A minimum time delay s-box circuit search method based on an STP solver

Abstract

The application discloses a minimum time delay S-box circuit search method based on an STP solver, and through construction of a constraint model containing circuit topology, logic function and process library weighted delay, the automatic tool STP solver can automatically search out the S-box circuit satisfying specific cryptographic properties and having minimum physical delay under given logic gate quantity and depth limitation. The application considers the security of the S-box against cryptographic attacks, can accurately constrain and optimize the physical delay of the critical path, and can also utilize the low delay characteristics of the composite logic gate to realize exploration and determination of the time delay performance boundary of the S-box under specific process.

Description

Technical Field

[0001] This invention belongs to the field of circuit optimization, specifically relating to a method for searching the minimum delay S-box circuit based on an STP solver. Background Technology

[0002] The S-box (Substitution Box) is a crucial component in symmetric cryptography algorithms. Typically serving as the sole nonlinear transformation element, its primary function is to provide confusion properties, thereby ensuring the algorithm's resistance to various security threats such as differential cryptanalysis, linear cryptanalysis, and algebraic attacks. In the hardware implementation of cryptographic algorithms, the S-box often occupies a significant portion of the logic circuit area and power consumption. Therefore, optimizing the S-box circuit structure has always been a key research focus at the intersection of integrated circuit design and cryptography. With the advancement of modern communication technologies towards high speed and real-time capabilities, applications such as fiber optic communication, 5G networks, and high-frequency trading systems place extremely high demands on the data throughput of encryption chips. In these scenarios, the critical path delay of digital circuits becomes a physical bottleneck limiting the system's maximum operating frequency. Therefore, designing an S-box circuit with minimal physical delay while ensuring cryptographic security has become crucial for improving the overall performance of encryption systems.

[0003] Currently, using Electronic Design Automation (EDA) combined with Boolean Satisfiability (SAT) or Satisfiability Modular Theory (SMT) solvers to automatically search for S-box circuits has become a mainstream technique. Among existing solutions, the paper "HowSmall Can S-boxes Be?" discloses a representative automated search framework. This existing technology mainly focuses on the limit optimization of S-box hardware area. By combining the Prim algorithm with the SAT solver, it uses the Gate Equivalent (GE) of different logic gates in the standard cell library as the core optimization index to construct a search model that includes circuit topology constraints and cryptographic property constraints. This method aims to find the S-box circuit structure with the smallest silicon area occupied by standard logic gates (such as AND gates, OR gates, XOR gates, etc.), and based on this framework, it successfully proved the theoretical lower bound of the minimum area of ​​the 4-bit optimal S-box, providing an important reference scheme for pursuing low-cost and lightweight cryptographic applications.

[0004] While the aforementioned existing technologies have achieved significant results in minimizing the area of ​​S-cell circuits, they still have obvious limitations and shortcomings in circuit design for high-speed, low-latency applications. First, these existing technologies are solely driven by the goal of "minimum area," ignoring the trade-off often existing between circuit area and latency. In pursuit of extreme area reduction, the algorithms tend to reuse signals and perform deep logic cascading, resulting in circuits with fewer gates but excessively deep logic levels and long signal propagation paths, severely limiting the circuit's operating speed. Second, the search models of existing technologies fail to accurately reflect the physical characteristics of actual semiconductor processes. They typically assume that all logic gates have the same propagation delay or evaluate solely based on area weights, ignoring the significant latency differences between different types of logic gates (e.g., complex XOR gates versus simple NAND gates) in actual standard cell libraries. This means that the searched circuits are not truly the fastest circuits after physical implementation. Furthermore, the existing gate library construction is relatively conservative, failing to include composite logic gates with "multiple inputs and low latency" characteristics (such as MAOI, MOAI, and other AND, OR, and NOT gates) in the process library into the search space. As a result, the advantages of composite gates in compressing critical paths cannot be utilized, and the latency performance of the circuit cannot be further optimized. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method for searching for S-box circuits with minimum physical delay based on the STP solver. By constructing a constraint model that includes circuit topology, logic function, and technology library weighted delay, and utilizing the automated tool STP (Simple Theorem Prover) solver, it can automatically search for S-box circuits that satisfy specific cryptographic properties (such as bijectivity, differential uniformity, linearity, etc.) and have minimum physical delay, given constraints on the number and depth of logic gates. This invention considers the security of S-boxes against cryptographic attacks, can accurately constrain and optimize the physical delay of critical paths, and can also utilize the low-latency characteristics of composite logic gates to explore and determine the delay performance boundaries of S-boxes under specific technologies.

