A shared state machine-based SM4 encryption and decryption key generation hardware design method

Abstract

The application discloses a hardware design method for SM4 encryption and decryption key generation based on a shared state machine, which combines encryption key generation and decryption key generation processes, shares all data paths and shares part of a state machine. 35 , K 34 , K 33 , K 32 as the main key input, and when decryption is performed, K 35 , K 34 , K 33 , K 32 are used as the main key input, so that the generation of the decryption key can be completed in only 32 cycles without the need of updating the key, thereby reducing the number of cycles required for the generation of the decryption round key. The customized state machine optimizes the decryption key generation process through state jumping, and the correctness of the generated encryption round key and decryption round key is ensured through control signals. The hardware design method for SM4 encryption and decryption key generation reduces the number of cycles for the generation of the decryption key when the key is unchanged by 50%. The number of registers and combinational logic required for the encryption and decryption key generation is reduced.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a hardware design method for generating SM4 encryption and decryption keys based on a shared state machine. Background Technology

[0002] The SM4 algorithm was initially released in 2006, became a cryptography industry standard in March 2012 (standard number: GM / T 0002-2012), and was converted into a national standard in August 2016. In 2018, it was incorporated into the ISO / IEC international standard (ISO / IEC 18033-3:2010 / AMD1:2018), becoming the first Chinese block cipher algorithm to be included in an international standard. During the promotion and application phase, domestic cryptographic transformation projects were implemented in key sectors such as finance, government affairs, and energy, and commercial cryptographic algorithms such as SM4 were adopted in critical information infrastructure.

[0003] SM4 is a 128-bit block cipher algorithm that employs a four-branch generalized unbalanced Feistel structure, comprising encryption / decryption and key generation parts. The encryption and decryption round function structures are identical, differing only in that the decryption input is the encryption output, and the round key order is reversed compared to encryption.

[0004] The round function structures for encryption and decryption are the same, but the order of the round keys is reversed. In the hardware implementation, if a single round function completes in one cycle, then for encryption round key generation, generating round keys 1 through 32 sequentially requires 32 cycles; while for decryption round key generation, the usual practice is to first calculate and store round keys 1 through 32 sequentially, and then output the round keys 32 through 1 required for decryption sequentially, which takes a total of 64 cycles. This process makes the number of cycles for generating decryption round keys twice that of encryption round keys, and this doubling of the number of cycles directly halves the throughput of SM4 decryption, having a significant impact on performance. At the same time, key storage requires an additional 32 32-bit registers, which also increases resource consumption. Summary of the Invention

[0005] The technical problem solved by this invention is to provide a hardware design method for generating SM4 encryption and decryption keys based on a shared state machine. This method designs a shared key generation method based on state machine reuse, which reduces the number of cycles required for key storage. When the decryption key remains unchanged, the number of decryption key cycles is reduced to 32 cycles, which is a 50% reduction in the number of cycles.

[0006] Technical Solution: To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0007] A hardware design method for generating SM4 encryption and decryption keys based on a shared state machine combines the encryption and decryption key generation processes, sharing the entire data path and a portion of the state machine. During encryption, the state machine takes K0, K1, K2, and K3 as the master key input; during decryption, it takes K... 35 K 34 K 33 K 32 As the master key input, the decryption key can be generated in just 32 cycles when no key update is required.

[0008] Furthermore, the encryption key generation formula used during encryption is as follows:

[0009] ;

[0010] Where MK represents the 128-bit input master key; FK represents the 128-bit system parameters in the SM4 standard; r represents the round number; K r Let represent the 32-bit encryption round key for the r-th round; A1 and B1 are 32-bit intermediate variables; a0 ~ a3 each represent 8-bit intermediate variables; τ represents a nonlinear function; L(B1) represents a linear transformation with input B1; Sbox(a0) ~ Sbox(a3) each represent an S-box function; ck i rk represents a 32-bit fixed parameter in the SM4 standard. r Let K represent the encryption round key for the r-th round. i The key that represents the input or output.

