SM4 encryption and decryption key generation hardware design method based on shared state machine

Abstract

The invention discloses an SM4 encryption and decryption key generation hardware design method based on a shared state machine, the encryption key generation process and the decryption key generation process are combined, all data paths are shared, a part of the state machine is shared, the state machine takes K0, K1, K2 and K3 as main key input during encryption, and takes K35, K34, K33 and K32 as main key input during decryption, so that the encryption key generation process and the decryption key generation process are integrated. The generation of the decryption key can be completed by only 32 cycles when the key does not need to be updated, so that the number of cycles required by the generation of the decryption round key is reduced. The customized state machine optimizes the decryption key generation process through state jump, and ensures the correctness of the generated encryption round key and decryption round key through control of a control signal. The method is used for generating an SM4 encryption and decryption key, and the period number of generation of the decryption key is reduced by 50% when the key is not changed. And the number of registers and combinatorial logics required by generation of encryption and decryption keys is reduced.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of information security, and particularly relates to a hardware design method for SM4 encryption and decryption key generation based on a shared state machine. BACKGROUND

[0002] The SM4 algorithm was first published in 2006, became a cryptographic industry standard (standard number: GM / T 0002-2012) in March 2012, and was converted into a national standard in August 2016. In 2018, it was included in the ISO / IEC international standard (ISO / IEC 18033-3:2010 / AMD1:2018), becoming the first Chinese block cipher algorithm to enter the international standard. In the promotion and application stage, the domestic cryptographic transformation project is implemented in key fields such as finance, government affairs, and energy, and key information infrastructure uses commercial cipher algorithms such as SM4.

[0003] SM4 is a block cipher algorithm with a block length of 128 bits, which adopts a four-branch generalized unbalanced Feistel structure and includes encryption and decryption and key generation. The encryption and decryption round function structures are the same, and the only difference is that the input of decryption is the output of encryption, and the order of the round keys used is opposite to that of encryption.

[0004] The encryption and decryption round function structures are the same, but the order of the round keys used is opposite. In hardware implementation, if a single round function is completed in one cycle, then for encryption round key generation, round keys 1 to 32 need to be generated in sequence, which requires 32 cycles; and for decryption round key generation, the usual practice is to first calculate and sequentially store round keys 1 to 32, and then output the decryption required round keys 32 to 1 in sequence, which requires a total of 64 cycles. This process makes the number of decryption round key generation cycles twice that of encryption round key generation cycles, and this doubling of the cycle number directly reduces the SM4 decryption throughput by half, causing a huge impact on performance. At the same time, the additional 32 32-bit registers required for key storage also increase resource consumption. SUMMARY

[0005] The technical problem solved by the present application is to provide a hardware design method for SM4 encryption and decryption key generation based on a shared state machine, which reduces the number of cycles required for key storage by designing a key generation sharing based on state machine reuse, and reduces the number of decryption key cycles to 32 cycles when the decryption key is constant, reducing the number of cycles by 50%.

[0006] Technical solution: In order to solve the above technical problems, the technical solution adopted by the present application is as follows:

[0007] A hardware design method of SM4 encryption and decryption key generation based on shared state machine, which combines encryption key generation and decryption key generation process, shares all data paths, and shares part of the state machine, which inputs K0, K1, K2 and K3 as the main key during encryption, and inputs K 35 , K 34 , K 33 and K 32 as the main key during decryption.

[0008] Further, during encryption, the encryption key generation formula is as follows:

[0009] ;

[0010] Wherein, MK represents a 128-bit input main key; FK represents a 128-bit system parameter in SM4 standard; r represents a round number; K r r represents a 32-bit rth round encryption round key; A1 and B1 are 32-bit intermediate variables; a0-a3 are 8-bit intermediate variables; τ represents a nonlinear function; L(B1) represents a linear transformation with B1 as input; Sbox(a0)-Sbox(a3) are S-box functions; ck i represents a 32-bit fixed parameter in SM4 standard; rk r represents an rth round encryption round key, and K i represents an input or output key.

[0011] Further, during decryption, the decryption round key generation formula is as follows:

[0012] Under the condition that K 35 , K 34 , K 33 and K 32 are known, the decryption round function can be expressed as:

[0013] ;

[0014] Wherein, A2 and B2 are 32-bit intermediate variables, and L(B2) represents a linear transformation with B2 as input. rk 31-r and K 31-r represent 32-bit 31-rth round encryption round keys, which are used as rth round decryption keys.