[0006] In a first aspect, embodiments of this application provide a method for searching the minimum delay S-box circuit based on an STP solver, comprising the following steps:

[0007] Step 1: Construct a general topology model for the S-box circuit

[0008] Step 1-1: Given initial parameters, including S-box bit width n, maximum number of logic gates k, target delay value, preset gate library set and corresponding gate delay.

[0009] Steps 1-2: Construct circuit variables, including main inputs, intermediate logic gate outputs, final outputs, wiring selectors, and gate type selectors, and implement functional constraints based on the gate type selectors.

[0010] Steps 1-3: Determine circuit topology constraints based on wiring selection variables to ensure the single-source and acyclic nature of circuit connections.

[0011] Step 2: Determine the weighted delay constraint. Based on the delay constraint model, recursively calculate the cumulative delay of each node in the general topology model, and constrain the maximum delay of the circuit to be less than or equal to the target delay value.

[0012] Step 3: Determine the cryptographic property constraints, traverse the input space, and ensure that the S-box circuit meets the requirements of bijectivity, differential uniformity, and linearity.

[0013] Step 4: Determine the symmetry breaking constraints and circuit depth constraints, and restrict the input and output order of the exchangeable gates and the S-box circuit depth, respectively.

[0014] Step 5: Transform the above model and constraints into the corresponding CVC file by writing a generator program, and then use the STP solver to solve it to obtain the minimum delay S-box circuit that meets the requirements.

[0015] In one possible implementation, the preset gate library set is an extended standard cell gate library, which includes basic logic gates and four-input logic gates MAOI and MOAI with low latency characteristics. The gate latency of different types of logic gates in the preset gate library set is determined based on actual process library parameters.

[0016] In one possible implementation, the circuit variables in the general topology model are specifically defined as follows:

[0017] The main input signal is ~ The output signal of the intermediate logic gate is ~ and the final output signal ~ .

[0018] Wiring selectors are used to describe the connection relationships of a circuit.

[0019] Gate type selectors are used to refer to each logic gate in the preset gate library set, implementing functional constraints. Through gate type selectors, the STP solver can automatically assign the optimal logic operation type to each node.

[0020] In one possible implementation, the circuit topology constraints are as follows:

[0021] For each logic gate's input port and the circuit's final output port, the signal source is constrained by routing selection variables to ensure that each port is connected to only one specific signal source (which can be the main input or the preceding logic gate), and index restrictions are used to ensure that there are no loops in the circuit.

[0022] In one possible implementation, unlike existing technologies that only use the number of logical layers as a latency metric, this invention establishes a latency constraint model based on a practical technology library, as follows:

[0023] The cumulative delay calculation is incorporated into the general topology model of the S-box circuit. A variable D is added to each node in the general topology model to record the cumulative delay. Each node includes intermediate logic gate outputs and the final output. For any logic gate G, the cumulative delay at its output is calculated. It is constrained to the maximum value of the arrival times of all its input signals plus the gate delay. The calculation logic is as follows:

[0024]

[0025] in, This represents the arrival time of the input signal.

[0026] Finally, define global delay constraints. This involves setting the critical path delay for the entire S-box circuit. Defined as the maximum cumulative delay of all final output signals, and constrained. Not greater than the preset target delay value .

[0027] In one possible implementation, the cryptographic property constraints are determined as follows:

[0028] The safety indices of the S-box are transformed into constraints recognizable by the STP solver, specifically including:

[0029] Bijective constraint: For any two different inputs, the corresponding circuit outputs must be different.

[0030] Difference uniformity constraint: For all non-zero input differences and output differences, count the number of inputs that satisfy the difference propagation equation, and constrain the maximum value of the difference pair to not exceed a preset threshold.

[0031] Linearity constraint: Constrains the maximum absolute value of the deviation from the linear approximation through inner product operation.

[0032] In one possible implementation, the symmetry breaking constraint and circuit depth constraint are specifically as follows:

[0033] To improve solution efficiency, this invention introduces symmetry breaking constraints. For logic gates with input-exchange symmetry (such as AND and XOR) in a preset gate library set, the connection order of their input signals is specified to follow a predetermined lexicographical order; simultaneously, based on the full permutation symmetry of the S-box output bits, the connection order of the output signals is specified. The circuit depth constraint restricts the circuit depth to be less than a predetermined threshold. By eliminating functionally equivalent redundant solutions through symmetry breaking constraints and circuit depth constraints, the search space is significantly reduced.

