mode is the hash mode (Ascon-hash, Ascon-hash a), INIT_PA_data_S is assigned to the pre-calculated initialized state value, as shown in Figure 4 These state values are pre-stored in hardware in advance, and INIT_PA_valid is pulled high at the same time, so that the substitution operation is skipped in the hash mode and the state INIT_PA_data_S is directly output.

[0087] When the running mode is the encryption and decryption mode (Ascon-128 encryption and decryption, Ascon-128a encryption and decryption), the data_S_init in the initialization processing module process_initial is assigned the value of IV||I_data_K||I_data_N, and the valid signal valid_S_init is pulled high. The valid_S_init and the data_S_init are input into the permutation module, and after the permutation operation, the permu pulls the data valid signal valid_S_permu high and transmits the data into the data_S_permu. When it is detected that the valid_S_permu is high, the S outputs the result of the bitwise XOR operation of the data_S_permu and the value of the highest bit of K after the value is padded with 0 to 320 bits.

[0088] When the output data of the initialization processing module process_initial is input into the correlation data processing module, as shown in Figure 7 The correlation data distribution data_disb_A first receives the output data valid signal INIT_PA_valid of the correlation data processing module process_A, the correlation data INIT_PA_data_A output by the initialization processing module process_initial, and the length INIT_PA_length_A of the correlation data output by the initialization processing module process_initial, and performs padding and block operation on the correlation data INIT_PA_data_A output by the initialization processing module process_initial. The correlation data distribution data_disb_A performs padding (the padding length is r bit, and here r=64 bit) and data block segmentation operation on the correlation data INIT_PA_data_A output by the initialization processing module process_initial through a shift register, and the principle is as shown in Figure 8As shown, assuming the length of the input related data I_data_A is L, a 1 and several 0s will be padded to the low bits of data A until L is a multiple of r. After L is a multiple of r, the related data A will be left shifted to the highest bit, and then the shift register will perform a left shift of r bits each time to output the data block A_Block. Meanwhile, the register will temporarily store the mode selection signal INIT_PA_mode of the related data processing module process_A, the key INIT_PA_data_K of the related data processing module process_A, the input data INIT_PA_data_I of the related data processing module process_A, the length INIT_PA_length_I of the input data of the related data processing module process_A, and the authentication tag INIT_PA_data_T of the input data of the related data processing module process_A. After the padding and block operation of the related data INIT_PA_data_A output by the initialization processing module process_initial are completed, if it is detected that the related data calculation cal_A is idle (i.e., A_CAL_DISB_ready is high), the block data DISB_CAL_data_A, its valid signal DISB_CAL_valid_A, the last block indication signal DISB_CAL_last_A, and the null data signal DISB_CAL_null_A will be output to the related data calculation cal_A.

[0089] When the output data valid signal INIT_PA_valid of the related data processing module process_A and the ready signal PI_PA_ready of the input data processing module process_I received by cal_A are both high, the output state INIT_PA_data_S of the initialization processing module process_initial and the value of the mode selection signal INIT_PA_mode of the related data processing module process_A will be read. Then, cal_A will perform an exclusive OR and permutation operation on the data block DISB_CAL_data_A segmented by the related data distribution data_disb_A to obtain the related data processing output state PA_PI_data_S and its valid signal PA_PI_valid, and the PA_PI_mode, PA_PI_data_K, PA_PI_data_I, PA_PI_length_I, and PA_PI_data_T temporarily stored in the register will be output to the next stage.

[0090] When the output data of the related data processing module process_A is input to the input data processing module, the input data distribution data_disb_I first receives the valid signal PA_PI_valid of the input data processing module process_I, the input data PA_PI_data_I of the input data processing module process_I and the input data length PA_PI_length_I of the input data processing module process_I, and performs the padding and block operation on the input data PA_PI_data_I of the input data processing module process_I; at the same time, the register temporarily stores the mode selection signal PA_PI_mode of the input data processing module process_I, the key PA_PI_data_K of the input data processing module process_I, the input data length PA_PI_length_I of the input data processing module process_I and the tag input data PA_PI_data_T of the input data processing module process_I in the input data. After the input data distribution data_disb_I completes the padding and block operation on the input data PA_PI_data_I of the input data processing module process_I, if it is detected that the related data calculation cal_I is idle (i.e. I_CAL_DISB_ready is high), the block data DISB_CAL_data_I and its valid signal DISB_CAL_valid_I, the last data block indication signal DISB_CAL_last_I and the null data signal DISB_CAL_null_I are output to the related data calculation cal_I.