[0015] Further, the SM4 encryption and decryption key generator includes a data path, an output round key value and a customized state machine.

[0016] Further, the data path refers to calculating next_K3 through the combinational logic, and the output round key value is assignRK=K3, and RK represents the round key output of the SM4 algorithm.

[0017] Further, the customized state machine includes state machine jump, combinational logic assignment of next state NS, timing logic output K0, K1, K2, K3 and K 35 , K 34 , K 33 , K 32 of the state machine, timing logic output flag1 of the state machine, control signal, combinational logic output constant ck of the state machine, and combinational logic output key_out_valid output valid signal of the state machine.

[0018] Further, the state jump of the customized state machine during encryption: during the encryption round key generation process, it is determined that flag=0; when reset, the state machine is in the initial state S0, load_key=0, the current state is maintained, and when load_key=1, the state S1 is entered; then, the S2 state, the S3 state,..., and the S33 state are sequentially executed; when the S33 state, the key_out_valid=1 is output, at this time, the number of decryption periods is 32, the encryption valid signal flag is valid, and the jump is to S0, and the state machine execution process of the next encryption round key generation is entered.

[0019] Further, the state jump of the customized state machine during decryption:

[0020] The decryption round key generation includes the first key valid, and then the key is unchanged, and only the plaintext valid signal load_data is given, and the K 35 , K 34 , K 33 and K 32 generated before are reused, and the decryption round key generation needs 32 periods.

[0021] Further, if only the first decryption round key generation process is valid, that is, load_key=1, and the decryption round key generation process is not valid, that is, load_key=0, only load_data=1 is needed; at state 34, load_key=0, load_data=1 is waited, jump to state S35, then S35, S36, S37, S38 are sequentially executed, jump to S5 at state S38, and then S6 state, S7 state,..., and S33 state are sequentially executed. At the S33 state, the key_out_valid=1 is output, at this time, the number of decryption periods is 32.

[0022] Advantages: compared with the prior art, the present application has the following advantages:

[0023] (1) The application supports encryption and decryption dual-mode operation, and customizes the state machine to optimize the decryption key generation process through state jumping, and controls the correctness of the generated encryption round key and decryption round key through the control signal flag1.

[0024] (2) The advantage of the application is that the SM4 encryption and decryption key generation can be used to reduce the number of decryption key generation cycles by 50% when the key is unchanged.

[0025] (3) The application reduces the number of registers and combinational logic required for encryption and decryption key generation. On Kintex7, Virtex6, Spartan6 devices, the number of flip-flops FF is reduced by 77.42%, and the number of lookup tables LUT is reduced by about 14%; on Spartan3 devices, the number of flip-flops FF is reduced by 78.03%, and the number of lookup tables LUT is reduced by 9.30%.

[0026] (4) The application increases the throughput of encryption and decryption key generation. On Kintex7, Virtex6, Spartan6 devices, the throughput is increased by about 23%-24%, and on Spartan3 devices, the throughput is increased by 76.95%. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 is a schematic diagram of the hardware design method of SM4 encryption and decryption key generation based on shared state machine. DETAILED DESCRIPTION

[0028] The application will be further illustrated below in conjunction with specific embodiments, which are implemented on the premise of the technical solutions of the application, and it should be understood that these embodiments are only used to illustrate the application and not to limit the scope of the application.

[0029] The hardware design method of SM4 encryption and decryption key generation based on shared state machine of the embodiment, aiming at the problem of too many cycles and storage units required by the SM4 encryption and decryption key generator in the prior art, proposes an SM4 encryption and decryption key generator and a key generation method.

[0030] The application combines encryption key generation and decryption key generation processes, shares all data paths, and shares part of the state machine. The state machine inputs K0, K1, K2, and K3 as the main key when encrypting, and inputs K 35 , K 34 , K 33 , and K 32 as the main key when decrypting. The decryption key generation can be completed in only 32 cycles without updating the key, thereby reducing the number of cycles required for decryption round key generation.

[0031] First, in encryption, the encryption key generation formula used is as follows:

[0032]

[0033] wherein MK represents a 128-bit input master key, FK represents a 128-bit system parameter in the SM4 standard, r represents a round number, K r r represents a 32-bit r-th round encryption round key, A1 and B1 are 32-bit intermediate variables; a0-a3 are 8-bit intermediate variables; τ represents a nonlinear function; L(B1) represents a linear transformation with B1 as input; Sbox(a0)-Sbox(a3) represent S-box functions; ck i represents a 32-bit fixed parameter in the SM4 standard; and rk r represents an r-th round encryption round key.