[0034] Secondly, embodiments of this application provide a minimum delay S-box circuit search system based on an STP solver, comprising the following modules:

[0035] Model building module: Used to build general topology models of S-box circuits;

[0036] Constraint module: Used to determine weighted delay constraints, cryptographic property constraints, symmetry breaking constraints, and circuit depth constraints.

[0037] The weighted delay constraint recursively calculates the cumulative delay of each node in the general topology model according to the delay constraint model, and constrains the maximum delay of the circuit to be less than or equal to the target delay value.

[0038] The aforementioned cryptographic property constraints traverse the input space to ensure that the S-box circuit meets the requirements of bijectivity, differential uniformity, and linearity.

[0039] The aforementioned symmetry breaking constraints and circuit depth constraints respectively restrict the input and output order of exchangeable gates and the S-box circuit depth.

[0040] Solver module: The generator program is written to convert the above model and constraints into the corresponding CVC file, and then the STP solver is used to solve it to obtain the minimum delay S-box circuit that meets the requirements.

[0041] In one possible implementation, the model building module operates as follows:

[0042] Step 1-1: Given initial parameters, including S-box bit width n, maximum number of logic gates k, target delay value, preset gate library set and corresponding gate delay.

[0043] Steps 1-2: Construct circuit variables, including main inputs, intermediate logic gate outputs, final outputs, wiring selectors, and gate type selectors, and implement functional constraints based on the gate type selectors.

[0044] Steps 1-3: Determine circuit topology constraints based on wiring selection variables to ensure the single-source and acyclic nature of circuit connections.

[0045] Thirdly, embodiments of this application provide an electronic device, including a processor and a memory;

[0046] The memory is used to store computer programs.

[0047] When the processor executes the program stored in the memory, it implements any of the minimum delay S-box circuit search methods described in this application.

[0048] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the minimum delay S-box circuit search methods described in this application.

[0049] Fifthly, embodiments of this application provide a computer program product containing instructions that, when run on a computer, cause the computer to execute any of the minimum delay S-box circuit search methods described in this application.

[0050] The beneficial effects of this invention are as follows:

[0051] Compared with existing technologies, this invention achieves physical circuit delay optimization, overcoming the limitations of existing technologies that only focus on hardware area or simple logic layer count. By introducing a weighted delay model based on a process library, this invention refines the search target from the abstract "logic depth" to "physical critical path delay." By assigning delay weights that conform to actual process characteristics to different types of logic gates, the search algorithm can distinguish circuit schemes with the same number of logic layers but different physical delays, thereby ensuring that the searched S-box circuits have faster operating speeds in real hardware.

[0052] This invention significantly reduces the critical path delay of a circuit by utilizing composite logic gates, thereby greatly increasing the operating frequency of the encryption system. Under the same cryptographic constraints, compared to existing schemes that only use basic gate libraries, this invention reduces the weighted delay of the critical path of the S-box circuit from 8 units to 4 units after introducing composite logic gates, resulting in a 50% improvement in delay performance. This significant performance improvement directly shortens the signal propagation path in combinational logic, enabling the encryption chip to support higher operating clock frequencies, thus significantly improving data throughput.

[0053] This invention achieves automated co-design of cryptographic security and high-performance hardware, ensuring the completeness and optimality of search results. Traditional manual design or heuristic search algorithms struggle to simultaneously consider complex cryptographic properties such as bijectivity, differential uniformity, and linearity, as well as fine-grained hardware delay constraints, easily getting trapped in local optima. This invention utilizes the global search capability of the SMT solver, uniformly encoding circuit topology, logic function selection, physical delay calculation, and cryptographic security indicators into mathematical constraints. This not only ensures that the generated S-box circuit strictly meets high security standards but also, through an iterative search strategy, finds the theoretically optimal delay solution within given resource boundaries, avoiding the subjectivity of manual design and significantly shortening the design cycle of high-performance cryptographic chips. Furthermore, the weighted delay model of this invention is decoupled from specific process libraries, exhibiting good versatility. Designers only need to update the delay weight parameters of the logic gates according to the target process to re-search for the optimal circuit structure adapted to that specific process (such as ASIC or FPGA) using the method of this invention. Detailed Implementation

[0054] The technical solutions in the embodiments of this application are clearly and completely described below. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art based on this application are within the scope of protection of this application.

