Small-state stream cipher implementation method based on conditional selection function

Abstract

The invention provides a small-state stream cipher implementation method based on a conditional selection function, which comprises the following steps of: connecting an LFSR and an NFSR in series, storing an initial key by using a nonvolatile memory, and selecting bits in the nonvolatile memory by using the conditional selection function to be used for a state updating process of the LFSR and the NFSR; partial states of the LFSR and the NFSR are selected to pass through a high-nonlinearity output function, and output bits are obtained; a dynamic initialization technology is adopted in the algorithm initialization process, and meanwhile output of an output function participates in updating of an internal state; and outputting the key stream through iteration, and completing data encryption and decryption. According to the method, through a conditional selection function and a dynamic initialization technology, the algorithm is ensured to be lightweight, and meanwhile, the method has relatively high safety strength.

Description

Technical Field

[0001] This invention relates to the field of information security, specifically a method for implementing small-state-flow cryptography based on conditional selection functions. Background Technology

[0002] In the field of cryptography, stream ciphers, as an important encryption system, are widely used in environments with limited hardware resources and in communication systems requiring high-speed or real-time data processing due to their high encryption and decryption efficiency and relatively simple implementation structure. Classic stream cipher algorithms include the Grain family of algorithms, the SNOW family of algorithms, and the ZUC algorithm. The security of stream ciphers largely depends on the size and update mechanism of their internal state. A typical threat comes from the Time-Memory-Data Tradeoff (TMDTO) attack, the efficiency of which is closely related to the size of the volatile state inside the algorithm. To effectively defend against such attacks, traditional design principles usually require the bit length of the volatile state inside the algorithm to be at least twice the key length; for example, the Grain-128a and Trivium algorithms both follow this principle. However, a larger internal state size also means more hardware resources such as registers, resulting in excessive hardware resource overhead for stream cipher algorithms, making them difficult to apply in resource-constrained environments.

[0003] To address the conflict between security and implementation cost, researchers have recently proposed an innovative "small-state" lightweight stream cipher model. This model uses non-volatile registers to partially replace the volatile register units in traditional stream cipher architectures. During algorithm execution, a fixed key stored in this non-volatile register is continuously invoked for computation. This reduces the number of registers used while maintaining the required security strength, thereby lowering the resource consumption of the algorithm in hardware implementation. This allows small-state stream ciphers to maintain resistance to TMDTO attacks while significantly reducing the size of volatile register units in the algorithm. Currently, several lightweight stream ciphers with internal states less than twice the key length have emerged, including Sprout, Plantlet, Fruit family, and Lizard cryptographic algorithms. These can be broadly categorized into three design structures: Lizard structure, CKEY structure (Continuous Key), and CIVK structure (Consisting of the initial value and key prefix).

[0004] In addition, to further enhance the forward security and unpredictability of the initial state and prevent the internal state from being reverse-engineered, the dynamic initialization rounds technique is also used to increase the difficulty for attackers to build an accurate algebraic model of the initialization process. However, the implementation of this method requires increasing the number of register bits, thereby increasing hardware overhead. Summary of the Invention

[0005] This invention aims to propose a small-state stream cryptography implementation method based on a conditional selection function. This method concatenates a Linear Feedback Shift Register (LFSR) and a Nonlinear Feedback Shift Register (NFSR), uses non-volatile memory to store the initial key, and employs a selection function to select bits from the non-volatile memory for the state update process of the LFSR and NFSR. A subset of the states from the LFSR and NFSR is processed by a highly nonlinear output function to obtain the output bits. Dynamic initialization techniques are applied during algorithm initialization, and the output of the output function participates in the internal state update. Through the conditional selection function and dynamic initialization techniques, this algorithm achieves high security strength while maintaining lightweight operation.

[0006] The technical solution to achieve the objective of this invention is:

[0007] A method for implementing small-state-flow cryptography based on conditional selection functions includes the following steps:

[0008] (1) Construct the algorithm structure;

[0009] The algorithm consists of an LFSR, an NFSR, a non-volatile memory, a selection function, and an output function. The overall algorithm adopts a Grain-like algorithm structure, combining the CKEY scheme with dynamic initialization technology to generate a key stream.

[0010] (2) Design the selection function;

[0011] Design a selection function that selects 3 bits from non-volatile memory as input each time and generates a 1-bit output to update the internal state of the NFSR.

[0012] (3) Algorithm initialization implementation;

[0013] Initialization is completed by iteratively filling in the LFSR and NFSR and combining them with a dynamic initialization method.