[0034] Second, in decryption, the decryption round key generation formula used is as follows:

[0035] Under the condition that K 35 , K 34 , K 33 , and K 32 are known, the decryption round function can be expressed as:

[0036]

[0037] wherein A2 and B2 are 32-bit intermediate variables, and L(B2) represents a linear transformation with B2 as input; rk 31-r and K 31-r represent 32-bit 31-r-th round encryption round keys, which are used as r-th round decryption keys.

[0038] It can be seen that the four operations of the 32-round cyclic iteration function for encryption and decryption round key generation, i.e., four-input XOR, nonlinear function τ, linear function L1, and two-input XOR, are all the same, and the difference lies in different inputs.

[0039] The encryption and decryption key generator of SM4 includes a data path, output round key value taking, and a customized state machine.

[0040] The output round key value taking is assign RK=K3, and RK represents the round key output of the SM4 algorithm.

[0041] The customized state machine needs a total of 39 states from S0 to S38. Through state machine jumping, the combination logic assignment of next state NS, the timing logic output of the state machine, K0, K1, K2, K3, and K 35 , K 34 , K 33 , and K32 The state machine's sequential logic outputs flag1 (control signal), the state machine's combinational logic outputs the constant ck, and the state machine's combinational logic outputs key_out_valid (valid signal).

[0042] State machine transition: CS represents the current state, and NS represents the next state. Upon reset, CS is set to 0; otherwise, NS is assigned to CS at the clock edge.

[0043] The combinational logic assignment for the next state NS is as follows: When CS is the initial state S0, if flag==0 and flag1==0, NS jumps to state S1; otherwise, it remains in the current state. When CS is in state S1, state S2 to state S32, NS jumps to the current state CS+1. When CS is in state S33, if flag=1, NS jumps to S0; if flag=0 and flag1=1, NS jumps to S35; otherwise, it jumps to state S34. When CS is in state 34, if load_key=1, NS jumps to state S1; if load_data=1, it jumps to state S35; otherwise, it remains in the current state. When CS is in state 35, state 36, and state 37, NS jumps to the current state CS+1. When CS is in state 38, NS jumps to state S5. When CS is in default, NS jumps to state S0.

[0044] The state machine's sequential logic outputs K0, K1, K2, and K3. When CS is in states S0 and S34, the value of the master key XORed with MK is used as the initial value of K0, K1, K2, and K3, i.e., {K0, K1, K2, K3} <= key^MK. When CS is in states S1 to S32, the values ​​of K0, K1, K2, and K3 are updated, i.e., {K0, K1, K2, K3} <= {K1, K2, K3, next_K3}, where next_K3 is the next round key calculated by combinational logic. When CS is in state S35, K0... 35 Assign the value to K3; in state S36, set K... 34 Assign the value to K3, and set K 35 Assign the value to K0; when CS is in state S37, set K... 33 Assign the value to K3, and set K 34 Assign the value to K1, and K 35 Assign the value to K0; when CS is in state S38, set K... 32 Assign the value to K3, and set K 33 Assign the value to K2, and K 34 Assign the value to K1, and K 35 Assign the value to K0. In fact, when executing states S35 to S38, K is... 35 K34 K 33 K 32 As the initial round key for decryption, and one is used in each cycle, after the initial round key for decryption is assigned, the process enters states 5 to 32, and a decryption round key can be obtained in each cycle.

[0045] The other set of sequential logic outputs K of the state machine 35 K 34 K 33 K 32 When CS is in state 33, if flag1=0, then K3, K2, K1, and K0 are respectively set as K. 35 K 34 K 33 K 32 The value of K is set to 0 if CS is otherwise unchanged; when CS is in other states, K remains unchanged. 35 K 34 K 33 K 32 Hold. This logic output indicates that, in state 33, the true K will be... 35 K 34 K 33 K 32 Once assigned a value, it remains unchanged. During decryption, if the master key remains the same, K can be used directly. 35 K 34 K 33 K 32 As initial values.

[0046] The state machine also outputs another sequential logic output, flag1, as a control signal. When CS is in state S0, flag1 is set to 0; when CS is in state 33, flag1 is set to 1; and flag1 remains unchanged in other states.