[0011] Furthermore, the decryption round key generation formula used during decryption is as follows:

[0012] Given K 35 K 34 K 33 K 32 In this case, the decryption round function can be expressed as:

[0013] ;

[0014] Here, A2 and B2 are 32-bit intermediate variables, and L(B2) represents a linear transformation with input B2. 31-r and K 31-r This represents the 32-bit encryption key for round 31-r, which is used as the decryption key for round r.

[0015] Furthermore, the SM4 encryption / decryption key generator includes a data path, an output round key value retrieval mechanism, and a custom state machine.

[0016] Furthermore, the data path refers to the calculation of next_K3 through combinational logic, with the output round key value being assignRK=K3, where RK represents the round key output of the SM4 algorithm.

[0017] Furthermore, the customized state machine includes state machine transitions, combinational logic assignments to the next state NS, and sequential logic outputs K0, K1, K2, K3, and K... 35 K 34 K 33 K 32 The sequential logic output flag1 of the state machine, the control signal, the combinational logic output constant ck of the state machine, and the combinational logic output key_out_valid of the state machine are valid signals.

[0018] Furthermore, the state transitions during encryption using the customized state machine are as follows: During the encryption round key generation process, flag=0 is determined; upon reset, the state machine remains in the initial state S0 with load_key=0, waiting for load_key=1 before entering state S1; then, states S2, S3, ..., S33 are executed sequentially; in state S33, key_out_valid=1 is output, indicating that the decryption cycle count is 32, the encryption valid signal flag is valid, and the machine jumps back to S0 to enter the state machine execution process for the next encryption round key generation.

[0019] Furthermore, the state transitions during custom state machine decryption:

[0020] Decryption round key generation includes an initial key validity period, after which the key remains unchanged, only sending a plaintext valid signal to load_data, reusing the previously generated K. 35 K 34 K 33 and K 32 The decryption round key generation requires 32 cycles.

[0021] Furthermore, if the key is only valid (load_key=1) during the first decryption round key generation process, and is no longer valid (load_key=0) in subsequent decryption round key generation processes, then only load_data=1 is needed; in state 34, load_key=0, waiting for load_data=1, then jumps to state S35, and then executes S35, S36, S37, and S38 in sequence. In state S38, it jumps to S5, and then executes states S6, S7, ..., S33 in sequence. In state S33, key_out_valid=1 is output, and the decryption cycle count is 32.

[0022] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0023] (1) This invention supports dual-mode operation of encryption and decryption. The customized state machine optimizes the decryption key generation process through state transitions, and the correctness of the generated encryption round key and decryption round key is ensured by controlling the flag1 signal.

[0024] (2) The advantage of this invention is that it can be used to generate SM4 encryption and decryption keys, reducing the number of cycles for generating decryption keys when the key remains unchanged by 50%.

[0025] (3) The present invention reduces the number of registers and combinational logic required for encryption and decryption key generation. On Kintex7, Virtex6, and Spartan6 devices, the number of flip-flops (FFs) is reduced by 77.42%, and the number of lookup tables (LUTs) is reduced by about 14%; on Spartan3 devices, the number of flip-flops (FFs) is reduced by 78.03%, and the number of lookup tables (LUTs) is reduced by 9.30%.

[0026] (4) This invention increases the throughput of encryption and decryption key generation. The throughput is increased by about 23%-24% on Kintex7, Virtex6, and Spartan6 devices, and by 76.95% on Spartan3 devices. Attached Figure Description

[0027] Figure 1 This is a schematic diagram of a hardware design method for generating SM4 encryption and decryption keys based on a shared state machine. Detailed Implementation

[0028] The present invention will be further illustrated below with reference to specific embodiments. These embodiments are implemented based on the technical solutions of the present invention, and it should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0029] This embodiment presents a hardware design method for generating SM4 encryption and decryption keys based on a shared state machine. Addressing the issues of the large number of cycles and storage units required by existing SM4 encryption and decryption key generators, this method proposes an SM4 encryption and decryption key generator and a key generation method.

