SM4 white box encryption method and electronic equipment

Abstract

The invention provides an SM4 white box encryption method and electronic equipment. The method comprises the following steps: performing multiple rounds of white box encryption operation on plaintext data to obtain an SM4 ciphertext; the white box encryption operation comprises the following steps: obtaining first intermediate data by using a second coding strategy and the current round of input data; inputting the first intermediate data and the white-box round key into a first lookup table to obtain second intermediate data; inputting the demasked mask and the second intermediate data into a second lookup table to obtain third intermediate data; and performing XOR on the result of the third intermediate data based on the third coding strategy and the result of the first group of data in the input data through the fourth coding strategy to obtain the output data of the current round. According to the SM4 white-box encryption method provided by the invention, the white-box round key can be updated based on the updated input key, and the updated white-box round key and the first intermediate data are input into the first lookup table, so that the dynamic updating of the white-box round key in the encryption process can be realized. In addition, the SM4 white box encryption method disclosed by the invention also has relatively high security on DCA attacks.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to an SM4 white-box encryption method and electronic device. Background Technology

[0002] White-box cryptography aims to protect cryptographic software from direct attacker access to the key when encrypting and decrypting data on untrusted terminals. Chow et al. were the first to publicly disclose a white-box cryptography algorithm. In reference 1, they implemented the round function of AES through a series of lookup tables, hiding the key within the lookup tables. They also employed encoding techniques to protect the input and output data of each lookup table, preventing attackers from directly obtaining the actual intermediate data and thus cracking the key, ensuring the cryptographic algorithm's secure operation in untrusted environments. Billet et al., in reference 2, introduced an algebraic attack method against the white-box cryptography algorithm in reference 1. This method can achieve attacks with speeds less than O(2^3) times. 30 The key implemented in the white-box cryptography can be recovered within a time complexity of [missing information]. Since then, white-box cryptographic schemes and their algebraic attack methods have been continuously proposed and improved. Reference 3 introduces side-channel attacks into white-box cryptanalysis for publicly available white-box cryptographic schemes, arguing that most existing schemes are not resistant to Differential Computational Analysis (DCA) attacks. Therefore, designing white-box encryption schemes resistant to DCA attacks has become a direction for white-box cryptography design. Furthermore, considering that in existing static white-box cryptographic schemes, the key is bound to a lookup table, and key updates often require regenerating and replacing the lookup table, resulting in low flexibility in practical applications, Wang Bin et al. first reported a dynamic white-box cryptographic scheme in Reference 4. This scheme allows different white-box keys to be used to complete the encryption and decryption process for the same white-box encryption process. The dynamic key white-box cryptographic scheme only requires updating the white-box key, resulting in relatively low update costs.

[0003] The SM4 algorithm, my country's first commercially available cryptographic algorithm, has become a national cryptographic industry standard and is widely used across various industries. Therefore, designing a white-box SM4 cryptographic algorithm is essential for the current complex network environment. Several static key encryption schemes exist for white-box implementations of SM4, such as the Xiao-Lai scheme, the Shi-Yang scheme, and the Bai-Wu scheme. However, static white-box schemes have low security, most cannot withstand DCA attacks, and because the key is bound to a lookup table, updating the key requires regenerating the entire white-box encryption program, making them unsuitable for scenarios with high flexibility requirements. Based on the shortcomings of static white-box schemes, Yang et al. proposed a dynamic SM4 white-box cryptographic scheme, WBDL (white-box SM4 algorithm based on dynamic white-box library), in reference 5. This algorithm can dynamically implement encryption and decryption operations on input data and resist DCA attacks through external encoding. However, due to the inherent design characteristics of the scheme, the output ciphertext obtained after removing the external encoding is inconsistent with the standard SM4 algorithm encryption result, meaning the dynamic SM4 white-box encryption scheme in reference 5 lacks universality.

[0004] Therefore, there is an urgent need to design a general-purpose dynamic SM4 white-box encryption method that has high algebraic security and can cope with DCA-type attacks.

[0005] List of references:

[0006] Literature 1: CHOW ST, EISEN PA, JOHNSON HJ, et al.White-box cryptography andan AES implementation[C].In:Selected Areas in Cryptography—SAC 2002.SpringerBerlin Heidelberg, 2002:250–270.[DOI:10.1007 / 3-540-36492-7_17];

[0007] Document 2: Billet O, Gilbert H, Ech-chatbi C. Cryptanalysis of a white boxAES implementation [C]. Selected Areas in Cryptography—SAC 2004. SpringerBerlin Heidelberg, 2004.227-240;

[0008] Document 3: Bos JW, Hubain C, Michiels W, Teuwen P. Differential computation analysis: Hid ing your white-box designs is not enough. In: Gierlichs B, PoschmannAY, eds. Proc. of the Int'l Conf. on Cryptographic Hardware and Embedded Systems. Berlin, Heidel berg: Springer,2016.215–236.[doi:10.1007 / 978-3-662-53140-2_11];

[0009] Document 4: WANG Bin, CHEN Si, CHEN Jiadong, WANG Xing. DWB-AES: implementation of dynamic white-box based on AES[J]. Journal on Communications, 2021(2):177-186;

[0010] Reference 5: Yang Yatao, Dong Hui, Zhang Ye, Zhang Yanshuo. WBDL: An improved SM4 dynamic white-box cryptographic algorithm [J]. Acta Cryptologica Sinica, 2023, 10(4):796–812. [DOI:10.13868 / j.cnki.jcr.000629]. Summary of the Invention

[0011] In view of this, embodiments of the present invention provide an SM4 white-box encryption method and electronic device, which can update the white-box round key by dynamically updating the input key, thereby making the encryption process universal, flexible and secure.

[0012] One aspect of the present invention provides an SM4 white-box encryption method, the method comprising the following steps:

[0013] The input plaintext data is split bit-by-bit to obtain four sets of data. A first encoding strategy is used to encode each of the four sets of data, and multiple rounds of white-box encryption are performed based on the encoding results. Specifically, the encoding results of the four sets of data are used as the input data for the zeroth round of white-box encryption. Each subsequent round of white-box encryption uses the last three sets of data from the previous round's input data and the previous round's output data as the input data for the current round.

[0014] The last three sets of input data and output data in the last round of white-box encryption are XORed with the corresponding first mask to obtain four sets of XOR results. The XOR results are then reversed to obtain the SM4 ciphertext.

[0015] Each round of white-box encryption operations includes:

[0016] The second encoding strategy is used to uniformly encode the last three groups of data in the input data of the current round of white-box encryption operation, and the uniform encoding result is XORed to obtain a set of 32-bit first intermediate data.

[0017] The first intermediate byte obtained by bitwise splitting the first intermediate data and the corresponding wheel key byte obtained by bitwise splitting the white-box wheel key are input into the first lookup table to obtain four sets of 8-bit second intermediate bytes; wherein, the white-box wheel key is 32-bit data pre-generated using the dynamically updatable input key;

[0018] The demasking byte obtained by bitwise splitting the 32-bit demasking byte and the corresponding second intermediate byte are input into the second lookup table to obtain a set of 32-bit masked third intermediate data. The demasking byte is obtained by XORing the first mask corresponding to the last three sets of data in the current round of input data, and is used to remove the second mask added in the previous round through the second lookup table.

[0019] The encoding result obtained by transforming the third intermediate data based on the third encoding strategy is XORed with the encoding result obtained by the first group of data in the input data through the fourth encoding strategy to obtain the output data of the current round of white-box encryption operation.

[0020] In some embodiments of the present invention, the first encoding strategy is a 32-order reversible first affine encoding;

[0021] The second encoding strategy is:

[0022] The inverse affine transformations are performed on the last three sets of input data in the current round, and the results of the inverse affine transformations are encoded using a 32nd-order invertible second affine code; the second affine code consists of four 8th-order invertible affine transformations.

[0023] In some embodiments of the present invention, the white-box wheel key is obtained in the following manner:

[0024] Based on the 32nd order invertible third affine coding and the 8th order invertible nonlinear coding, a white-box round key is obtained using a 32-bit round key; where the round key is obtained from the input key through a key arrangement algorithm, and the third affine coding consists of four 8th order invertible affine transformations.

[0025] In some embodiments of the present invention, when the matrix portion of the third affine encoding is the same as the matrix portion of the second affine encoding, the encoding strategy of the first lookup table includes:

[0026] The round key bytes are encoded using an 8th-order inverse nonlinear encoding.