[0091] When the valid signal PA PI valid received by cal I for the input data processing module process I and the ready signal FINAL PI ready output by the finalization processing module process final are both high, the values of the output state PA PI data S of the relevant data processing module process A, the mode selection signal PA PI mode of the input data processing module process I, and the input data length PA PI length I of the input data processing module process I are read. Subsequently, cal I performs XOR and permutation operations on the data block DISB CAL data I segmented by the relevant data distribution data disb I to obtain the output state PI FINAL data S of the input data processing module process I, the output valid signal PI FINAL valid for the finalization processing module process final, and the output data block PI FINAL data O of the input data processing module process I. Meanwhile, the mode selection signal PI FINAL mode of the finalization processing module process final, the key PI FINAL data K of the finalization processing module process final, the output data block length PI FINAL length O of the input data processing module process I, and the output tag PI FINAL data T of the input data processing module process I temporarily stored in the register are output to the next stage.

[0092] The finalization processing module process final first performs a shift operation on the incoming output data block PI FINAL data O of the input data processing module process I.

[0093] If in the hash mode, the result after the shift operation is directly selected by the selector Mux and gated to the output data block O data O.

[0094] If in the encryption mode, the termination processing module process_final will first perform the zero padding operation on the input termination processing module process_final key PI_FINAL_data_K, then XOR the result after the zero padding operation with the output state PI_FINAL_data_S of the input data processing module process_I, and then input to permu for 12 rounds of permutation to form a new state S_FNL, XOR the lowest 128 bits of the generated S_FNL with the termination processing module process_final key PI_FINAL_data_K, generate the output label O_data_T of the top layer Ascon_top output data, and simultaneously merge the output label O_data_T of the top layer Ascon_top output data with the result after the shift of the output data block PI_FINAL_data_O of the input data processing module process_I, and output the output data O_data_O of the top layer Ascon_top through the selector.

[0095] If in the decryption mode, the termination processing module process_final compares whether the output label O_data_T of the top layer Ascon_top output data and the output label PI_FINAL_data_T of the input data processing module process_I are consistent, if consistent, then the result after the shift is selected to the output data block O_data_O through the two-stage selector, and if inconsistent, then -1 is output.

[0096] Part of the steps in the embodiments of the present application can be implemented by software, and the corresponding software program can be stored in a readable storage medium, such as an optical disc or a hard disk.

[0097] The above only describes the preferred embodiments of the present application, and is not intended to limit the present application, and any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A hardware implementation device compatible with the Ascon family of cryptographic algorithms, characterized in that, The device comprises an initialization processing module process_initial, a related data processing module process_A, an input data processing module process_I and a finalization processing module process_final; The initialization processing module process_initial, the related data processing module process_A, the input data processing module process_I and the finalization processing module process_final jointly accept a clock signal clk and a reset signal rstn from outside the device; The initialization processing module is used to obtain an initial state in combination with a key and a public information code in an authentication encryption and decryption mode, and then output a state after a permutation operation; In a hash mode, a pre-computation optimization is performed, and a result obtained after the pre-computation optimization is assigned to an output state; The related data processing module is used to perform data block segmentation on related data I_data_A, and perform calculation on the output state and the related data I_data_A, and then output a new state; The input data processing module is used to implement plaintext processing of an encryption algorithm, ciphertext processing of a decryption algorithm and finalization operation of a hash algorithm; The finalization processing module is used to complete a permutation operation on a state output by the input data processing module in an encryption and decryption mode, obtain an output state of the finalization processing module, and finally obtain an authentication tag in combination with the output state of the finalization processing module and a key, and directly output data in a hash mode; The initialization processing module process_initial comprises a permu and a pre-stored hash state value; The permu is used to implement a permutation operation on an output state of the initialization processing module process_initial in an authentication encryption and decryption mode, and the pre-stored hash state value is used to assign a corresponding state value to the output state of the initialization processing module process_initial in a hash mode; The finalization processing module process_final receives an output of the input data processing module process_I, performs a round of permutation operation on the output to obtain an output of the finalization processing module, and performs exclusive OR calculation on the last 128 bits of the output of the finalization processing module and the last 128 bits of a key of the finalization processing module process_final to obtain a final output, In a hash mode, an authentication tag is not calculated, and a final calculation result is directly output.

2. The apparatus of claim 1, wherein, The input of the initialization processing module process_initial is an input data valid signal I_valid_input, a mode selection signal I_mode, related data I_data_A, a length of the related data I_data_A I_length_A, input data I_data_I, a length of the input data I_data_I I_length_I, an input key I_data_K, a public information code I_data_N, an authentication tag I_data_T, and a ready signal PA_INIT_ready of the related data processing module process_A.