[0014] (4) Generate the key stream;

[0015] The bits generated by the output function are directly used as key bits. Through multiple iterative operations, the generated bit sequences are combined in sequence to form the final key stream.

[0016] (5) Data encryption and decryption implementation;

[0017] Based on the generated key stream, the data is encrypted and decrypted.

[0018] In the small-state stream cryptography implementation method based on conditional selection function of the present invention, the specific steps of constructing the algorithm structure in step (1) are as follows:

[0019] The algorithm includes LFSR, NFSR, one non-volatile memory, a selection function, and an output function, as detailed below;

[0020] (1.1) A 69-bit LFSR and a 90-bit NFSR are concatenated as the driving part of the algorithm;

[0021] (1.1.1) LFSR components;

[0022] The LFSR component uses the Atom algorithm and consists of 69 bits. To enhance the diffusion performance of its internal state bits, this component is optimized by introducing additional state bits into its state update function, thereby improving the overall linear diffusion efficiency and resistance to cryptanalysis of the algorithm. The LFSR uses... It means that, among them, Let F(L) represent the i-th state bit of the LFSR at time t, where 0 ≤ i ≤ 68; the optimized LFSR update function is F(L). t )for:

[0023]

[0024] (1.1.2) NFSR components;

[0025] The NFSR component uses the Atom algorithm and is 89 bits long. It means that, among them, This represents the i-th state bit of the NFSR at time t; the NFSR update function G(B) t )for:

[0026]

[0027] (1.2) Set the non-volatile memory to 128 bits to store a 128-bit initial key; the selection function takes some status bits of LFSR and NFSR as input, and selects specific key bits from the non-volatile register according to the output of the selection function to participate in subsequent operations;

[0028] (1.3) The algorithm output function consists of a linear term, a quadratic nonlinear term, and a 9-variable function h; when selecting state bits, priority is given to state bits that are not used by the update functions and selection functions of LFSR and NFSR themselves, to enhance the independence and unpredictability of the output; with z t This represents the key stream output by the algorithm at time t, and the output function is:

[0029]

[0030] Where h(x) contains 9 input variables, has an algebraic degree of 5, a relevant immune order of 3, and a nonlinearity of 240, h(x) = h(x0, x... 1, x 2, x 3, x 4, x 5, x 6, x 7, x8), defined as follows:

[0031] h(x)=x0x1x2x7x8+x0x1x2x7+x0x1x2x8+x0x1x2+x0x1x3x7x8+x0x1x3x7+x0x1x4x7x8+x0x1x4x7+x0x1x4x8+x0x1x4+x0x1x5x7x8+x0x1x5x7+x0x1x6x7x8+x0x1x6x8+x0x1x7x8+x0x1x8+x0x2x3x7x8+x0x2x3x7+x0x2x3x8+x0x2x3+x0x2x4x7x8+x0x2x4x8+x0x2x5x7x8+x0x2x5x7+x0x2x5x8+x0x2x5+x0x2x6x7x8+x0x2x6x8+x0x2x7x8+x0x2x8+x0x3x4x7x8+x0x3x4x7+x0x3x5x7x8+x0x3x5x7+x0x3x6x7x8+x0x3x6x7+x0x3x8+x0x3+x0x4x5x7x8+x0x4x5x7+x0x4x6x7x8+x0x4x6x8+x0x4x7+x0x4+x0x5x6x7x8+x0x5x6x7+x0x5x7x8+x0x5x7+x0x6x7+x0x6x8+x0x7x8+x1x2x3x7x8+x1x2x4x7x8+x1x2x4x8+x1x2x5x7x8+x1x2x6x7x8+x1x2x6x8+x1x2x7+x1x2x8+x1x2+x1x3x4x7x8+x1x3x5x7x8+x1x3x6x7x8+x1x3x7+x1x4x5x7x8+x1x4x5x8+x1x4x6x7x8+x1x4x7+x1x4+x1x5x6x7x8+x1x5x6x7+x1x5x7x8+x1x5x7+x1x5x8+x1x6x7+x1x8+x1+x2x3x4x7x8+x2x3x5x7x8+x2x3x6x7x8+x2x4x5x7x8+x2x4x5x8+x2x4x6x7x8+x2x4x7x8+x2x4x8+x2x5x6x7x8+x2x5x6x8+x2x5x8+x2x6x7x8+x2x6x8+x2x7x8+x2+x3x4x5x7x8+x3x4x5x7+x3x4x6x7x8+x3x4x6x7+x3x5x6x7x8+x3x5x7x8+x3x6x7x8+x3x6x7+x3x7+x3+x4x5x6x7x8+x4x5x6x8+x4x6x7x8+x4x6x8+x4x7+x5x7x8+x5+x6+x7x8+x7+x8+1;

[0032] (1.4) Set the initial key and initial vector, and fill the state bits of LFSR and NFSR; use the bits output by the output function and the bits selected by the selection function in the non-volatile memory to participate in the state update of LFSR and NFSR; complete the initialization process by combining the dynamic initialization method.