[0055] This application provides a method for searching for the minimum delay S-box circuit based on an STP solver. This method transforms the construction and optimization problem of S-box circuits into a computer-processable constraint satisfaction problem, utilizing automated tools to find the circuit structure that satisfies specific cryptographic properties and has the minimum physical delay within a vast search space. This embodiment uses the search for a 4-bit S-box that satisfies bijectivity, differential uniformity no greater than 4, and linearity no greater than 4 as an example to illustrate the technical solution of this invention in detail.

[0056] This invention uses the STP (Simple Theorem Prover) solver. Table 1 first lists the common CVC language functions used by STP and their application meaning in this invention.

[0057] Name Symbol Example Series connection Extraction Bitwise XOR Bit vector addition Logical AND t1&t2 Logical OR 丨 t1丨t2 Not equal to Less than or equal to Greater than or equal to Equal to

[0058] The core of this invention lies in transforming the construction problem of the S-box circuit into a mathematical model, and further converting it into CVC language for STP to solve.

[0059] The main steps include:

[0060] Step 1: Construct a general topology model for the S-box circuit

[0061] Step 1-1: Given initial parameters, including S-box bit width n, maximum number of logic gates k, target delay value, preset gate library set and corresponding gate delay.

[0062] In this embodiment, the S-cell width is set as follows:

[0063]

[0064] The maximum number of logic gates allowed is:

[0065]

[0066] Target latency value:

[0067]

[0068] The preset door vault set and corresponding door delays are as follows:

[0069] Logic gate Gate delay (ns) NAND 0.01 NOR 0.01 AND 0.02 OR 0.02 NAND3 0.01 NOR3 0.01 AND3 0.02 OR3 0.03 XNOR 0.03 XOR 0.03 XNOR3 0.05 XOR3 0.05 MAOI1 0.02 MOAI1 0.02

[0070] Based on the actual process library parameters, determine the corresponding gate delay for different types of logic gates. .

[0071] Steps 1-2: Construct circuit variables, including main inputs, intermediate logic gate outputs, final outputs, wiring selectors, and gate type selectors, and implement functional constraints based on the gate type selectors.

[0072] The main input signal is ~ The output signal of the intermediate logic gate is ~ and the final output signal ~ .

[0073] Wiring selectors are used to describe the connection relationships of a circuit.

[0074] Define routing selection variables:

[0075]

[0076] Indicates the i-th logic gate The input port is connected to the j-th signal source (the signal source includes the main input and the preceding logic gate).

[0077] Gate type selectors are used to refer to each logic gate in the preset gate library set, implementing functional constraints. Through gate type selectors, the STP solver can automatically assign the optimal logic operation type to each node.

[0078] Define function selection variables To decide the first A logic gate The specific functions are described using nested IF-THEN-ELSE structures in CVC. For example, if... The corresponding AND gate encoding then constrains It is equal to the bitwise AND of its input; if it corresponds to MAOI1 gate encoding, then the constraint is... It equals the result of a compound logical operation.

[0079] Steps 1-3: Determine circuit topology constraints to ensure the single-source and acyclic nature of circuit connections.

[0080] For each logic gate's input port and the circuit's final output port, the signal source is constrained by routing selection variables to ensure that each port is connected to only one specific signal source (which can be the main input or the preceding logic gate), and index restrictions are used to ensure that there are no loops in the circuit.

[0081] To construct a valid circuit topology, each gate's input port must be constrained to connect to only one specific signal source. In CVC, this is achieved through the following logic:

[0082]

[0083] At the same time, through index constraints (logic gates) It can only be connected to logic gates ,in Ensure the circuit is loop-free.

[0084] Step 2: Determine the weighted delay constraint. Based on the delay constraint model, recursively calculate the cumulative delay of each node in the general topology model, and constrain the maximum delay of the circuit to be less than or equal to the target delay value.

[0085] To accurately optimize physical latency, this invention abandons the traditional logic layer number calculation and instead adopts a latency constraint model.

[0086] The cumulative delay calculation is incorporated into the general topology model of the S-box circuit. A variable D is added to each node in the general topology model to record the cumulative delay. Each node includes intermediate logic gate outputs and the final output. The cumulative delay of the current node is recorded. For each logic gate... Its output delay The calculation formula is:

[0087]

[0088] in, This represents the arrival time of the input signal.