[0047] The combinational logic output constant ck of the state machine. This embodiment provides a list showing the output constant ck of CS in different states. i The value of is assigned to ck. i This represents the constant value required to calculate the key for the i-th encryption round. When flag1=0, the encryption round key is calculated from the initial encryption round key, and ck0 to ck0 are given sequentially from state S1 to state S32. 31 The values ​​are assigned to ck sequentially, and a new next_K3 can be calculated and assigned to obtain the new K3. When flag1=1, the decryption round key is calculated from the initial decryption round key, and ck is given sequentially from state S5 to state S32. 31 Up to ck4, values ​​are sequentially assigned to ck, and a new next_K3 can be calculated and assigned to obtain the new K3. In other states, ck defaults to ck0.

[0048] Table 1 ck i hexadecimal value

[0049]

[0050] Table 2. Selected ck under different states and flag1 signal. i value

[0051] The other combinational logic output of the state machine, key_out_valid, outputs a valid signal. When CS is in state 0, 1, 34, or 35, key_out_valid is 0; when CS is in other states, if flag=1, then key_out_valid=1; otherwise, key_out_valid=flag1.

[0052] Table 3 SM4 Encryption / Decryption Key Generator Interface

[0053]

[0054] This state machine implements a complete key expansion process, supports dual-mode encryption and decryption operations, optimizes the decryption key generation process through state transitions, and ensures the correctness of the generated encryption round key and decryption round key through the control signal flag1.

[0055] In this embodiment, the design process of the custom state machine for the encryption / decryption key generator is as follows: Figure 1 As shown, when ck takes the value cki, K can be calculated using cki. i+3 The state machine provides the actual calculated and used K4 to K in different states. 35 There are a total of 32 rounds of keys. There are a total of 39 states, from S0 to S38. We provide the state transitions during encryption and decryption.

[0056] State transitions during encryption:

[0057] During the encryption round key generation process, it can be determined that flag=0. Upon reset, the state machine is in the initial state S0, with load_key=0. It maintains the current state and waits for load_key=1 before entering state S1. Then, it sequentially executes states S2, S3, ..., S33. In state S33, it outputs key_out_valid=1, indicating that the decryption cycle count is 32, the encryption valid signal flag is valid, and it jumps back to S0 to enter the state machine execution process for the next encryption round key generation.

[0058] State transition during decryption:

[0059] There are two scenarios for generating the decryption round key: one is that the key is valid every time, meaning K needs to be recalculated each time. 35 K 34 K 33 and K 32 In this scenario, generating the decryption round key requires 64 cycles. Another scenario involves a valid key initially, followed by a unchanged key, where only the plaintext valid signal `load_data` is sent. In this case, the previously generated key can be reused. 35 K 34 K 33 and K 32 The decryption round key generation requires 32 cycles.

[0060] During the first decryption round key generation process, it can be determined that flag=0. Upon reset, the state machine is in the initial state S0, with load_key=1. It maintains the current state and waits for load_key=1 before entering state S1. Then, it sequentially executes states S2, S3, ..., S33. In state S33, the encryption valid signal flag=0 is invalid, and flag1=0, so it jumps to state S35. Then, it sequentially executes states S35, S36, S37, and S38. In state S38, it jumps to S5, and then sequentially executes states S6, S7, ..., S33. In state S33, key_out_valid=1 is output, and the decryption cycle count is 64. When flag=0 and flag1=1, it jumps to state S34. In the waiting state S34, if load_key=1, it jumps to S1; otherwise, if load_data=1, it jumps to S35; otherwise, it maintains the current state.

[0061] If the state machine has a valid key every time, then in state 34 it waits for load_key=1, jumps to S1, and repeats the key generation process of the first decryption round. In this case, the number of decryption cycles is 64 each time.

[0062] If the key is only valid (load_key=1) during the first decryption round key generation process, and is invalid (load_key=0) during subsequent decryption round key generation processes, then only load_data=1 is needed. In state 34, load_key=0, waiting for load_data=1, then jumps to state S35. Afterwards, states S35, S36, S37, and S38 are executed sequentially. In state S38, it jumps back to S5, then states S6, S7, ..., S33 are executed sequentially. In state S33, key_out_valid=1 is output, and the decryption cycle count is 32.

[0063] This invention supports dual-mode operation for encryption and decryption. It optimizes the decryption key generation process through state transitions and uses the control signal flag1 to ensure the correctness of the generated encryption and decryption round keys. The advantage of this invention is that it reduces the number of decryption key generation cycles by 50% when the key remains unchanged, making it suitable for SM4 encryption and decryption key generation. This invention also reduces the number of registers and combinational logic required for encryption and decryption key generation.