[0030] This invention combines the encryption key generation and decryption key generation processes, sharing the entire data path and a portion of the state machine. During encryption, this state machine uses K0, K1, K2, and K3 as the master key input; during decryption, it uses K... 35 K 34 K 33 K 32 As the master key input, the decryption key can be generated in just 32 cycles when no key update is required, thus reducing the number of cycles required to generate the decryption round key.

[0031] First, the encryption key generation formula used during encryption is as follows:

[0032]

[0033] Where MK represents the 128-bit input master key, FK represents the 128-bit system parameters in the SM4 standard, r represents the round number, and K... r Let represent the 32-bit encryption round key for the r-th round, where A1 and B1 are 32-bit intermediate variables; a0 ~ a3 represent 8-bit intermediate variables; τ represents a nonlinear function; L(B1) represents a linear transformation with input B1; Sbox(a0) ~ Sbox(a3) represent S-box functions; ck i rk represents a 32-bit fixed parameter in the SM4 standard. r This represents the encryption key for the r-th round.

[0034] Secondly, the decryption round key generation formula used during decryption is as follows:

[0035] Given K 35 K 34 K 33 K 32 In this case, the decryption round function can be expressed as:

[0036]

[0037] Where A2 and B2 are 32-bit intermediate variables, and L(B2) represents a linear transformation with input B2; rk 31-r and K 31-r This represents the 32-bit encryption key for round 31-r, which is used as the decryption key for round r.

[0038] It can be seen that the four operations of the 32-round loop iteration function for generating encryption and decryption round keys—four-input XOR, nonlinear function τ, linear function L1, and two-input XOR—are all the same; the difference lies in the inputs.

[0039] The SM4 encryption / decryption key generator consists of three parts: a data path, an output round key value retrieval mechanism, and a custom state machine.

[0040] The output round key is assigned as RK=K3, where RK represents the round key output of the SM4 algorithm.

[0041] A custom state machine requires 39 states, from S0 to S38. This is achieved through state machine transitions, combinational logic assignment of the next state NS, and sequential logic outputs of K0, K1, K2, K3, and K... 35 K 34 K 33 K32 The state machine's sequential logic outputs flag1 (control signal), the state machine's combinational logic outputs the constant ck, and the state machine's combinational logic outputs key_out_valid (valid signal).

[0042] State machine transition: CS represents the current state, and NS represents the next state. Upon reset, CS is set to 0; otherwise, NS is assigned to CS at the clock edge.

[0043] The combinational logic assignment for the next state NS is as follows: When CS is the initial state S0, if flag==0 and flag1==0, NS jumps to state S1; otherwise, it remains in the current state. When CS is in state S1, state S2 to state S32, NS jumps to the current state CS+1. When CS is in state S33, if flag=1, NS jumps to S0; if flag=0 and flag1=1, NS jumps to S35; otherwise, it jumps to state S34. When CS is in state 34, if load_key=1, NS jumps to state S1; if load_data=1, it jumps to state S35; otherwise, it remains in the current state. When CS is in state 35, state 36, and state 37, NS jumps to the current state CS+1. When CS is in state 38, NS jumps to state S5. When CS is in default, NS jumps to state S0.

[0044] The state machine's sequential logic outputs K0, K1, K2, and K3. When CS is in states S0 and S34, the value of the master key XORed with MK is used as the initial value of K0, K1, K2, and K3, i.e., {K0, K1, K2, K3} <= key^MK. When CS is in states S1 to S32, the values ​​of K0, K1, K2, and K3 are updated, i.e., {K0, K1, K2, K3} <= {K1, K2, K3, next_K3}, where next_K3 is the next round key calculated by combinational logic. When CS is in state S35, K0... 35 Assign the value to K3; in state S36, set K... 34 Assign the value to K3, and set K 35 Assign the value to K0; when CS is in state S37, set K... 33 Assign the value to K3, and set K 34 Assign the value to K1, and K 35 Assign the value to K0; when CS is in state S38, set K... 32 Assign the value to K3, and set K 33 Assign the value to K2, and K 34 Assign the value to K1, and K 35 Assign the value to K0. In fact, when executing states S35 to S38, K is... 35 K34 K 33 K 32 As the initial round key for decryption, and one is used in each cycle, after the initial round key for decryption is assigned, the process enters states 5 to 32, and a decryption round key can be obtained in each cycle.