[0089] In the CVC language, the recursive calculation of the max function is implemented using BVGE (greater than or equal to) and IF-THEN-ELSE structures. For example, to calculate the max function with two inputs... Maximum value:

[0090] IF BVGE(d1,d2) THEN d1 ELSE d2 ENDIF

[0091] Finally, the maximum cumulative delay of all final output signals is constrained to not exceed the preset target delay value. :

[0092]

[0093] in, The critical path delay of the entire S-box circuit is the maximum cumulative delay of all final output signals.

[0094] Step 3: Determine the cryptographic property constraints, traverse the input space, and ensure that the S-box circuit meets the requirements of bijectivity, differential uniformity, and linearity.

[0095] To ensure that the generated circuit constitutes a safe S-box, the following constraints must be applied:

[0096] Bijective constraint: for any input index Constrain the corresponding circuit output .

[0097] Difference uniformity constraint: for all non-zero input differences and output differential Count the number of inputs that satisfy the difference propagation equation and constrain the maximum value of the difference pairs. .

[0098] Linearity constraint: Constraining the maximum absolute value of the deviation from linear approximation through inner product operation. .

[0099] Step 4: Determine the symmetry breaking constraints and circuit depth constraints, and restrict the input and output order of the exchangeable gates and the S-box circuit depth, respectively.

[0100] First, to eliminate equivalent redundant solutions in the search space caused by the interchange of logic gate inputs, for logic gates that satisfy the commutative law (such as AND gates and XOR gates), the bit vector greater than comparison function (BVGT) is used to enforce that the signal source indices connected to their input ports must follow an ascending order. Its CVC language description is as follows:

[0101] ASSERT(BVGT(a_input_1,a_input_2))

[0102] Here, a_input_1 and a_input_2 represent the signal source index variables connected to the two input ports of the logic gate, respectively. The BVGT function ensures that the former is strictly greater than the latter, thus avoiding repeated searches of mirror circuits with the same function. Similarly, for the full permutation symmetry of the S-cell output bits, the same BVGT constraint is applied to the signal source indices of adjacent output ports.

[0103] Secondly, the depth of the entire circuit is constrained. The program defines a depth variable for each node in the circuit, specifying that the depth of the main input signal is 0. For the depth calculation of the logic gate input ports, the program generates nested conditional statements by traversing the wiring variable 'a', inheriting the corresponding depth value according to the type of signal source. If the signal source is the main input, the depth is 0; if it is a preceding logic gate, the output depth of that gate is inherited. The CVC language description logic is as follows:

[0104] ASSERT(Depth_in=IF a_source_1 THEN 0 ELSE IF a_source_2 THEN Depth_gate_j...ENDIF)

[0105] For the output depth of each logic gate, the program simulates the signal through the gate at increasing levels. By comparing the depth values ​​of all input ports of the gate, the maximum value is selected and incremented by 1 to obtain the output depth of the gate. The calculation of the maximum value is implemented using the nested bit vector greater than or equal to function BVGE, and the increment operation is implemented using the bit vector addition function BVPLUS. Its CVC language description is as follows:

[0106] ASSERT(Depth_gate=BVPLUS(8,MAX(Depth_in_1,Depth_in_2,...),0bin00000001))

[0107] The depth of the entire circuit, CircuitDepth, is defined as the maximum value among all final output signal depths, and a capping constraint is applied, requiring it to not exceed a preset target depth, target_depth_value. This forces the circuit structure searched by the solver to meet the design requirements at the logic level. Its CVC language description is as follows:

[0108] ASSERT(BVLE(CircuitDepth, target_depth_value))

[0109] Step 5: Transform the above model and constraints into the corresponding CVC file by writing a generator program, and then use the STP solver to solve it to obtain the minimum delay S-box circuit that meets the requirements.

[0110] In practical implementation, this invention uses a C++ generator program to transform the above model and constraints into CVC format constraints recognizable by the STP solver. The specific constraint construction process is as follows:

[0111] First, construct cryptographic property constraints: for bijective constraints, generate the assertion ASSERT(S[p]≠S[q]) to ensure that different inputs map to different outputs.

[0112] For the difference uniformity, the program defines a counter variable Counter_DDT for each non-zero input difference α and output difference β. It verifies whether S(x⊕α)⊕S(x)=β is true by bit vector XOR operation. If true, the counter is set to 1, otherwise it is set to 0. Then, the BVPLUS function is used to accumulate the counter values ​​corresponding to all x to obtain the number of occurrences of the difference feature, and asserts that the number is less than or equal to 4.