[0027] Based on the position of the first intermediate byte in the first intermediate data and the position of the round key byte in the white-box round key, the round key byte after inverse nonlinear encoding is XORed with the corresponding first intermediate byte.

[0028] The XOR operation result is encoded using an 8th-order nonlinear code, and the second intermediate byte is output.

[0029] When the matrix part of the third affine encoding differs from the matrix part of the second affine encoding, the encoding strategy of the first lookup table includes:

[0030] The round key bytes are encoded using an 8th-order inverse nonlinear encoding.

[0031] The round key bytes that have undergone inverse nonlinear encoding are subjected to a corresponding affine transformation based on the third inverse affine encoding, and the affine transformation result is encoded using the second affine encoding.

[0032] Based on the position of the first intermediate byte in the first intermediate data and the position of the round key byte in the white-box round key, the round key byte after the second affine encoding is XORed with the corresponding first intermediate byte.

[0033] The result of the XOR operation is encoded using an 8th-order nonlinear code, and the second intermediate byte is output.

[0034] In some embodiments of the present invention, the encoding strategy of the second lookup table includes:

[0035] Based on the position of the second intermediate byte in the second intermediate data and the position of the demasking byte in the demasking, the corresponding second intermediate byte and demasking byte are determined; wherein, the second intermediate data is obtained by concatenating four groups of 8-bit second intermediate bytes;

[0036] The second intermediate byte is encoded using 8th-order inverse nonlinear encoding and second inverse affine encoding. The corresponding demasking byte is encoded using 32nd-order invertible fourth affine encoding. The encoded second intermediate byte and the corresponding encoded demasking byte are then XORed. The constant part of the fourth affine encoding is 0.

[0037] The XOR operation result obtained by the S-box is byte-replaced, and the search result of the S-box is masked by a pre-set second mask;

[0038] The result of the masking operation is encoded based on the fifth affine code of order 32, resulting in an 8-bit third intermediate byte; where the fourth and fifth affine codes are both composed of four 8th order invertible affine transformations.

[0039] In some embodiments of the present invention, when the matrix portion of the third affine encoding is the same as the matrix portion of the second affine encoding,

[0040] If the constant of the third affine code is not 0, then the second inverse affine code is the matrix part of the inverse code corresponding to the second affine code;

[0041] If the constant of the third affine code is not 0, then the second inverse affine code is the inverse code corresponding to the second affine code.

[0042] In some embodiments of the present invention, the third encoding strategy is:

[0043] The third intermediate data is subjected to affine operation using the fifth inverse affine code, and the affine operation result is subjected to linear transformation. The linear transformation result is then encoded based on the sixth affine code of order 32. The third intermediate data is obtained by concatenating four sets of third intermediate bytes obtained based on the demasking code and the second intermediate data.

[0044] In some embodiments of the present invention, the fourth encoding strategy is:

[0045] Perform the corresponding inverse affine transformation on the first set of data in the current round of input data, and encode the obtained inverse affine transformation result using the 32nd order seventh affine code;

[0046] In this case, the matrix part of the sixth affine code in the current round is the same as the matrix part of the seventh affine code, and the result of the XOR operation between the constant of the sixth affine code and the constant of the seventh affine code is the constant of the affine code corresponding to the output data of the current round.

[0047] In some embodiments of the present invention, the first mask is obtained in the following manner:

[0048] The index count corresponding to the second intermediate byte of each group is determined based on the position of the second intermediate byte in the second intermediate data.

[0049] Using the second middle byte of each group in the current round as an index, the pre-stored nonlinear permutation table is searched according to the corresponding index number, and the search result of the nonlinear permutation table is used as an index to search the pre-stored mask to generate a lookup table, resulting in four groups of second masks.

[0050] The four sets of second masks obtained by concatenation are encoded based on the eighth affine code of order 32 to obtain the first mask corresponding to the output data of the current round.

[0051] In this case, the first mask corresponding to the zeroth round input data is 0, and the demasking mask for the zeroth round is also 0;

[0052] The concatenated result is encoded based on the 32nd-order eighth affine code, including:

[0053] Based on the mask, the inverse code of the affine transformation corresponding to the lookup table is used to perform affine operation on the concatenated result, the affine operation result is then subjected to linear transformation, and the result of the linear transformation is encoded by the fourth inverse affine code.

[0054] Another aspect of the present invention provides an electronic device including a processor, a memory, and a computer program / instructions stored in the memory. The processor is configured to execute the computer program / instructions, and when the computer program / instructions are executed, the electronic device implements the steps of the method described in any of the above embodiments.

[0055] This invention proposes an SM4 white-box encryption method and electronic device, which can realize the SM4 white-box encryption process through lookup tables and encoding strategies. When the white-box round key needs to be updated, this application only needs to generate a new white-box round key using the updated input key, and then input the updated white-box round key into the lookup table to complete the key addition operation. Furthermore, the order of round key usage based on the SM4 algorithm ensures the consistency of the encryption result with the standard SM4 algorithm. Therefore, the dynamic SM4 white-box encryption algorithm proposed in this application has flexibility and versatility, and provides high security against DCA attacks.

[0056] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the description, or may be learned by practice of the invention. The objects and other advantages of the invention can be realized and obtained by means of the structures specifically pointed out in the description and drawings.

[0057] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0058] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, are not intended to limit the scope of the invention. In the drawings:

[0059] Figure 1This is a flowchart illustrating each round of white-box encryption operations in one embodiment of the present invention.

[0060] Figure 2 This is a flowchart illustrating the white-box encryption operation in another embodiment of the present invention.

[0061] Figure 3 This is a schematic diagram of the process for generating a white-box wheel key in one embodiment of the present invention.

[0062] Figure 4 This is a schematic diagram of the encoding strategy for adding a round key lookup table TK in one embodiment of the present invention.

[0063] Figure 5 This is a schematic diagram of the encoding strategy of the masked nonlinear lookup table MS in one embodiment of the present invention.

[0064] Figure 6 This is a schematic diagram illustrating the generation of a first mask and a second mask in one embodiment of the present invention. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0066] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0067] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0068] In the following description, embodiments of the invention will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0069] For the white-box implementation of SM4, some scholars have proposed several design schemes. For example, Xiao Yaying et al. (Reference: Xiao Yaying, Lai Xuejia. White-box cryptography and white-box implementation of SM4 algorithm [C]. Chinese Association for Cryptologic Research 2009 Annual Meeting. Beijing: Science Press, 2009. 24-34) proposed the first white-box implementation scheme of SM4 algorithm (i.e. Xiao-Lai scheme) based on lookup table technology, and proved that the scheme can successfully resist BGE attack (Reference: Billet O, Gilbert H, Ech-chatbi C. Cryptanalysis of a white box AES implementation [C]. Selected Areas in Cryptography—SAC 2004. Springer Berlin Heidelberg, 2004. 227-240). Lin Tingting et al. (Reference: Lin Tingting, Lai Xuejia. An effective attack on white-box SM4 implementation [J]. Journal of Software, 2013, 24(9): 2238-2249) combined multiple methods such as BGE attack, differential cryptography analysis and solving equation systems to analyze the Xiao-Lai white-box SM4 implementation scheme (i.e., Lin-Lai attack), and gave the worst-case time complexity of the attack as 2. 47Shi Yang et al. (Reference: Shi Y, Wei W, He Z, et al. A lightweight white-box symmetric encryption algorithm against node capture for WSNs[J]. Sensors, 2015, 15(5):11928-11952) proposed a new white-box SM4 scheme (Shi-Yang scheme), which uses dual cryptography and combines random obfuscation to protect the lookup table. Bai Kunpeng et al. (Reference: Bai KP, Wu C K. A secure white-box SM4 implementation[J]. Security and Communication Networks, 2016, 9(10):996-1006) proposed the Bai-Wu SM4 white-box implementation scheme, which can cope with Lin-Lai analysis, so that large linear codes will not be canceled by the combination of lookup tables, and its running speed is 9 times faster than the Xiao-Lai white-box SM4 implementation scheme. However, this scheme requires 32.5MB of memory space to store the lookup table, and this scheme cannot cope with the algebra attack of Pan Wenlun et al., and its security needs to be improved. Yao Si et al. (Reference: Yao Si, Chen Jie. A novel white-box implementation of the SM4 algorithm [J]. Journal of Cryptology, 2020, 7(03):358-374. DOI:10.13868 / j.cnki.jcr.000373) proposed a white-box SM4 implementation scheme with internal state augmentation by combining obfuscated keys and lookup table techniques. By introducing redundant intermediate states, this scheme significantly improves the complexity of key extraction by attackers. However, most of the above schemes cannot cope with DCA-type attacks and have low security.