[0045] The other set of sequential logic outputs K of the state machine 35 K 34 K 33 K 32 When CS is in state 33, if flag1=0, then K3, K2, K1, and K0 are respectively set as K. 35 K 34 K 33 K 32 The value of K is set to 0 if CS is otherwise unchanged; when CS is in other states, K remains unchanged. 35 K 34 K 33 K 32 Hold. This logic output indicates that, in state 33, the true K will be... 35 K 34 K 33 K 32 Once assigned a value, it remains unchanged. During decryption, if the master key remains the same, K can be used directly. 35 K 34 K 33 K 32 As initial values.

[0046] The state machine also outputs another sequential logic output, flag1, as a control signal. When CS is in state S0, flag1 is set to 0; when CS is in state 33, flag1 is set to 1; and flag1 remains unchanged in other states.

[0047] The combinational logic output constant ck of the state machine. This embodiment provides a list showing the output constant ck of CS in different states. i The value of is assigned to ck. i This represents the constant value required to calculate the key for the i-th encryption round. When flag1=0, the encryption round key is calculated from the initial encryption round key, and ck0 to ck0 are given sequentially from state S1 to state S32. 31 The values ​​are assigned to ck sequentially, and a new next_K3 can be calculated and assigned to obtain the new K3. When flag1=1, the decryption round key is calculated from the initial decryption round key, and ck is given sequentially from state S5 to state S32. 31 Up to ck4, values ​​are sequentially assigned to ck, and a new next_K3 can be calculated and assigned to obtain the new K3. In other states, ck defaults to ck0.

[0048] Table 1 ck i hexadecimal value

[0049]

[0050] Table 2. CK selection under different states and flag1 signal. i value

[0051]

[0052] The other combinational logic output of the state machine, key_out_valid, outputs a valid signal. When CS is in state 0, 1, 34, or 35, key_out_valid is 0; when CS is in other states, if flag=1, then key_out_valid=1; otherwise, key_out_valid=flag1.

[0053] Table 3 SM4 Encryption / Decryption Key Generator Interface

[0054]

[0055] This state machine implements a complete key expansion process, supports dual-mode encryption and decryption operations, optimizes the decryption key generation process through state transitions, and ensures the correctness of the generated encryption round key and decryption round key through the control signal flag1.

[0056] In this embodiment, the design process of the custom state machine for the encryption / decryption key generator is as follows: Figure 1 As shown, when ck takes the value cki, K can be calculated using cki. i+3 The state machine provides the actual calculated and used K4 to K in different states. 35 There are a total of 32 rounds of keys. There are a total of 39 states, from S0 to S38. We provide the state transitions during encryption and decryption.

[0057] State transitions during encryption:

[0058] During the encryption round key generation process, it can be determined that flag=0. Upon reset, the state machine is in the initial state S0, with load_key=0. It maintains the current state and waits for load_key=1 before entering state S1. Then, it sequentially executes states S2, S3, ..., S33. In state S33, it outputs key_out_valid=1, indicating that the decryption cycle count is 32, the encryption valid signal flag is valid, and it jumps back to S0 to enter the state machine execution process for the next encryption round key generation.

[0059] State transition during decryption:

[0060] There are two scenarios for generating the decryption round key: one is that the key is valid every time, meaning K needs to be recalculated each time. 35 K 34 K 33 and K 32 In this scenario, generating the decryption round key requires 64 cycles. Another scenario involves a valid key initially, followed by a unchanged key, where only the plaintext valid signal `load_data` is sent. In this case, the previously generated key can be reused. 35 K 34 K 33 and K 32 The decryption round key generation requires 32 cycles.