[0113] For linearity, the linear approximation deviation between the input mask and the output mask is calculated using inner product operations, and the number of inputs that satisfy the linear relationship is counted. The maximum absolute value of the linear approximation deviation is then asserted. .

[0114] Next, the circuit topology and functional constraints are constructed. The program defines routing selection variables 'a' and function selection variables 'b'. Regarding the legality of circuit connections, the program generates mutual exclusion and existence constraints for all input ports of each logic gate. The BVPLUS function calculates the sum of all routing selection variables 'a' pointing to that port and asserts that the sum is strictly equal to 1, thus ensuring that each port is connected to only one signal source. Regarding the functionality of the logic gates, the program constructs nested bit vector operation expressions. Based on the value of the function selection variable 'b' (such as the encoding of gates corresponding to AND, OR, XOR, MAOI1, etc.), the program defines the logical relationship between the output and input of the logic gates through operations such as BVXOR, BVAND, and BVNOT.

[0115] Finally, a cumulative delay constraint is constructed, which is crucial for achieving the minimum delay search. The program introduces a delay variable D. For each logic gate, the program first calculates the input delay, using a series of IF-THEN-ELSE statements to determine the state of the routing variable a, thereby obtaining the cumulative delay value of the current input signal source (which could be the main input x or the preceding gate t) of that logic gate. Subsequently, the program calculates the output delay, using nested BVGE (greater than or equal to) comparison operations to implement the maximum value function MAX, calculating the maximum value of all input delays, and adding the gate delay determined by the technology library for that logic gate, thus obtaining the output delay of that logic gate. Finally, the program calculates the maximum delay of all S-box output bits y to obtain the critical path delay MaxDelay of the circuit, and asserts BVLE(MaxDelay, Target_Delay), which requires that the total circuit delay does not exceed the preset target value, thereby driving the solver to search for the circuit structure with optimal delay while satisfying all the above constraints.

[0116] This application also provides a minimum delay S-box circuit search system based on an STP solver, including the following modules:

[0117] Model building module: Used to build general topology models of S-box circuits;

[0118] Constraint module: Used to determine weighted delay constraints, cryptographic property constraints, symmetry breaking constraints, and circuit depth constraints.

[0119] The weighted delay constraint recursively calculates the cumulative delay of each node in the general topology model according to the delay constraint model, and constrains the maximum delay of the circuit to be less than or equal to the target delay value.

[0120] The aforementioned cryptographic property constraints traverse the input space to ensure that the S-box circuit meets the requirements of bijectivity, differential uniformity, and linearity.

[0121] The aforementioned symmetry breaking constraints and circuit depth constraints respectively restrict the input and output order of exchangeable gates and the S-box circuit depth.

[0122] Solver module: The generator program is written to convert the above model and constraints into the corresponding CVC file, and then the STP solver is used to solve it to obtain the minimum delay S-box circuit that meets the requirements.

[0123] In one possible implementation, the model building module operates as follows:

[0124] Step 1-1: Given initial parameters, including S-box bit width n, maximum number of logic gates k, target delay value, preset gate library set and corresponding gate delay.

[0125] Steps 1-2: Construct circuit variables, including main inputs, intermediate logic gate outputs, final outputs, wiring selectors, and gate type selectors, and implement functional constraints based on the gate type selectors.

[0126] Steps 1-3: Determine circuit topology constraints based on wiring selection variables to ensure the single-source and acyclic nature of circuit connections.

[0127] In one possible implementation, the preset gate library set is an extended standard cell gate library that includes not only basic logic gates (such as NAND, NOR, XOR, etc.) but also four-input logic gates MAOI and MOAI with low latency characteristics. The gate latency of different types of logic gates in the preset gate library set is determined based on the actual process library parameters.

[0128] In one possible implementation, the circuit variables are specifically defined as follows:

[0129] The main input signal is ~ The output signal of the intermediate logic gate is ~ and the final output signal ~ .

[0130] Wiring selectors are used to describe the connection relationships of a circuit.

[0131] Gate type selectors are used to refer to each logic gate in the preset gate library set, implementing functional constraints. Through gate type selectors, the STP solver can automatically assign the optimal logic operation type to each node.

[0132] In one possible implementation, the circuit topology constraints are as follows:

[0133] For each logic gate's input port and the circuit's final output port, the signal source is constrained by routing selection variables to ensure that each port is connected to only one specific signal source (which can be the main input or the preceding logic gate), and index restrictions are used to ensure that there are no loops in the circuit.