[0064] It can be seen that on Kintex7, Virtex6, and Spartan6 devices, the number of flip-flops (FFs) is reduced by 77.42%, and the number of lookup tables (LUTs) is reduced by about 14%; on Spartan3 devices, the number of flip-flops (FFs) is reduced by 78.03%, and the number of lookup tables (LUTs) is reduced by 9.30%.

[0065] This paper reduces the number of key generation and decryption cycles by 50%, increases throughput by approximately 23%-24% on Kintex7, Virtex6, and Spartan6 devices, and increases throughput by 76.95% on Spartan3 devices.

[0066] Table 4. Overall Results of Shared Encryption / Decryption Key Generation

[0067]

[0068] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A hardware design method for generating SM4 encryption / decryption keys based on a shared state machine, characterized in that: The encryption key generation and decryption key generation processes are combined, sharing the entire data path and a portion of the state machine. During encryption, this state machine takes K0, K1, K2, and K3 as the master key input; during decryption, it takes K... 35 K 34 K 33 K 32 As the master key input, the decryption key can be generated in just 32 cycles when no key update is required. The SM4 encryption / decryption key generator includes a data path, output round key value retrieval, and a custom state machine. The custom state machine includes state machine transitions, combinational logic assignment of the next state NS, and sequential logic outputs K0, K1, K2, K3, and K... 35 K 34 K 33 K 32 The sequential logic output flag1 of the state machine, the control signal, the combinational logic output constant ck of the state machine, and the combinational logic output key_out_valid of the state machine are valid signals.

2. The hardware design method for generating SM4 encryption / decryption keys based on a shared state machine according to claim 1, characterized in that: The encryption key is generated using the following formula: ； Where MK represents the 128-bit input master key, FK represents the 128-bit system parameters in the SM4 standard, r represents the round number, and K... r Let represent the 32-bit encryption round key for the r-th round, where A1 and B1 are 32-bit intermediate variables; a0~a3 represent 8-bit intermediate variables respectively; τ represents a nonlinear function; L(B1) represents a linear transformation with input B1; Sbox(a0)~Sbox(a3) represent S-box functions respectively; ck i rk represents a 32-bit fixed parameter in the SM4 standard. r Let K represent the encryption round key for the r-th round. i The key that represents the input or output.

3. The hardware design method for generating SM4 encryption / decryption keys based on a shared state machine according to claim 1, characterized in that: The decryption round key generation formula used during decryption is as follows: Given K 35 K 34 K 33 K 32 In this case, the decryption round function can be expressed as: ； Where A2 and B2 are 32-bit intermediate variables, and L(B2) represents a linear transformation with input B2; rk 31-r and K 31-r This represents the 32-bit encryption key for round 31-r, which is used as the decryption key for round r.

4. The hardware design method for generating SM4 encryption / decryption keys based on a shared state machine according to claim 1, characterized in that: The data path refers to the calculation of next_K3 through combinational logic, and the output round key is assigned RK=K3, where RK represents the round key output of the SM4 algorithm.

5. The hardware design method for generating SM4 encryption / decryption keys based on a shared state machine according to claim 1, characterized in that: Custom state machine encryption state transitions: During the encryption round key generation process, flag=0 is determined; upon reset, the state machine is in the initial state S0, with load_key=0, and maintains the current state, waiting for load_key=1 before entering state S1; then, states S2, S3, ..., S33 are executed sequentially; in state S33, key_out_valid=1 is output, at which point the decryption cycle count is 32, the encryption valid signal flag is valid, and the machine jumps back to S0 to enter the state machine execution process for the next encryption round key generation.

6. The hardware design method for generating SM4 encryption / decryption keys based on a shared state machine according to claim 1, characterized in that: State transitions during custom state machine decryption: Decryption round key generation includes an initial key validity period, after which the key remains unchanged, only sending a plaintext valid signal to load_data, reusing the previously generated K. 35 K 34 K 33 and K 32 The decryption round key generation requires 32 cycles.

7. The hardware design method for generating SM4 encryption / decryption keys based on a shared state machine according to claim 6, characterized in that: If the key is only valid during the first decryption round key generation process (load_key=1), and the key is no longer valid during subsequent decryption round key generation processes (load_key=0), then only load_data=1 is needed; in state 34, load_key=0, waits for load_data=1, jumps to state S35, and then executes S35, S36, S37, and S38 in sequence. In state S38, it jumps to S5, and then executes states S6, S7, ..., S33 in sequence; in state S33, key_out_valid=1 is output, and the decryption cycle count is 32.

Images