[0070] Zhang Yueyu et al. (Reference: ZHANG Yueyu, XU Dong, CHEN Jie. Analysis and Improvement of White-box SM4 Implementation[J]. Journal of Electronics & Information Technology, 2022, 44(8):2903-2913. doi:10.11999 / JEIT210556) proposed using nonlinear components to obfuscate the intermediate states in the Schau-Lai white-box scheme, eliminating the correlation between the intermediate states and the key to cope with DCA attacks. Yuan Ziqing et al. (Reference: YUAN ZQ, CHEN J. A white-box SM4 scheme against differential computation analysis[J]. Journal of Cryptologic Research, 2023, 10(2):386–396.[DOI:10.13868 / j.cnki.jcr.000601]) proposed a white-box implementation method based on the White-Wu scheme that uses nonlinear coding to resist DCA attacks. Zhao et al. (References: Zhao, D.; Wang, Y.; Li, Y.; Hu, X.; Yu, Y.; Chen, S.; Zheng, S. An Efficient Masked White-Box Implementation of SM4. Electronics 2024, 13, 2326. https: / / doi.org / 10.3390 / electronics13122326) used Boolean masks to mask the intermediate data of SM4 at various points, making it impossible for attackers to establish the real relationship between the data and the key, thereby resisting DCA attacks.

[0071] The aforementioned SM4 white-box solutions are all static white-box designs. Because the round key is bound to the lookup table in static white-box solutions, in scenarios requiring periodic key updates, the entire white-box encryption program needs to be regenerated each time the key is updated, resulting in significant update costs. Furthermore, if the key of the white-box solution is cracked, the white-box design or encryption program needs to be replaced. In addition, some articles have demonstrated that the Xiao-Lai and Bai-Wu SM4 white-box solutions cannot cope with DCA-type side-channel attacks, and the Yao Si solution also has limited ability to handle side-channel attacks. Therefore, a white-box SM4 solution with high algebraic security and the ability to withstand DCA-type attacks is needed.

[0072] In summary, designing a key-changeable SM4 white-box cryptographic algorithm to ensure data encryption and decryption security is essential to meet the requirements of scenarios with high demands for cost, security, and flexibility. To improve the flexibility and security of white-box solutions, Yang Yatao et al. first proposed a dynamic SM4 white-box algorithm. However, due to the inherent design characteristics of this algorithm, the ciphertext output in the final round of encryption differs from the standard SM4 algorithm encryption result after removing the external encoding, meaning that this algorithm lacks universality. Therefore, this application proposes a flexible and more universal dynamic SM4 white-box encryption algorithm.

[0073] This application dynamically updates the input key during SM4 white-box encryption, and can even achieve one-time pad encryption in certain scenarios. When the white-box round key needs to be updated, it only needs to update the round key with the updated input key to generate the white-box round key. Moreover, this application constructs an additional round key lookup table TK by traversing each possible round key value. Therefore, the round key in the encryption process, as input data for SM4 white-box encryption, can be XORed with the first intermediate data through the lookup table TK. Furthermore, compared to the dynamic SM4 white-box algorithm proposed by Yang et al., this application uses the same order of round keys as the standard SM4 algorithm during encryption, making the final encryption result consistent with the standard SM4 algorithm. Therefore, the encryption method of dynamically updating the input key in this application has higher flexibility and versatility.

[0074] Furthermore, the SM4 dynamic white-box encryption method proposed in this application can hide the correlation between intermediate data and round keys at a relatively low cost by combining lookup tables and affine operations, thereby countering DCA attacks. This application adds a Boolean mask to the S-box operation result and uses different affine codes to protect the masked data (i.e., the third intermediate data) and the mask values ​​(including the first and second masks). Due to the different codes, the mask of the intermediate data cannot be directly eliminated by XOR operations, increasing the complexity of the encryption. Moreover, to ensure encryption security, this application continuously retains the second mask in subsequent operations of the current round of encryption, meaning the intermediate data is masked everywhere. In addition, except for the zeroth round of white-box encryption, the unmasking mask and the masked data can be used as the input and output of the nonlinear operation correlation lookup table, respectively, ensuring the correctness of the encryption.

[0075] The SM4 cryptographic algorithm is a block cipher with 128-bit input and output data and a 128-bit key. Both the encryption and key expansion algorithms employ a non-linear iterative structure, with 32 rounds of computation each.

[0076] Considering the poor security of directly performing SM4 white-box encryption on plaintext data, this application requires encrypting the plaintext data Q before performing multiple rounds of white-box encryption. This application considers encrypting the plaintext data Q by adding affine coding.

[0077] More specifically, since directly encrypting 128-bit plaintext data may be too costly, this application considers splitting the 128-bit plaintext data bit by bit into four groups of data Q. i (j = 0, 1, 2, 3), each group is 32 bits long. Therefore, the plaintext data can be represented as Q = (Q0, Q1, Q2, Q3), or it can be represented as Q = Q0||Q1||Q2||Q3 using the concatenation symbol ||. Here, j represents the data Q. j The position in the plaintext data Q.

[0078] To ensure data security, a first encoding strategy can be used to encode the four sets of data obtained from the splitting. Specifically, this application can use a 32nd-order invertible first affine code P to encode the four sets of data Q0, Q1, Q2, and Q3 respectively, thereby obtaining four sets of encrypted data P(Q j That is, using a 32nd-order invertible first affine code P, four sets of encrypted data P(Q0), P(Q1), P(Q2), and P(Q3) are obtained. The first affine code P is defined as follows: Where lP(x) represents an n-order matrix on GF(2) (i.e., lP(x) represents the linear part of the first affine code P), and cP is an n-bit vector (i.e., cP represents the constant part of the first affine code P); when cP = 0, the first affine code P is a linear code.

[0079] Based on the structure of the SM4 block cipher algorithm itself, the data input for each round of white-box encryption operation in this application can be represented as X. i X i+1 X i+2 and X i+3 The output data can be represented as X i+4 (i = 0, 1, 2, ..., 31). That is, this application is based on four sets of encrypted data P(Q) j In multi-round white-box encryption, the input and output data are different for each round. The input data for the zeroth round of white-box encryption is four sets of encrypted data P(Q). jThat is, when i = 0, the input data X0, X1, X2 and X3 of the i-th round are P(Q0), P(Q1), P(Q2) and P(Q3) respectively; the input data of each round of encryption operation after the zero-th round of white-box encryption operation (that is, when i = 1, 2, 3, ..., 31) are the last three sets of data X from the input data of the previous round. i+1 X i+2 and X i+3 And the output data X from the previous round i+4 .

[0080] As an example, considering the impact of memory usage, this application can directly encrypt plaintext data Q using an affine transformation to obtain P(Q). j This is done without considering the form of a lookup table. Furthermore, the first affine codes corresponding to the four sets of data obtained from the split can be different; for example, the first encoding strategies corresponding to the four sets of data can be P0, P1, P2, and P3 respectively, but this invention is not limited to this.

[0081] The entire SM4 white-box encryption process in this application can be primarily implemented using lookup tables and affine coding. The lookup table generation process is as follows: the encoding involved in the SM4 white-box encryption process is broken down into multiple parts, each part is scrambled, and a lookup table corresponding to that module is generated based on all possible inputs and outputs of each part. During the SM4 white-box encryption process, the output result of the lookup table can be obtained by searching based on the data input to the lookup table, thus achieving the encoding. Using lookup tables not only saves operational overhead during SM4 white-box encryption but also hides the internal encryption encoding, thereby improving security.

[0082] Referring to the Scholl-Lay SM4 white-box scheme, this application divides each round of white-box encryption operation in SM4 into three stages: a unified encoding part, a data masking part, and a data output part, and uses lookup tables or affine transformations to perform encryption at each stage. In the unified encoding part, this application can use a composite affine encoding strategy to encode the data. In the data masking part, it can use four types of lookup tables (including the added round key lookup table TK, the masked nonlinear lookup table MS, and the nonlinear permutation table). The data is encrypted using a lookup table (M) generated by a mask, and a third encoding strategy (D) can be used in the data output section. i and the fourth encoding strategy C i Encode the data. Furthermore, since the output of each lookup table in white-box cryptography is encoded, in the three stages of each round of white-box encryption, the encoding strategy for each lookup table should include using the input encoding to decode the input data to remove the output encoding added by the previous transformation, performing the corresponding transformation on the decoded data, and finally encoding the result of the current transformation with the output encoding to obtain the output data of the lookup table.