[0134] In one possible implementation, the delay constraint model is as follows:

[0135] The cumulative delay calculation is incorporated into the general topology model of the S-box circuit. A variable D is added to each node in the general topology model to record the cumulative delay. Each node includes intermediate logic gate outputs and the final output. For any logic gate G, the cumulative delay at its output is calculated. It is constrained to the maximum value of the arrival times of all its input signals plus the gate delay. The calculation logic is as follows:

[0136]

[0137] in, This represents the arrival time of the input signal.

[0138] Finally, define global delay constraints. This involves setting the critical path delay for the entire S-box circuit. Defined as the maximum cumulative delay of all final output signals, and constrained. Not greater than the preset target delay value .

[0139] In one possible implementation, the cryptographic property constraints on the constraint module are specifically as follows:

[0140] The safety indices of the S-box are transformed into constraints recognizable by the STP solver, specifically including:

[0141] Bijective constraint: For any two different inputs, the corresponding circuit outputs must be different.

[0142] Difference uniformity constraint: For all non-zero input differences and output differences, count the number of inputs that satisfy the difference propagation equation, and constrain the maximum value of the difference pair to not exceed a preset threshold.

[0143] Linearity constraint: Constrains the maximum absolute value of the deviation from the linear approximation through inner product operation.

[0144] In one possible implementation, the symmetry breaking constraint and circuit depth constraint of the constraint module are specifically as follows:

[0145] To improve solution efficiency, this invention introduces symmetry breaking constraints. For logic gates with input-exchange symmetry (such as AND and XOR) in a preset gate library set, the connection order of their input signals is specified to follow a predetermined lexicographical order; simultaneously, based on the full permutation symmetry of the S-box output bits, the connection order of the output signals is specified. The circuit depth constraint restricts the circuit depth to be less than a predetermined threshold. By eliminating functionally equivalent redundant solutions through symmetry breaking constraints and circuit depth constraints, the search space is significantly reduced.

[0146] This application also provides an electronic device, including a processor and a memory.

[0147] The memory is used to store computer programs.

[0148] When the processor executes a program stored in the memory, it implements any of the methods described in this application.

[0149] In one possible implementation, the electronic device of this application embodiment further includes a communication interface and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus.

[0150] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc.

[0151] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0152] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0153] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0154] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements any of the methods described in this application.

[0155] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to perform any of the methods described in this application.

[0156] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0157] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0158] The various embodiments in this specification are described in a related manner. Each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other.

[0159] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the scope of protection of this application.

Claims

1. A method for searching the minimum delay S-box circuit based on an STP solver, characterized in that, The steps include the following: Step 1: Construct a general topology model for the S-box circuit Step 1-1: Given initial parameters, including S-box bit width n, maximum number of logic gates k, target delay value, preset gate library set and corresponding gate delay; Steps 1-2: Construct circuit variables, including main input, intermediate logic gate output, final output, routing selection variables, and function selection variables, and implement functional constraints based on the function selection variables; Steps 1-3: Determine circuit topology constraints based on wiring selection variables to ensure the single-source and acyclic nature of circuit connections; Step 2: Determine the weighted delay constraint. Based on the delay constraint model, recursively calculate the cumulative delay of each node in the general topology model, and constrain the maximum delay of the circuit to be less than or equal to the target delay value. The time-delay constraint model is as follows: The cumulative delay calculation is incorporated into the general topology model of the S-box circuit. A variable D is added to each node in the general topology model to record the cumulative delay. Each node includes intermediate logic gate outputs and the final output. For any logic gate G, the cumulative delay at its output is... It is constrained to be the maximum of the arrival times of all its input signals plus the gate delay of that arbitrary logic gate. The calculation logic is as follows: in, The arrival time of the input signal; Finally, define global latency constraints; Delay the critical path of the entire S-box circuit Defined as the maximum cumulative delay of all final output signals, and constrained. Not greater than the preset target delay value ; Step 3: Determine the cryptographic property constraints, traverse the input space, and ensure that the S-box circuit meets the requirements of bijectivity, differential uniformity, and linearity; Step 4: Determine the symmetry breaking constraints and circuit depth constraints, and restrict the input and output order of the exchangeable gates and the S-box circuit depth, respectively; Step 5: Transform the above general topology model and constraints into the corresponding CVC file by writing a generator program, and then use the STP solver to solve it to obtain the minimum delay S-box circuit that meets the requirements.