[0033] (1.5) Generate the key stream through iteration.

[0034] In the small-state stream cryptography implementation method based on conditional selection function of the present invention, the design of the selection function in step (2) is as follows:

[0035] (2.1) 128-bit initial key This indicates that the 128-bit initial vector is... This indicates that a 128-bit non-volatile memory is filled with a 128-bit key, and the state of the non-volatile register after filling is as follows: ;

[0036] (2.2) For this 128-bit non-volatile internal state, during clock period t, the key selection bit k t The calculation is as follows:

[0037]

[0038] Where r, p, and q are all index subscripts of the initial key in the non-volatile memory. , , dv is the disturbance value, dv = s1 + s2. , When k p ≠k q+64 When a perturbation is applied, dv∧(k p +k q+64 ) is a conditional disturbance term.

[0039] In the small-state stream cryptography implementation method based on conditional selection function of the present invention, the algorithm initialization implementation in step (3) is as follows:

[0040] (3.1) Fill the 90-bit NFSR register with the first 90 bits of the initialization vector IV; fill the first 38 bits of the LFSR register with the last 38 bits of the initialization vector IV; then fill the middle 22 bits of the LFSR with the filling vector PD, where PD = (PD0,…, PD0). 21 )=1 22 The remaining positions of the LFSR are filled with 0 bits.

[0041] (3.2) Set the iteration variable t=0;

[0042] (3.3) Call the selection function and output the key selection bit k according to step (2.2). t Call the output function and output the key stream bits z according to step (1.3). t ;

[0043] (3.4) Calculate the output value of the LFSR update function and compare it with the key stream bits z obtained in step (3.3). t XOR the results and update the LFSR accordingly:

[0044]

[0045] (3.5) Take the first state bit of the LFSR Key stream bits z t Key selection bit k t XOR the result with the output of the NFSR update function, and then update the NFSR with the result.

[0046]

[0047] (3.6) The algorithm iterates for 128 rounds. In each round, the process of steps (3.3) to (3.5) is repeated. In each iteration, t = t + 1 is set.

[0048] (3.7) The algorithm enters the dynamic initialization stage. A dynamic integer dval with a value range of 0-127 is generated by selecting some state bits from LFSR and NFSR for algorithm iteration, ensuring that the number of iterations is unpredictable. During iteration, steps (3.3) to (3.5) are repeated for dval iterations, and t is set to t+1 for each iteration. The calculation method of dval is as follows:

[0049]

[0050] (3.8) Repeat steps (3.3) to (3.5) for 256 iterations, setting t=t+1 in each iteration, and then completing the initialization; the output bits generated in each iteration of the above process will be fed back to the update process of LFSR and NFSR.

[0051] In the small-state stream cryptography implementation method based on conditional selection function of the present invention, step (4) of generating the key stream specifically includes the following steps:

[0052] (4.1) Set the length of the plaintext data m to p;

[0053] (4.2) Perform a state update operation on the LFSR. The LFSR update function is defined as follows:

[0054]

[0055] (4.3) Call the selection function to output the key selection bit k t ;

[0056] (4.4) The first bit of the LFSR The key selection bit k output in step (4.3) t The output value of the NFSR update function is XORed, and the result is used for the NFSR state update. The NFSR update function is then defined as follows:

[0057]

[0058] (4.5) Call the output function to output z t ;

[0059] (4.6) Let t = t + 1, p = p - 1; if p ≠ 0, go to step (4.2) and continue to execute the next round of iteration; otherwise, end the iteration and generate the key stream z in sequence. t By concatenating the sequences sequentially, the final key stream sequence z is obtained.