[0083] Figure 1 This is a flowchart illustrating the encryption operation during the SM4 white-box implementation in one embodiment of the present invention. Figure 1 As shown, each round of encryption operation includes steps S110-S140.

[0084] Step S110: As Figure 2 As shown, in the unified encoding section, the last three sets of data in the current round of input data are uniformly encoded using the second encoding strategy, and the three sets of unified encoding results are XORed to obtain a set of 32-bit first intermediate data. The second encoding strategy is a pre-set encryption algorithm, which can be used to directly encode data during the SM4 white-box encryption process.

[0085] More specifically, since the input data may carry different affine codes in each round of encryption (for example, the affine codes carried by the input data X1, X2, X3, and X4 in the first round are P, P, P, and P′4, respectively), to facilitate subsequent encryption operations, the last three sets of data in the current round's input data need to be uniformly affine-coded. The input data for the i-th round of white-box encryption can be represented as X i X i+1 X i+2 and X i+3 Take the last three sets of data X from the input data of the i-th round. i+1 X i+2 and X i+3 These can be used as inputs, and the second encoding strategy can be used to process the last three sets of data X. i+1 X i+2 and X i+3 By performing unified affine coding, the encoded X′ can be obtained. i+1 , X′ i+2 and X′ i+3 ; Regarding the result X′ of the operation i+1 , X′ i+2 and X′ i+3 The first intermediate data Y can be obtained through XOR operation. i .

[0086] In some embodiments of the present invention, the second encoding strategy is: for the last three sets of data X of the i-th round of input data... i+1 X i+2 or X i+3 Perform the corresponding inverse affine transformations respectively, using the 32nd order invertible second affine code. The obtained inverse affine transformation result is encoded; wherein, the second affine encoding... It consists of four 8th-order invertible affine transformations.

[0087] More specifically, in the unified encoding section, after performing composite affine encoding on the last three sets of data in the current round of input data, the 32-bit first intermediate data Y can be obtained by using an XOR operation. i If we denote the second encoding strategy in this part as M... i+k The composite encoding part mainly encodes the 32-bit X. i+k (k = 1, 2, 3) undergoes affine transformation M i+k Then, an XOR operation is performed to obtain the 32-bit Y. i .

[0088] Furthermore, affine transformation M i+k Can be recorded as in, For X i+k The inverse transformation corresponding to the 32nd order invertible affine transformation carried, such as the last three sets of data X1, X2, and X3 in the zeroth round (i=0) input data. All are P -1 The last three sets of data X2, X3, and X4 in the first round (i=1) input data correspond to P respectively -1 P -1 and The last three sets of data X3, X4, and X5 in the second round (i=2) input data correspond to P respectively -1 , and E is a 32nd order invertible affine transformation i The inverse, consisting of 4 E i，j The expression (i = 0, 1, 2, ..., 31, j = 0, 1, 2, 3) can be represented as diag(E) i，0 E i，1 E i，2 E i，3 ), where each E i，j Both are 8th-order invertible affine transformations, E i，j It can be represented as

[0089] As an example, this application may employ A uniform affine transformation can be performed on the last three sets of data in the current round of input data, or E can be used. i The present invention is not limited to performing a uniform affine transformation on the last three sets of data in the current round of input data.

[0090] The unified encoding part obtains the 32-bit first intermediate data Y through three composite affine transformations and two XOR operations. i Its encoding process can be represented by the following formula:

[0091]

[0092] Step S120: Split the first intermediate data Y bit by bit. i The first intermediate byte Y obtained i，j and by bit splitting the white box wheel key wbrk i The corresponding round key byte wbrk obtained i，j Input the first lookup table to obtain four groups of 8-bit second intermediate bytes T. i，j Among them, the white-box round key wbrk i It is based on 32-bit data pre-generated from an input key with dynamic update capability (e.g., the input key can be updated according to changes in plaintext data Q).

[0093] To ensure encryption security, this application employs a lookup table that hides encoded information in the data masking section, instead of directly encoding the data. Furthermore, to avoid buffer overflows due to an excessively large lookup table, the input and output data of the lookup table can be split in the data masking section. This application uses an 8-bit input lookup table for encryption, which saves storage space and improves encryption speed.

[0094] The data masking part involves adding a round key lookup table TK (first lookup table), a masking nonlinear lookup table MS (second lookup table), and a nonlinear permutation table. A lookup table M is generated using the mask. A round key lookup table TK is added to combine the output data Y from the unified coding section. i With white box wheel key wbrk i The purpose of adding a mask to the nonlinear lookup table MS is to add a Boolean mask (maskv) to the result of the S-box operation. i，j This further conceals the correlation between the actual intermediate value and the key; in addition, each round of white-box encryption requires the use of a randomly generated non-linear permutation table. Generate a lookup table M using the mask, and obtain the second mask maskv corresponding to the output result of the S-box. i，j The first mask Mv corresponding to the current round's output data i+4 .

[0095] The added round key lookup table TK takes two 8-bit data inputs and outputs one 8-bit data. To accommodate the input and output byte counts of the added round key lookup table TK, this application uses a 32-bit white-box round key wbrk. i The round key is split into four 8-bit bytes (wbrk). i，j And the 32-bit first intermediate data Y i The first intermediate byte Y is split into four 8-bit bytes.i，j That is, wbrk i Bitwise splitting into wbrk i，0 wbrk i，1 wbrk i，2 and wbrk i，3 Y i Bitwise split into Y i，0 Y i，1 Y i，2 and Y i，3 Based on wbrk i，j In wbrk i，j The position in the middle and Y i，j In Y i The position (j = 0, 1, 2, 3) in the code corresponds to the round key byte wbrk. i，j and the first intermediate byte Y i，j Input the round key lookup table TK, and obtain the 8-bit second intermediate byte T by searching. i，j Specifically, wbrk i，0 and Y i，0 Inputting the added round key lookup table TK will yield T. i，0 wbrk i，1 and Y i，1 Inputting the added round key lookup table TK will yield T. i，1 wbrk i，2 and Y i，2 Inputting the added round key lookup table TK will yield T. i，2 wbrk i，3 and Y i，3 Inputting the added round key lookup table TK will yield T. i，3 .

[0096] To ensure simultaneous encoding of lookup table TK, this application uses four different lookup tables TK obtained from the previous round's key additions for encoding in the current round. Specifically, each lookup table TK is input with its corresponding 8-bit Y. i，j and 8-bit wbrk i，j Finally, by combining the output results of the four lookup tables TK, four groups of 8-bit second intermediate bytes T are obtained. i，j Adding a round key lookup table TK requires 2... 8 *2 8 *8 bits = 2 6 KB; Each round of white-box encryption requires 4 additional rounds of key lookup table TK pairs split into wbrk. i，j and Y i，j To perform the search, a total of 32 rounds of white-box encryption operations are required. 6 KB * 4 * 32 = 2 3 MB of storage space.

[0097] Because this application will use wbrk during the encryption process i，j and Y i，j As input parameters, the added round key is obtained by performing a lookup operation in the added round key lookup table TK. i，j When the input key is changed, only the white-box wheel key in the input wheel key lookup table TK needs to be dynamically changed; the lookup table itself does not need to be changed. That is, in this application, the white-box wheel key is not bound to the lookup table.

[0098] Current proposed improved SM4 white-box encryption schemes against DCA attacks mainly achieve this by adding 8th-order nonlinear encoding to further obfuscate the correlation between intermediate data and the key, such as the improved scheme by Yuan Ziqing, Zhang Yueyu, and others. However, the introduction of nonlinear encoding makes it impossible to directly XOR intermediate data carrying the same encoding; it can only be done with the aid of an XOR lookup table. Therefore, the introduction of 8th-order nonlinear encoding will bring greater memory overhead to the SM4 white-box encryption scheme, making it unsuitable for resource-constrained scenarios. Considering the security of the round key and memory resources, this application only adds 8th-order nonlinear encoding to the round key part, enabling the proposed dynamic SM4 white-box encryption scheme to resist DCA attacks at a lower cost.