[0061] During the first decryption round key generation process, it can be determined that flag=0. Upon reset, the state machine is in the initial state S0, with load_key=1. It maintains the current state and waits for load_key=1 before entering state S1. Then, it sequentially executes states S2, S3, ..., S33. In state S33, the encryption valid signal flag=0 is invalid, and flag1=0, so it jumps to state S35. Then, it sequentially executes states S35, S36, S37, and S38. In state S38, it jumps to S5, and then sequentially executes states S6, S7, ..., S33. In state S33, key_out_valid=1 is output, and the decryption cycle count is 64. When flag=0 and flag1=1, it jumps to state S34. In the waiting state S34, if load_key=1, it jumps to S1; otherwise, if load_data=1, it jumps to S35; otherwise, it maintains the current state.

[0062] If the state machine has a valid key every time, then in state 34 it waits for load_key=1, jumps to S1, and repeats the key generation process of the first decryption round. In this case, the number of decryption cycles is 64 each time.

[0063] If the key is only valid (load_key=1) during the first decryption round key generation process, and is invalid (load_key=0) during subsequent decryption round key generation processes, then only load_data=1 is needed. In state 34, load_key=0, waiting for load_data=1, then jumps to state S35. Afterwards, states S35, S36, S37, and S38 are executed sequentially. In state S38, it jumps back to S5, then states S6, S7, ..., S33 are executed sequentially. In state S33, key_out_valid=1 is output, and the decryption cycle count is 32.

[0064] This invention supports dual-mode operation for encryption and decryption. It optimizes the decryption key generation process through state transitions and uses the control signal flag1 to ensure the correctness of the generated encryption and decryption round keys. The advantage of this invention is that it reduces the number of decryption key generation cycles by 50% when the key remains unchanged, making it suitable for SM4 encryption and decryption key generation. This invention also reduces the number of registers and combinational logic required for encryption and decryption key generation.

[0065] It can be seen that on Kintex7, Virtex6, and Spartan6 devices, the number of flip-flops (FFs) is reduced by 77.42%, and the number of lookup tables (LUTs) is reduced by about 14%; on Spartan3 devices, the number of flip-flops (FFs) is reduced by 78.03%, and the number of lookup tables (LUTs) is reduced by 9.30%.

[0066] This paper reduces the number of key generation and decryption cycles by 50%, increases throughput by approximately 23%-24% on Kintex7, Virtex6, and Spartan6 devices, and increases throughput by 76.95% on Spartan3 devices.

[0067] Table 4. Overall Results of Shared Encryption / Decryption Key Generation

[0068]