3. The apparatus of claim 2, wherein, The related data processing module process_A includes a related data distribution data_disb_A and a related data calculation cal_A. The related data distribution data_disb_A is used for performing a bit padding operation on the output of the initialization processing module process_initial received and dividing the output into a plurality of data blocks, and sequentially outputting the data blocks to the related data calculation cal_A in a high-to-low order for calculation. The related data calculation cal_A performs an exclusive OR and a permutation operation on the data blocks divided by the related data distribution data_disb_A after receiving the output of the initialization processing module process_initial, to obtain the output of the related data processing module process_A.

4. The apparatus of claim 3, wherein, The input data processing module process_I includes an input data distribution data_disb_I and an input data calculation cal_I. The input data distribution data_disb_I is used for performing a bit padding operation on the input of the data processing module process_I and dividing the input into a plurality of data blocks, and sequentially outputting the data blocks to the input data calculation cal_I in a high-to-low order for calculation. The input data calculation cal_I is used for performing an exclusive OR and a permutation operation on the output of the related data processing module process_A and the data blocks input by the input data distribution data_disb_I, to generate the output of the input data processing module process_I.

5. The apparatus of claim 4, wherein, The initialization processing module process_initial, the related data processing module process_A, the input data processing module process_I, and the termination processing module process_final are divided into four pipeline stages. The encryption and decryption mode of the device supports Ascon-128 encryption and decryption and Ascon128a encryption and decryption, and the hash mode supports Ascon-hash and Ascon-hasha.

6. A method of using a hardware implementation device compatible with the Ascon family of cryptographic algorithms, characterized in that, The method is based on the device of any one of claims 1-5.

7. The method of use of claim 6, wherein, The use method includes: Step one: the initialization processing module process_initial performs corresponding operations according to the mode selection signal; If it is an encryption and decryption mode, 12 rounds of permutation operations are performed to obtain the output of the initialization processing module process_initial. If the mode is hash, the state value stored in the hardware in advance is assigned to the output of the initialization processing module process_initial; Step two: the relevant data processing module process_A calculates the data and state output by the initialization processing module process_initial, and generates the output of the relevant data processing module process_A; Step three: the input data processing module process_I calculates the output of the relevant data processing module process_A, generates the output of the processed input data processing module process_I and the output of the input data processing module process_I without shift processing, and temporarily stores the received key and mode, and outputs all data to the next stage after processing is completed; Step four: the termination processing module process_final performs shift operation on the output of the input data processing module process_I until the valid data output by the input data processing module process_I is shifted to the lowest bit of the register, and the final output is obtained.

8. The method of use of claim 7, wherein, In the step two: The correlation data distribution data_disb_A in the correlation data processing module process_A performs a bit padding operation on the output of the initialization processing module process_initial received and divides the data into a plurality of data blocks A1, A2,..., A s , and sequentially outputs them from high bits to low bits to the correlation data calculation cal_A. The relevant data calculation cal_A in the relevant data processing module process_A receives the output of the initialization processing module process_initial, and performs XOR and permutation operation with the data block transmitted by the relevant data distribution data_disb_A, to generate the output state of the temporary relevant data processing module process_A, and the output state of the temporary relevant data processing module process_A is calculated with the relevant data block of the next round until the last data block is calculated, and the output of the relevant data processing module process_A is output; In the step three: The input data distribution data_disb_I in the input data processing module process_I performs a padding operation on the input of the input data processing module process_I and divides it into multiple data blocks I1, I2, …, I s , and sequentially outputs them from high bits to low bits to the input data calculation cal_I; The input data calculation cal_I in the input data processing module process_I performs XOR and permutation operation on the output of the relevant data processing module process_A and the relevant data block transmitted by the input data distribution data_disb_I, to generate the output of the temporary input data processing module process_I, and the output of the temporary input data processing module process_I is calculated with the input data block of the next round until the last data block is calculated, and the output state and data block of the input data processing module process_I are output; In the step four: In the hash mode, the termination processing module process_final only outputs the final data; In the encryption mode, the termination processing module process_final performs bitwise XOR operation on the output of the input data processing module process_I, and then performs 12 rounds of permutation to form a new state, performs bitwise XOR operation on the lowest 128 bits of the new state and the key of the termination processing module process_final, and generates the final output tag, the final output data and the tag; In the decryption mode, the process_final module performs a bitwise XOR operation on the output of the process_I module, and then performs 12 rounds of permutation to form a new state. The lowest 128 bits of the new state are XORed with the key of the process_final module to generate the tag of the final output. The process_final module compares the tag of the final output with the tag of the output of the process_I module. If they are consistent, the value of the output data O_data_O is output. If they are inconsistent, -1 is output.

Images