[0099] Furthermore, since the white-box round key in this application is generated based on a dynamically changing input key (the input key changes each time the SM4 white-box encryption process is performed, i.e., the input key corresponds to different plaintext data), this application can introduce a dynamic white-box round key in the data masking part, which increases the complexity of the SM4 white-box encryption process.

[0100] In some embodiments of the present invention, the white-box wheel key generation process is as follows:

[0101] Based on the 32nd order invertible third affine code W i And an 8th-order invertible nonlinear concatenated code OUT(x), using a 32-bit round key rk i Obtain the white box wheel key wbrk i Among them, the third affine code W i It consists of four 8th-order invertible affine transformations. That is, this application can first derive the round key rk for 32 rounds of iterative encryption based on the input key using a key arrangement algorithm. i Then, based on the round key of each round, the corresponding white-box round key wbrk is obtained. i The generation process of the white-box round key can be divided into the following two cases:

[0102] (1) For each round, the round key rk i Byte-based, using an 8-bit round key byte rk i，j Obtain the 8-bit round key byte wbrki，j This leads to the white-box round key wbrk corresponding to the 32 rounds of white-box encryption operations. i .

[0103] More specifically, the 32-bit round key rk i The key is split bitwise into four 8-bit round key bytes to obtain rk. i，0 rk i，1 rk i，2 and rk i，3 (can be collectively referred to as rk) i，j ); due to the 32nd order invertible third affine code W i It consists of four 8th-order invertible affine transformations, which can be represented as W. i =diag(W i，0 W i，1 W i，1 W i，3 (W) i，j An 8th-order invertible affine transformation can be represented as The value of j can be determined based on the value of j (i.e., based on the round key byte rk). i，j In round key rk i The position in the middle and W i，j In the third affine code W i (position in the middle), using the corresponding W i，j Wheel key byte rk i，j Perform affine transformation (W) i，j and the corresponding rk i，j (The j values ​​are the same); To improve the nonlinear effect of encryption, this application also utilizes an 8th-order invertible nonlinear concatenated code OUT(x) (hereinafter referred to as nonlinear code OUT(x)) to W i，j The affine transformation result is encoded to generate the round key byte wbrk. i，j By cascading the corresponding round key bytes wbrk i，j The white-box round key wbrk corresponding to the i-th round of white-box encryption operation can be obtained. i The nonlinear concatenated code OUT(x) can be randomly generated, satisfying x = OUT(IN(x)).

[0104] With rk i，j The process of generating white-box round keys for a unit is as follows: Figure 3 As shown, this can be expressed by the formula:

[0105] wbrk i，j =OUT(W i，j (rk i，j ));

[0106] (2) For each round, the round key rk i , with rki The unit is directly derived from the 32-bit round key rk. i Generate a 32-bit white-box round key wbrk i .

[0107] More specifically, this application can utilize a 32nd-order invertible third affine code W i 32-bit round key rk i Perform an affine transformation and use the 8th-order nonlinear concatenated code OUT(x) to transform the third affine code W. i The affine transformation result is encoded to directly generate the white-box round key wbrk corresponding to the i-th round of white-box encryption operation. i . with rk i The process of generating white-box wheel keys for a unit can be represented by the following formula:

[0108] wbrk i =OUT(W i (rk i ));

[0109] However, with 32-bit rk i Performing TK table operations on a per-unit basis is costly, consumes a lot of storage space, and is relatively slow.

[0110] As an example, when the white-box wheel key needs to be updated, the input key can be generated using a random algorithm or a specified key can be used. When updating the white-box wheel key, after updating the input key, the white-box wheel key can be generated using either of the above methods, and the updated white-box wheel key can be used as an input parameter of the lookup table TK, without needing to update the entire white-box encryption process. This application's method of generating the white-box wheel key separately reduces the cost of updates and improves update efficiency.

[0111] When adding a round key lookup table TK in the data masking section, the round key byte wbrk can be used. i，j and the first intermediate byte Y i，j The second intermediate byte T of 8 bits is obtained by searching. i，j Due to the round key byte wbrk i，j and the first intermediate byte Y i，j The encoding strategy for adding a round key lookup table (TK) can be specifically divided into round key byte (wbrk) depending on the encoding carried. i，j The matrix portion of the affine code (i.e., the third affine code) and the first intermediate byte Y are carried. i，j There are two cases: the matrix parts of the carried affine code (i.e., the second affine code) are the same and different.

[0112] In some embodiments of the present invention, such as Figure 4As shown in (a), in the 32nd order invertible third affine code W i The matrix part and the 32nd order invertible second affine code When the matrix parts are the same (at this time) The encoding strategy for the first lookup table (i.e., the added round key lookup table TK) includes:

[0113] Using 8th-order inverse nonlinear concatenated encoding IN(x) to generate the round key byte wbrk i，j Encode;

[0114] Based on the first intermediate byte Y i，j Y in the first intermediate data i Position and round key bytes wbrk i，j In the white box wheel key wbrk i The position in the middle will be the round key byte IN(wbrk) after inverse nonlinear encoding. i，j ) and the corresponding first intermediate byte Y i，j Perform an XOR operation (i.e., IN(wbrk) with the same j value). i，j ) and Y i，j (Perform XOR operation);

[0115] The XOR operation result obtained by the 8th-order nonlinear code OUT(x) Encode the data and output a second set of intermediate bytes.

[0116] In the third affine code W i The matrix part and the second affine encoding When the matrix parts are the same, the round key byte wbrk is eliminated using the 8th-order inverse nonlinear encoding IN(x). i，j After carrying the non-linear encoding, IN(wbrk) can be directly processed. i，j ) and the first intermediate byte Y i，j An XOR operation is performed. Furthermore, to ensure the non-linear effect of the lookup table output, this application uses an 8th-order non-linear code OUT(x) to encode the XOR operation result.

[0117] like Figure 4 As shown in (b) above, in the 32nd order invertible third affine code W i The matrix part and the 32nd order invertible second affine code When the matrix portion differs, the encoding strategies for adding the round key lookup table TK include:

[0118] The round key byte wbrk is generated using the 8th-order inverse nonlinear encoding IN(x). i，j Encode;

[0119] Based on the corresponding 8th-order affine transformation W in the third inverse affine encoding i，j -1 The round key byte IN(wbrk) after inverse nonlinear encoding i，j Perform the corresponding affine transformation, and utilize the corresponding 8th-order affine transformation in the second affine code. The obtained affine transformation result is encoded to obtain In this step, wbrk with the same j value must be selected. i，j W i，j -1 and Encode;

[0120] Based on the first intermediate byte Y i，j Y in the first intermediate data i Position and round key bytes wbrk i，j In the white box wheel key wbrk i The position in the middle will be the round key byte after the second affine encoding. With the corresponding first intermediate byte Y i，j Perform an XOR operation (at this time, the wbrk performs the XOR operation) i，j and Y i，j (The j values ​​are the same in both cases);

[0121] The result of the XOR operation is encoded using an 8th-order nonlinear code OUT(x), and a second set of intermediate bytes is output.

[0122] For example, in the third affine encoding W i The matrix part and the second affine encoding In cases where the matrix parts differ, wbrk i，0 and Y i，0 Get T i，0 The specific process can be as follows:

[0123] The round key byte wbrk is generated using the 8th-order inverse nonlinear encoding IN(x). i，0 Encode;

[0124] Based on the third inverse affine code W i The corresponding 8th order affine transformation W i0 -1 The round key byte IN(wbrk) after inverse nonlinear encoding i，0 Perform the corresponding affine transformation and use the second affine code. The corresponding 8th order affine transformation The obtained affine transformation result is encoded to obtain

[0125] Based on the first intermediate byte Y i，j Y in the first intermediate data i Position and round key bytes wbrk i，j In the white box wheel key wbrk i The position in the middle determines Y. i，0 With wbrk i，0 Corresponding; the round key bytes after the second affine encoding With the corresponding first intermediate byte Y i，0 Perform an XOR operation;

[0126] The result of the XOR operation is encoded using an 8th-order nonlinear code OUT(x), and a second set of intermediate bytes is output.

[0127] As an example, in the third affine coding W i The matrix part and the second affine encoding In cases where the matrix portion differs, the encoding strategy for adding a round key lookup table TK can also be to use the first intermediate byte Y. i，j The affine code carried Convert to W i，j In this way, we obtain the affine code W. i，j The second intermediate byte T i，j .