[0060] In the small-state stream cryptography implementation method based on conditional selection function of the present invention, the data encryption and decryption implementation in step (5) is as follows:

[0061] (5.1) The data encryption process is as follows;

[0062] (5.1.1) Input plaintext m and the key stream z generated in step (4);

[0063] (5.1.2) Perform a bitwise XOR operation on m and z, and the result is the ciphertext c, whose mathematical expression is as follows:

[0064]

[0065] Where p represents the length of m, c i For the i-th bit of the ciphertext, m i For the i-th bit of the plaintext, z i It is the i-th bit of the key stream;

[0066] (5.2) The data decryption process is as follows;

[0067] (5.2.1) Input the ciphertext c and the key stream z generated in step (4);

[0068] (5.2.2) Perform a bitwise XOR operation on c and z. The result is the plaintext m, and its mathematical expression is as follows:

[0069]

[0070] Where p represents the length of the ciphertext c.

[0071] The beneficial effects of this invention are:

[0072] (1) The method of the present invention adopts the CKEY scheme, which stores the key in a non-volatile register to participate in the operation process of the algorithm, so that the algorithm can not only effectively resist the related attacks of TMDTO, but also has a low overall hardware footprint, making it suitable for resource-constrained environments.

[0073] (2) This invention improves the security of the algorithm by designing a conditional selection function to effectively resist typical cryptographic analysis methods such as cubic attacks and fast correlation attacks; at the same time, it adopts dynamic initialization technology to achieve unpredictability of the number of initialization rounds without relying on additional hardware such as counters, thereby reducing hardware overhead. Attached Figure Description

[0074] Figure 1 This is a flowchart of a small-state stream cryptography implementation method based on a conditional selection function according to the present invention.

[0075] Figure 2 This is a diagram of the algorithm structure of the present invention.

[0076] Specific implementation examples

[0077] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but this is not intended to limit the present invention. Example

[0078] A small-state-flow cryptography implementation method based on conditional selection functions, referring to... Figure 1 This includes the following steps:

[0079] (1) Construct the algorithm structure;

[0080] (2) Design the selection function;

[0081] (3) Algorithm initialization implementation;

[0082] (4) Generate the key stream;

[0083] (5) Data encryption and decryption implementation.

[0084] In this invention, a small-state-flow cryptography implementation method based on conditional selection functions is described, referring to... Figure 2 The specific steps for constructing the algorithm structure in step (1) are as follows:

[0085] The algorithm includes LFSR, NFSR, one non-volatile memory, a selection function, and an output function, as detailed below;

[0086] (1.1) A 69-bit LFSR and a 90-bit NFSR are concatenated as the driving part of the algorithm;

[0087] (1.1.1) LFSR components;

[0088] The LFSR component uses the Atom algorithm and consists of 69 bits. To enhance the diffusion performance of its internal state bits, this component is optimized by introducing additional state bits into its state update function, thereby improving the overall linear diffusion efficiency and resistance to cryptanalysis of the algorithm. The LFSR uses... It means that, among them, Let F(L) represent the i-th state bit of the LFSR at time t, where 0 ≤ i ≤ 68; the optimized LFSR update function is F(L). t )for:

[0089]

[0090] (1.1.2) NFSR components;

[0091] The NFSR component uses the Atom algorithm and is 89 bits long. It means that, among them, This represents the i-th state bit of the NFSR at time t; the NFSR update function G(B) t )for:

[0092]

[0093] (1.2) Set the non-volatile memory to 128 bits to store a 128-bit initial key; the selection function takes some status bits of LFSR and NFSR as input, and selects specific key bits from the non-volatile register according to the output of the selection function to participate in subsequent operations;

[0094] (1.3) The algorithm output function consists of a linear term, a quadratic nonlinear term, and a 9-variable function h; when selecting state bits, priority is given to state bits that are not used by the update functions and selection functions of LFSR and NFSR themselves, to enhance the independence and unpredictability of the output; with z t This represents the key stream output by the algorithm at time t, and the output function is:

[0095]

[0096] Where h(x) contains 9 input variables, has an algebraic degree of 5, a relevant immune order of 3, and a nonlinearity of 240, h(x) = h(x0, x... 1, x 2, x 3, x 4, x 5, x 6, x 7, x8), defined as follows:

[0097] h(x)=x0x1x2x7x8+x0x1x2x7+x0x1x2x8+x0x1x2+x0x1x3x7x8+x0x1x3x7+x0x1x4x7x8+x0x1x4x7+x0x1x4x8+x0x1x4+x0x1x5x7x8+x0x1x5x7+x0x1x6x7x8+x0x1x6x8+x0x1x7x8+x0x1x8+x0x2x3x7x8+x0x2x3x7+x0x2x3x8+x0x2x3+x0x2x4x7x8+x0x2x4x8+x0x2x5x7x8+x0x2x5x7+x0x2x5x8+x0x2x5+x0x2x6x7x8+x0x2x6x8+x0x2x7x8+x0x2x8+x0x3x4x7x8+x0x3x4x7+x0x3x5x7x8+x0x3x5x7+x0x3x6x7x8+x0x3x6x7+x0x3x8+x0x3+x0x4x5x7x8+x0x4x5x7+x0x4x6x7x8+x0x4x6x8+x0x4x7+x0x4+x0x5x6x7x8+x0x5x6x7+x0x5x7x8+x0x5x7+x0x6x7+x0x6x8+x0x7x8+x1x2x3x7x8+x1x2x4x7x8+x1x2x4x8+x1x2x5x7x8+x1x2x6x7x8+x1x2x6x8+x1x2x7+x1x2x8+x1x2+x1x3x4x7x8+x1x3x5x7x8+x1x3x6x7x8+x1x3x7+x1x4x5x7x8+x1x4x5x8+x1x4x6x7x8+x1x4x7+x1x4+x1x5x6x7x8+x1x5x6x7+x1x5x7x8+x1x5x7+x1x5x8+x1x6x7+x1x8+x1+x2x3x4x7x8+x2x3x5x7x8+x2x3x6x7x8+x2x4x5x7x8+x2x4x5x8+x2x4x6x7x8+x2x4x7x8+x2x4x8+x2x5x6x7x8+x2x5x6x8+x2x5x8+x2x6x7x8+x2x6x8+x2x7x8+x2+x3x4x5x7x8+x3x4x5x7+x3x4x6x7x8+x3x4x6x7+x3x5x6x7x8+x3x5x7x8+x3x6x7x8+x3x6x7+x3x7+x3+x4x5x6x7x8+x4x5x6x8+x4x6x7x8+x4x6x8+x4x7+x5x7x8+x5+x6+x7x8+x7+x8+1;

[0098] (1.4) Set the initial key and initial vector, and fill the state bits of LFSR and NFSR; use the bits output by the output function and the bits selected by the selection function in the non-volatile memory to participate in the state update of LFSR and NFSR; complete the initialization process by combining the dynamic initialization method.

[0099] (1.5) Generate the key stream through iteration.

[0100] In the small-state stream cryptography implementation method based on conditional selection function of the present invention, the design of the selection function in step (2) is as follows:

[0101] (2.1) 128-bit initial key This indicates that the 128-bit initial vector is... This indicates that a 128-bit non-volatile memory is filled with a 128-bit key, and the state of the non-volatile register after filling is as follows: ;

[0102] (2.2) For this 128-bit non-volatile internal state, during clock period t, the key selection bit k t The calculation is as follows:

[0103]

[0104] Where r, p, and q are all index subscripts of the initial key in the non-volatile memory. , , dv is the disturbance value, dv = s1 + s2. , When k p ≠k q+64 When a perturbation is applied, dv∧(k p +k q+64 ) is a conditional disturbance term.

[0105] In the small-state stream cryptography implementation method based on conditional selection function of the present invention, the algorithm initialization implementation in step (3) is as follows:

[0106] (3.1) Fill the 90-bit NFSR register with the first 90 bits of the initialization vector IV; fill the first 38 bits of the LFSR register with the last 38 bits of the initialization vector IV; then fill the middle 22 bits of the LFSR with the filling vector PD, where PD = (PD0,…, PD0). 21 )=1 22 The remaining positions of the LFSR are filled with 0 bits.

[0107] (3.2) Set the iteration variable t=0;

[0108] (3.3) Call the selection function and output the key selection bit k according to step (2.2). t Call the output function and output the key stream bits z according to step (1.3). t ;

[0109] (3.4) Calculate the output value of the LFSR update function and compare it with the key stream bits z obtained in step (3.3). t XOR the results and update the LFSR accordingly:

[0110]

[0111] (3.5) Take the first state bit of the LFSR Key stream bits z t Key selection bit k t XOR the result with the output of the NFSR update function, and then update the NFSR with the result.

[0112]

[0113] (3.6) The algorithm iterates for 128 rounds. In each round, the process of steps (3.3) to (3.5) is repeated. In each iteration, t = t + 1 is set.