2. The method for searching the minimum delay S-box circuit based on an STP solver according to claim 1, characterized in that, The preset gate library set is an extended standard cell gate library, which includes basic logic gates and four-input logic gates MAOI and MOAI with low latency characteristics; the gate latency of different types of logic gates in the preset gate library set is determined according to the actual process library parameters.

3. The method for searching the minimum delay S-box circuit based on an STP solver according to claim 1, characterized in that, The circuit variables in the general topology model are defined as follows: The main input signal is ~ The output signal of the intermediate logic gate is ~ and the final output signal ~ ; Wiring selection variables are used to describe the connection relationships of the circuit; Function selection variables are used to refer to each logic gate in the preset gate library set to implement functional constraints.

4. The method for searching the minimum delay S-box circuit based on an STP solver according to claim 1, characterized in that, The specific circuit topology constraints are as follows: For each logic gate's input port and the circuit's final output port, the signal source is constrained by routing selection variables to ensure that each port is connected to only one specific signal source, and index restrictions are used to ensure that there are no loops in the circuit.

5. The method for searching the minimum delay S-box circuit based on an STP solver according to claim 1, characterized in that, The specific constraints on cryptographic properties are as follows: The safety indices of the S-box are transformed into constraints recognizable by the STP solver, specifically including: Bijective constraint: For any two different inputs, the corresponding circuit outputs must be different; Difference uniformity constraint: For all non-zero input differences and output differences, count the number of inputs that satisfy the difference propagation equation, and constrain the maximum value of the difference pair to not exceed a preset threshold. Linearity constraint: Constrains the maximum absolute value of the deviation from the linear approximation through inner product operation.

6. The method for searching the minimum delay S-box circuit based on an STP solver according to claim 1, characterized in that, The specific details of symmetry breaking constraints and circuit depth constraints are as follows: Symmetry breaking constraints: For logic gates with input exchange symmetry in the preset gate library set, the connection order of their input signals is specified to follow a set lexicographical order; at the same time, based on the full permutation symmetry of the S-box output bits, the connection order of the output signals is specified; the circuit depth constraint restricts the circuit depth to be less than a set threshold.

7. A minimum delay S-box circuit search system based on an STP solver, characterized in that, Includes the following modules: Model building module: Used to build a general topology model of an S-box circuit; specific operations are as follows: Step 1-1: Given initial parameters, including S-box bit width n, maximum number of logic gates k, target delay value, preset gate library set and corresponding gate delay; Steps 1-2: Construct circuit variables, including main input, intermediate logic gate output, final output, routing selection variables, and function selection variables, and implement functional constraints based on the function selection variables; Steps 1-3: Determine circuit topology constraints based on wiring selection variables to ensure the single-source and acyclic nature of circuit connections; Constraint module: used to determine weighted delay constraints, cryptographic property constraints, symmetry breaking constraints, and circuit depth constraints; The weighted delay constraint, based on the delay constraint model, recursively calculates the cumulative delay of each node in the general topology model, and constrains the maximum delay of the circuit to be less than or equal to the target delay value. The time-delay constraint model is as follows: The cumulative delay calculation is incorporated into the general topology model of the S-box circuit. A variable D is added to each node in the general topology model to record the cumulative delay. Each node includes intermediate logic gate outputs and the final output. For any logic gate G, the cumulative delay at its output is... It is constrained to be the maximum of the arrival times of all its input signals plus the gate delay of that arbitrary logic gate. The calculation logic is as follows: in, The arrival time of the input signal; Finally, define global latency constraints; Delay the critical path of the entire S-box circuit Defined as the maximum cumulative delay of all final output signals, and constrained. Not greater than the preset target delay value ; The aforementioned cryptographic property constraints traverse the input space to ensure that the S-box circuit meets the requirements of bijectivity, differential uniformity, and linearity. The aforementioned symmetry breaking constraints and circuit depth constraints respectively restrict the input and output order of exchangeable gates and the S-box circuit depth; Solver module: The generator program is written to convert the above general topology model and constraints into the corresponding CVC file, and then the STP solver is used to solve it to obtain the minimum delay S-box circuit that meets the requirements.

8. An electronic device, characterized in that, Including processor and memory; The memory is used to store computer programs; When the processor executes the program stored in the memory, it implements the minimum delay S-box circuit search method according to any one of claims 1-6.

Images