[0128] Second intermediate byte T i，j (i.e. T) i，0 T i，1 T i，2 and T i，3 Cascading can yield 32 bits of second intermediate data T for the i-th round. i Because this application requires the 8-bit second intermediate byte T... i，j The input is a masked nonlinear lookup table MS. To reduce the number of operation steps, the output result of the round key lookup table TK (i.e., the second intermediate byte T) can also be omitted. i，j Perform cascading operations.

[0129] To reduce memory consumption, this application separates the nonlinear S-box and linear transformation L of the SM4 encryption algorithm, and uses a masked nonlinear lookup table MS to perform S-box operations, thereby encoding the input and output data of the lookup table MS; furthermore, this application combines the linear operation L with the affine transformation, and applies them respectively to the third intermediate data Z. i Second mask maskv i，j Composite affine coding.

[0130] Step S130: In the data masking part, a 32-bit demasking mask can be used to demask the output result of the added round key lookup table TK, and byte substitution and masking operations are performed on it through the masking nonlinear lookup table MS to output 32-bit third intermediate data Z. i Specifically, the 32-bit demasking code RM will be split bit by bit. i The obtained 8-bit demasking code byte RM i，j and the corresponding second intermediate byte T i，j Input the second lookup table (i.e., the masked non-linear lookup table MS), and find the 8-bit third intermediate byte Z. i，j The third intermediate byte Z output from the lookup table MS. i，j Cascading yields a set of 32-bit masked third intermediate data Z. i , can be represented as Z i =Z i，0 ||Z i，1 ||Z i，2 ||Z i，3 .

[0131] The main purpose of the masked nonlinear lookup table MS is to perform byte substitution operations using a nonlinear S-box and mask the results. This ensures that the second intermediate byte T is simultaneously processed. i，j For encoding, this application selects four masked nonlinear lookup tables (MS) in the current round. One masked nonlinear lookup table (MS) requires 2... 8 *2 8 *8 bits = 2 6 KB; Each round of white-box encryption requires 4 masked non-linear lookup tables MS to T i，j and split RM i，j To perform the search, a total of 32 rounds of white-box encryption operations are required. 6 KB * 4 * 32 = 2 3 MB of storage space.

[0132] In some embodiments of the present invention, such as Figure 5 As shown, the encoding strategy for the masked nonlinear lookup table MS includes:

[0133] Based on the second intermediate byte T i，j Second intermediate data T i Position and unmasking code byte RM i，j In the demask RMi, determine the corresponding second intermediate byte and demask byte (i.e., RM with the same j value). i，j and T i，j (Identify the corresponding second intermediate byte and masking byte);

[0134] Based on the 8th-order inverse nonlinear code IN(x) and the second inverse affine code E i The second intermediate byte is encoded based on the 32nd order reversible fourth affine code H. i The corresponding demasking code byte RM i，j Encode the data, and then perform an XOR operation between the encoded second intermediate byte and the corresponding encoded masking byte.

[0135] The XOR operation result is performed using an S-box, and then byte-by-byte substitution is performed using a pre-defined second mask. i，j Perform a masking operation on the search results of the S-box;

[0136] Based on the 32nd order invertible fifth affine code G i The result of the masking operation is encoded to obtain an 8-bit third intermediate byte Z. i，j .

[0137] Among them, the fourth affine code H i and the fifth affine code G i Each consists of four 8th-order invertible affine transformations, which can be represented as H. i =diag(H i，0 H i，1 H i，2 H i，3 ) and G i =diag(G i，0 G i，1 G i，2 G i，3 ), H i，j and G i，j Both are 8th-order invertible affine transformations, which can be represented as H respectively. i，j (x)=lH i，j (x)(i.e., the fourth affine code H) i (the constant part is 0) and Using the fourth affine code H i and the fifth affine code G i During encoding, the corresponding H values ​​with the same j value as the data in the input masked nonlinear lookup table MS must be selected respectively. i，j and G i，j .

[0138] More specifically, the second intermediate byte T of 8it with the same j value. i，j and 8-bit demasking byte RM i，j As input to the lookup table MS, the 8-bit third intermediate byte Z can be output. i，j The encoding strategy for the masked nonlinear lookup table MS can be:

[0139] Using the fourth affine code Hi The corresponding 8th order affine transformation H i，j Cancel masking byte RM i，j Perform input decoding to obtain H i，j (RM i，j ); using 8th-order inverse nonlinear coding IN(x) and second inverse affine coding E i The corresponding 8th order affine transformation E i，j For the second intermediate byte T i，j Perform input decoding to obtain E i，j (IN(T i，j ));

[0140] Perform an XOR operation on the decoded data to obtain The result of the XOR operation is used to perform byte substitution using an S-box (the S-box is a fixed 8-bit input, 8-bit output substitution). The search results of the S-box are masked using the pre-calculated second mask to obtain...

[0141] Using the fifth affine code G i The corresponding 8th order affine transformation G i，j The result of the masking operation is encoded to obtain the third intermediate byte.

[0142] For example, in round i, T i，0 and RM i，0 Input a masked nonlinear lookup table MS, and output Z. i，0 The specific encoding process can be as follows:

[0143] Using 8th-order inverse nonlinear concatenated coding IN(x) and second inverse affine coding E i The 8th order affine transformation E i，0 For the second intermediate byte T i，0 Encode to obtain E i，0 (IN(T i，0 Using an 8th-order affine transformation H i，0 Cancel masking byte RM i，0 Encode to obtain H i，0 (RM i，0 );

[0144] H i，0 (RM i，0 ) and E i，0 (IN(T i，0 Perform an XOR operation and then use the S-box to perform byte substitution on the XOR result to obtain... Using the second mask maskv i，0The output of the S-box is masked by XOR operation to obtain... Using the 8th order affine transformation G i，0 The result of the masking operation is encoded to obtain

[0145] In some embodiments of the present invention, since the constant part of the affine code can be removed when performing an XOR operation on data carrying the same affine code, the second intermediate byte T carrying the second affine code is used in the encoding strategy of the masked nonlinear lookup table MS. i，j When performing input decoding, it is necessary to use the third affine code W. i For the second inverse affine code E i A limitation is imposed. That is, in the matrix part lW of the third affine encoding. i (x) and the matrix part lE of the second affine encoding i -1 If (x) is the same, and the third affine code W i If the constant is not 0, then the second inverse affine code is the matrix part of the inverse code corresponding to the second affine code; if the third affine code W i If the constant is 0, then the second inverse affine code is the inverse code corresponding to the second affine code.

[0146] More specifically, in the matrix part lW of the third affine encoding i (x) and the matrix part lE of the second affine encoding i -1 If (x) is the same, and the third affine code is a linear code (i.e., W) i =lW i (x)), then since the second affine code can be expressed as Second intermediate byte T i，j The carried affine code includes the constant part of the second affine code; therefore, the second inverse affine code in the encoding strategy of the lookup table MS is the inverse code corresponding to the second affine code, i.e. If the constant of the third affine code is not 0 (i.e.) Then, since the second affine code can be represented as Second intermediate byte T i，j The carried affine code does not include the constant part of the second affine code; therefore, the second inverse affine code in the encoding strategy of the lookup table MS is the matrix part of the inverse code corresponding to the second affine code, i.e., E. i =lE i (x).

[0147] Furthermore, the data masking section also includes the use of nonlinear permutation tables. The mask generation lookup table M generates the second mask corresponding to the output result of the S-box of the current round. i，j The first mask Mv corresponding to the current round's output data i+4 The unmasking byte is obtained by applying the first mask Mv corresponding to the last three groups of data in the current round of input data. i+4 The result obtained by XOR operation is used to remove the second mask added in the previous round through the second lookup table MS. For example, the last three sets of data X in the input data of the i-th round. i+1 X i+2 and X i+3 The corresponding first masks are Mv i+1 Mv i+2 and Mv i+3 Then the i-th round However, during the zeroth round of white-box encryption (where i = 0), since the input data X0, X1, X2, and X3 obtained from the plaintext data Q-encoded are not masked, no demasking step is needed in the zeroth round. The first masks Mv1, Mv2, and Mv3 corresponding to X1, X2, and X3 can be preset to 0, resulting in RM0 = 0. Therefore, during the zeroth round of white-box encryption, the data input to the masked nonlinear lookup table MS can be the 8-bit second intermediate byte T. i，j And 0, by searching the output, we can obtain the 8-bit third intermediate byte Z. i，j For example, in the first round (where i=1), the first masks corresponding to the input data X2, X3, and X4 are Mv2, Mv3, and Mv4, respectively, which are 0, 0, and Mv4. Therefore...