[0069] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A hardware design method for generating SM4 encryption / decryption keys based on a shared state machine, characterized in that: The encryption key generation and decryption key generation processes are combined, sharing the entire data path and a portion of the state machine. During encryption, this state machine takes K0, K1, K2, and K3 as the master key input; during decryption, it takes K... 35 K 34 K 33 K 32 As the master key input, when there is no need to update the key, the decryption key can be generated in just 32 cycles, thereby reducing the number of cycles required to generate the decryption round key; First, the encryption key generation formula used during encryption is as follows: ； Where MK represents the 128-bit input master key, FK represents the 128-bit system parameters in the SM4 standard, r represents the round number, and K... r Let represent the 32-bit encryption round key for the r-th round, where A1 and B1 are 32-bit intermediate variables; a0~a3 each represent 8-bit intermediate variables; τ represents a nonlinear function; L(B1) represents a linear transformation with input B1; Sbox(a0)~Sbox(a3) each represent an S-box function; ck i rk represents a 32-bit fixed parameter in the SM4 standard. r Represents the encryption round key for the r-th round; Secondly, the decryption round key generation formula used during decryption is as follows: Given K 35 K 34 K 33 K 32 In this case, the decryption round function can be expressed as: ； Where A2 and B2 are 32-bit intermediate variables, and L(B2) represents a linear transformation with input B2; rk 31-r and K 31-r This represents the 32-bit encryption key for round 31-r, which is used as the decryption key for round r. The four operations of the 32-round loop iteration function for generating encryption and decryption round keys—four-input XOR, nonlinear function τ, linear function, and two-input XOR—are all the same; the only difference is the input. The SM4 encryption / decryption key generator consists of three parts: a data path, an output round key value retrieval mechanism, and a custom state machine. The output round key is assigned RK=K3, where RK represents the round key output of the SM4 algorithm; A custom state machine requires 39 states, from S0 to S38; these states are determined through state machine transitions, combinational logic assignment of the next state NS, and sequential logic outputs of K0, K1, K2, K3, and K... 35 K 34 K 33 K 32 The sequential logic output of the state machine is the control signal flag1, the combinational logic output of the state machine is the constant ck, and the combinational logic output of the state machine is the valid signal key_out_valid. State machine transition: CS represents the current state and NS represents the next state; upon reset, CS is assigned a value of 0; otherwise, NS is assigned a value to CS when the clock edge arrives. The combinational logic assignment for the next state NS is as follows: When CS is the initial state S0, if flag==0 and flag1==0, NS jumps to state S1; otherwise, it remains in the current state. When CS is in state S1, state S2 to state S32, NS jumps to the current state CS+1. When CS is in state S33, if flag=1, NS jumps to S0; if flag=0 and flag1=1, NS jumps to S35; otherwise, it jumps to state S34. When CS is in state 34, if load_key=1, NS jumps to state S1; if load_data=1, it jumps to state S35; otherwise, it remains in the current state. When CS is in state 35, state 36, and state 37, NS jumps to the current state CS+1. When CS is in state 38, NS jumps to state S5. When CS is in the default state, NS jumps to state S0. The state machine's sequential logic outputs K0, K1, K2, and K3. When CS is in states S0 and S34, the value of the master key XORed with MK is used as the initial value of K0, K1, K2, and K3, i.e., {K0, K1, K2, K3} <= key^MK. When CS is in states S1 to S32, the values ​​of K0, K1, K2, and K3 are updated, i.e., {K0, K1, K2, K3} <= {K1, K2, K3, next_K3}, where next_K3 is the next round key calculated by combinational logic. When CS is in state S35, K0... 35 Assign the value to K3; in state S36, set K... 34 Assign the value to K3, and set K 35 Assign the value to K0; when CS is in state S37, set K... 33 Assign the value to K3, and set K 34 Assign the value to K1, and K 35 Assign the value to K0; when CS is in state S38, set K... 32 Assign the value to K3, and set K 33 Assign the value to K2, and K 34 Assign the value to K1, and K 35 Assigning a value to K0; actually, when executing states S35 to S38, K is... 35 K 34 K 33 K 32 As the initial round key for decryption, and one is used in each cycle, after the initial round key for decryption is assigned, the process enters states 5 to 32, and a decryption round key can be obtained in each cycle. The other set of sequential logic outputs K of the state machine 35 K 34 K 33 K 32 When CS is in state 33, if flag1=0, then K3, K2, K1, and K0 are respectively set as K. 35 K 34 K 33 K 32 The value of K is set to 0 if CS is otherwise unchanged; when CS is in other states, K remains unchanged. 35 K 34 K 33 K 32 Hold; this logic output indicates that, in state 33, the true K will be... 35 K 34 K 33 K 32 Once assigned a value, it remains unchanged. During decryption, if the master key remains the same, K can be used directly. 35 K 34 K 33 K 32 As initial value; The state machine outputs another sequential logic signal, flag1, as a control signal. When CS is in state S0, flag1 is assigned a value of 0; when CS is in state 33, flag1 is assigned a value of 1; and flag1 remains unchanged in other states. The combinational logic output constant ck of the state machine; CS will change ck in different states. i The value of ck is assigned to ck; i This represents the constant value required to calculate the key for the i-th encryption round; when flag1=0, the encryption round key is calculated from the initial encryption round key, and ck0 to ck1 are given sequentially from state S1 to state S32. 31 The values ​​are assigned to ck sequentially, and a new next_K3 can be calculated and assigned to obtain the new K3; when flag1=1, the decryption round key is calculated from the initial decryption round key, and ck is given sequentially from state S5 to state S32. 31 Up to ck4, values ​​are assigned to ck in sequence, and a new next_K3 can be calculated and assigned to obtain the new K3; in other states, ck defaults to ck0.

Images