[0148] The output data X of the i-th round i+4 The corresponding first mask Mv i+4 It is based on the four sets of second intermediate bytes T in the i-th round. i，j The specific process of generation is as follows: Figure 6 As shown. In the i-th round, this application utilizes the 8-bit second intermediate byte T obtained. i，j Nonlinear permutation table The index, and the non-linear permutation table The search result is used as a mask to generate the index of the lookup table M, and the second intermediate byte T of the i-th round is obtained respectively. i+1，j The corresponding second mask maskv i+1，j Using the eighth affine code J i The obtained second mask maskv i By performing an affine transformation, we can obtain the output data X of the i-th round. i+4 The corresponding first mask Mv i+4 .

[0149] More specifically, nonlinear permutation tables The input is an 8-bit data T i，j The output is an 8-bit non-linear permutation data. The mask generation lookup table M can be input with an 8-bit data (i.e., The output is the second mask corresponding to the nonlinear S-box output result. in, Indicates T i，j For indexing, nonlinear permutation tables If we perform a continuous search j times, for example, when j=2, the result of the first search is... The second search result was When j = 0, it means that T i，j For indexing, nonlinear permutation tables The search is performed 0 times consecutively, therefore when j=0, maskv i，j =M(T) i，0 When j = 1, 2, 3, That is, it can be based on the second intermediate byte T i，j Second intermediate data T i The position in the table determines its position in the nonlinear permutation table. The number of indexes in the data.

[0150] Furthermore, in this application, the first mask Mv i+4 Mainly through nonlinear permutation tables Mask generation lookup table M and eighth affine code J i Obtained. The four sets of second masks (maskv) obtained through cascading the i-th round. i，0 maskv i，1 maskv i，2 and maskv i，3 Get a 32-bit mask. i And based on the 32nd order eighth affine code, the concatenated result maskv i Encoding yields the first mask Mv corresponding to the output data of the i-th round. i+4 Among them, the eighth affine code J i It can be represented as Where, N i The inverse encoding of the affine transformation corresponding to the lookup table M for the mask can be represented as follows: H is a fourth linear code of order 32. i The inverse encoding of , where L represents the linear transformation.

[0151] Furthermore, each round of white-box encryption operation only generates a non-linear permutation table randomly. Generate a lookup table M with a mask, based on each second intermediate byte T. i，j A fixed number of indexes are used to look up a nonlinear permutation table. Then, using the search results, a lookup table M is generated by further searching for the mask. The second mask corresponding to the output result of the current round S box can be obtained, and the data is masked based on the second mask.

[0152] As an example, the mask generation lookup table M can be generated using a random algorithm, the process of which is as follows: Iterate through 0-255 as x, generating a random number using a random number generator during each iteration. Divide this random number by 256 and take the remainder m. Then, use the 8th-order invertible affine code N used for the mask. i -1 Perform an affine transformation on the remainder m, and then transform the result N of the affine transformation. i -1 (m) represents the result M(x) obtained by generating the lookup table M using x as the index as the lookup mask. Specifically, the random algorithm for generating the lookup table M using the lookup mask can be:

[0153]

[0154] Nonlinear permutation table It can be generated through a random algorithm, the process of which is as follows: Initially, x is used as the index to search the nonlinear permutation table. The results obtained Given x itself, iterate through the numbers 0-255 sequentially using x as the index. During each iteration, generate a random number using a machine number generator, divide this random number by 256 and take the remainder s. Swap the nonlinear permutation table search using x as the index and the remainder s as the index. The result is then used to look up the nonlinear permutation table using the random number x as an index. The result obtained is Specifically, the random algorithm for generating the lookup table M by generating the mask can be expressed as:

[0155]

[0156] Due to the masking code RM i It can be pre-calculated and generated. To save memory resources, this application uses a non-linear permutation table. A mask-generated lookup table M for encryption and an affine transformation J i Obtain the first mask Mv i+4 That's it. A nonlinear permutation table. Requires 2 8 *8 bits = 2 8 B, generating a lookup table M from a mask requires 2... 8 *8 bits = 2 8B; Each round of white-box encryption operation requires a non-linear permutation table. And the mask generates a lookup table M, therefore, during the 32 rounds of white-box encryption operations, the nonlinear permutation table A total of 2 are needed 8 B*32=2 3 It requires KB of storage space, and the mask generation lookup table M requires a total of 2 KB. 8 B*32=2 3 KB of storage space.

[0157] As an example, since the data masking part involves the process of data demasking and masking, that is, removing the mask added in the previous round and adding a new mask after the corresponding transformation, the demasking mask can be calculated in advance in the unified coding part, or it can be calculated before the data masking part performs demasking.

[0158] Step S140: Transfer the third intermediate data Z i The encoding result obtained by linear transformation based on the third encoding strategy is compared with the first set of data X in the current round's input data. i The encoding result obtained by the fourth encoding strategy is XORed to obtain the output data X of the i-th round. i+4 .

[0159] More specifically, in the entire SM4 white-box encryption process, the data output section is mainly used to determine the output data Z from the data masking section. i Get the wheel output X i+4 .like Figure 2 As shown, in the data output section, the third intermediate data Z i Directly using the third encoding strategy D i Encoding yields D i (Z i The first set of data X in the current round of input data. i Through the fourth encoding strategy C i Encoding can yield C i (X i ); D i (Z i ) and C i (X i XOR encoding can be used to obtain the output data of the i-th round.

[0160] In some embodiments of the present invention, the third encoding strategy D i for:

[0161] Using the 32nd order fifth inverse affine code G i -1 For the third intermediate data Z iPerform affine operations, apply a linear transformation L to the result, and then apply the result based on the 32nd-order sixth affine code P′. i+4 The obtained linear transformation result is encoded, i.e., the third encoding strategy D. i This can be expressed by the formula:

[0162] Fourth encoding strategy C i For: the first set of data X in the current round of input data i Perform the corresponding inverse affine transformation and use the 32nd order seventh affine code P″ i+4 The obtained inverse affine transformation result is encoded, i.e., the fourth encoding strategy C. i This can be expressed by the formula: For example, if the affine code corresponding to the first set of data X0 in the zeroth round (i=0) is P, then... The affine code corresponding to the first set of input data X4 in the fourth round (i=4) is P4.

[0163] Sixth affine code P′ i+4 It can be represented as P′ i+4 =lP′ i+4 (x)+cP′ i+4 The seventh affine code P″ i+4 It can be represented as P″ i+4 =lP″ i+4 (x)+cP″ i+4 Furthermore, the sixth affine code P′ in the i-th round i+4 The matrix part and the seventh affine code P″ i+4 The matrix parts are the same, and the constant cP′ of the sixth affine code is the same. i+4 The constant cP″ of the seventh affine code i+4 The result obtained after the XOR operation is the current round output data X. i+4 The corresponding affine coding constant cP i+4 ,Right now

[0164] Third encoding strategy D i This can be viewed as a composite affine coding. Similarly, the fourth coding strategy C i It can also be viewed as a composite affine coding. That is, the data output part can be implemented through two composite affine transformations and one XOR operation.

[0165] After 32 rounds of white-box encryption, this application can extract the last three sets of data (X) from the input data of the final round of white-box encryption (i.e., i=31, the 31st round of white-box encryption). 31 X 32 X33 and X 34 ) and the output data X of the last round 35 Each is associated with the corresponding first mask Mv i+4 Perform an XOR operation and reverse the four XOR results to obtain the corresponding SM4 ciphertext. That is, the 128-bit ciphertext obtained by SM4 white-box encryption of 128-bit plaintext data Q in this application can be represented as follows:

[0166] The SM4 white-box encryption method proposed in this application has the following advantages:

[0167] (1) This application enables dynamic white-box encryption. Traditional static round keys require updating the lookup table and affine operation throughout the entire white-box encryption process before white-box encryption can be performed. In contrast, this application uses dynamic round keys for white-box encryption, offering greater flexibility. Specifically, when the white-box round key needs to be updated, the updated white-box round key can be added by adding it to the round key lookup table TK. Furthermore, in scenarios requiring frequent updates to the white-box round key, only the round key rk needs to be used. i Generate a new white-box wheel key wbrk i The subsequent white-box encryption process can be completed quickly. That is, this application combines the process of adding a round key lookup table TK and generating a white-box round key from the round key, so that the round key can be changed at any time for dynamic white-box encryption.

[0168] (2) Compared with the traditional static white-box scheme, this application only needs to update the white-box round key to complete the white-box encryption update process. The update cost is only 128B (while the update cost of the static white-box scheme is at least KB level, and can reach MB level to cope with DCA attacks). The update time is in microseconds, resulting in higher update efficiency (since the static white-box scheme involves updating the entire encryption program, the update time is usually measured in seconds).

[0169] (3) The white-box encryption method proposed in this application has universality. Although the WBDL algorithm can dynamically select the key to complete white-box encryption each time, the final encryption result of the scheme is different from the standard algorithm because the order of use of the round keys is completely shuffled during encryption, which makes the scheme lack universality. The white-box encryption method proposed in this application is based on the SM4 encryption algorithm and uses the round keys in the iterative order to ensure the consistency of the encryption result with the standard algorithm, making the scheme universal.

[0170] Corresponding to the above method, the present invention also provides an electronic device, which includes a computer device, the computer device including a processor and a memory, the memory storing computer programs / instructions, the processor executing the computer programs / instructions stored in the memory, and when the computer programs / instructions are executed by the processor, the electronic device performs the steps of the method as described above.

[0171] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0172] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0173] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0174] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations can be made to the embodiments of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An SM4 white-box encryption method, characterized in that, The method includes the following steps: The input plaintext data is split bit-by-bit to obtain four sets of data. A first encoding strategy is used to encode each of the four sets of data, and multiple rounds of white-box encryption are performed based on the encoding results. The encoding results of the four sets of data are used as the input data for the zeroth round of white-box encryption. Each subsequent round of white-box encryption uses the last three sets of data from the previous round's input data and the previous round's output data as the input data for the current round. The last three sets of input data and output data in the last round of white-box encryption are XORed with the corresponding first mask to obtain four sets of XOR results. The XOR results are then reversed to obtain the SM4 ciphertext. Each round of the white-box encryption operation includes: The second encoding strategy is used to uniformly encode the last three groups of data in the input data of the current round of white-box encryption operation, and the uniform encoding result is XORed to obtain a set of 32-bit first intermediate data. The first intermediate byte obtained by bitwise splitting the first intermediate data and the corresponding wheel key byte obtained by bitwise splitting the white-box wheel key are input into the first lookup table to obtain four sets of 8-bit second intermediate bytes; wherein, the white-box wheel key is 32-bit data pre-generated using the dynamically updatable input key; The demasking byte obtained by bitwise splitting the 32-bit demasking byte and the corresponding second intermediate byte are input into the second lookup table to obtain a set of 32-bit masked third intermediate data. The demasking byte is obtained by XORing the first mask corresponding to the last three sets of data in the current round of input data, and is used to remove the second mask added in the previous round through the second lookup table. The encoding result obtained by transforming the third intermediate data based on the third encoding strategy is XORed with the encoding result obtained by the first group of data in the input data through the fourth encoding strategy to obtain the output data of the current round of white-box encryption operation.

2. The method of claim 1, wherein, The first encoding strategy is a 32-order invertible first affine encoding; The second encoding strategy is: The inverse affine transformations are performed on the last three sets of data in the current round of input data, and the results of the inverse affine transformations are encoded using a 32nd-order invertible second affine code; wherein the second affine code consists of four 8th-order invertible affine transformations.

3. The method of claim 2, wherein, The white-box round key is obtained in the following way: Based on the 32nd order invertible third affine coding and the 8th order invertible nonlinear coding, a white-box round key is obtained using a 32-bit round key; where the round key is obtained from the input key through a key arrangement algorithm, and the third affine coding consists of four 8th order invertible affine transformations.

4. The method of claim 3, wherein, When the matrix part of the third affine encoding is the same as the matrix part of the second affine encoding, the encoding strategy of the first lookup table includes: The round key bytes are encoded using an 8th-order inverse nonlinear encoding. Based on the position of the first intermediate byte in the first intermediate data and the position of the round key byte in the white-box round key, the round key byte after inverse nonlinear encoding is XORed with the corresponding first intermediate byte. The XOR operation result is encoded by 8-order nonlinear encoding, and the second intermediate byte is outputted; In the case that the matrix part of the third affine encoding is different from the matrix part of the second affine encoding, the encoding strategy of the first lookup table comprises: The round key byte is encoded by 8-order inverse nonlinear encoding; The round key byte encoded by the inverse nonlinear encoding is subjected to corresponding affine transformation based on the third inverse affine encoding, and the affine transformation result is encoded by the second affine encoding; The round key byte subjected to the second affine encoding is subjected to XOR operation with the corresponding first intermediate byte based on the position of the first intermediate byte in the first intermediate data and the position of the round key byte in the white-box round key; The XOR operation result is encoded by 8-order nonlinear encoding, and the second intermediate byte is outputted.

5. The method of claim 4, wherein, The encoding strategy of the second lookup table comprises: The corresponding second intermediate byte and the unmasking mask byte are determined based on the position of the second intermediate byte in the second intermediate data and the position of the unmasking mask byte in the unmasking mask, wherein the second intermediate data is obtained by concatenating the four groups of 8-bit second intermediate bytes; The second intermediate byte is encoded based on 8-order inverse nonlinear encoding and the second inverse affine encoding, the corresponding unmasking mask byte is encoded based on 32-order reversible fourth affine encoding, and the encoded second intermediate byte and the corresponding encoded unmasking mask byte are subjected to XOR operation; wherein the constant part of the fourth affine encoding is 0; The XOR operation result is encoded by 8-order nonlinear encoding, and the second intermediate byte is outputted. The XOR operation result is encoded by 8-order nonlinear encoding, and the second intermediate byte is outputted.

6. The method of claim 5, wherein, In the case that the matrix part of the third affine encoding is the same as the matrix part of the second affine encoding, If the constant of the third affine encoding is not 0, the second inverse affine encoding is the inverse encoding of the matrix part of the second affine encoding; If the constant of the third affine encoding is 0, the second inverse affine encoding is the inverse encoding of the second affine encoding.

7. The method of claim 5, wherein, The third encoding strategy is: The third intermediate data is subjected to affine operation by the fifth inverse affine encoding, the affine operation result is subjected to linear transformation, and the linear transformation result is encoded based on 32-order sixth affine encoding; wherein the third intermediate data is obtained by concatenating the four groups of third intermediate bytes based on the unmasking mask and the second intermediate data.

8. The method of claim 7, wherein, The fourth encoding strategy is: The first group of data in the current round input data is subjected to corresponding inverse affine transformation, and the inverse affine transformation result is encoded by 32-order seventh affine encoding; The matrix part of the sixth affine encoding of the current round is the same as the matrix part of the seventh affine encoding, and the constant of the sixth affine encoding and the constant of the seventh affine encoding are subjected to XOR operation to obtain the constant of the affine encoding corresponding to the current round output data.

9. The method of claim 5, wherein, The first mask is obtained by the following way: determining an index number corresponding to each group of the second intermediate bytes based on positions of the second intermediate bytes in the second intermediate data; taking each group of the second intermediate bytes in the current round as an index, respectively searching a pre-stored nonlinear permutation table according to the corresponding index number, and taking a search result of the nonlinear permutation table as an index, respectively searching a pre-stored mask generation lookup table to obtain four groups of second masks; concatenating the four groups of the second masks obtained and encoding the concatenation result based on an eighth affine encoding of a 32-order to obtain a first mask corresponding to output data of the current round; wherein the first mask corresponding to input data of the zeroth round is 0, and a mask elimination mask of the zeroth round is also 0; the encoding of the concatenation result based on the eighth affine encoding of the 32-order includes: performing affine operation on the concatenation result based on inverse encoding of an affine transformation corresponding to the mask generation lookup table, performing linear transformation on an obtained affine operation result, and encoding a result of the linear transformation through a fourth inverse affine encoding.

10. An electronic device comprising a processor, a memory, and a computer program / instructions stored on the memory, wherein, The processor is configured to execute the computer program / instruction, and when the computer program / instruction is executed, the electronic device implements the steps of the method in any one of claims 1 to 9.

Images