[0114] (3.7) The algorithm enters the dynamic initialization stage. A dynamic integer dval with a value range of 0-127 is generated by selecting some state bits from LFSR and NFSR for algorithm iteration, ensuring that the number of iterations is unpredictable. During iteration, steps (3.3) to (3.5) are repeated for dval iterations, and t is set to t+1 for each iteration. The calculation method of dval is as follows:

[0115]

[0116] (3.8) Repeat steps (3.3) to (3.5) for 256 iterations, setting t=t+1 in each iteration, and then completing the initialization; the output bits generated in each iteration of the above process will be fed back to the update process of LFSR and NFSR.

[0117] In the small-state stream cryptography implementation method based on conditional selection function of the present invention, step (4) of generating the key stream specifically includes the following steps:

[0118] (4.1) Set the length of the plaintext data m to p;

[0119] (4.2) Perform a state update operation on the LFSR. The LFSR update function is defined as follows:

[0120]

[0121] (4.3) Call the selection function to output the key selection bit k t ;

[0122] (4.4) The first bit of the LFSR The key selection bit k output in step (4.3) t The output value of the NFSR update function is XORed, and the result is used for the NFSR state update. The NFSR update function is then defined as follows:

[0123]

[0124] (4.5) Call the output function to output z t ;

[0125] (4.6) Let t = t + 1, p = p - 1; if p ≠ 0, go to step (4.2) and continue to execute the next round of iteration; otherwise, end the iteration and generate the key stream z in sequence. t By concatenating the sequences sequentially, the final key stream sequence z is obtained.

[0126] In the small-state stream cryptography implementation method based on conditional selection function of the present invention, the data encryption and decryption implementation in step (5) is as follows:

[0127] (5.1) The data encryption process is as follows;

[0128] (5.1.1) Input plaintext m and the key stream z generated in step (4);

[0129] (5.1.2) Perform a bitwise XOR operation on m and z, and the result is the ciphertext c, whose mathematical expression is as follows:

[0130]

[0131] Where p represents the length of m, c i For the i-th bit of the ciphertext, m i For the i-th bit of the plaintext, z i It is the i-th bit of the key stream;

[0132] (5.2) The data decryption process is as follows;

[0133] (5.2.1) Input the ciphertext c and the key stream z generated in step (4);

[0134] (5.2.2) Perform a bitwise XOR operation on c and z. The result is the plaintext m, and its mathematical expression is as follows:

[0135]

[0136] Where p represents the length of the ciphertext c.

Claims

1. A method of implementing a small state stream cipher based on a conditional selection function, characterized by, The method comprises the following steps: (1) constructing an algorithm structure; The algorithm is composed of an LFSR, an NFSR, one non-volatile memory, a selection function and an output function; the algorithm as a whole adopts a Grain type algorithm structure, combines a CKEY scheme and a dynamic initialization technology, and generates a key stream; (2) designing the selection function; A selection function is designed, 3 bits are selected from the non-volatile memory as input each time, one bit output is generated through the function, and the internal state of the NFSR is updated; (3) algorithm initialization implementation; The initialization is completed through filling the LFSR and the NFSR and combining a dynamic initialization method to perform algorithm iteration; (4) generating the key stream; The bits generated by the output function are directly used as key bits, and the generated bit sequence is combined in sequence to form a final key stream through multiple iteration operations; (5) data encryption and decryption implementation; Based on the generated key stream, the data encryption and decryption operations are completed.

2. A method for implementing a small-state stream cipher based on a condition selection function according to claim 1, characterized in that, The constructing algorithm structure in step (1) comprises the following specific steps: (1.1) one 69-bit LFSR and one 90-bit NFSR are adopted in series as the driving part of the algorithm; (1.1.1) the LFSR component; The LFSR component uses an Atom algorithm LFSR component, which has 69 bits; in order to enhance the diffusion performance of the internal state bits, the component is optimized, additional state bits are introduced into the state update function to participate in the operation, and the linear diffusion efficiency and the anti-cryptanalysis ability of the whole algorithm are improved; the LFSR is updated according to the following formula: wherein, represents the i-th state bit of the LFSR at time t, 0≤i≤68; the optimized LFSR update function F(L t ) is as follows: (1.1.2) the NFSR component; The NFSR component uses the Atom algorithm NFSR component, 89 bits in total; the NFSR is updated according to the following equation: wherein, represents the i-th state bit of the NFSR at time t; the NFSR update function G(B t ) is: (1.2) the non-volatile memory is set to 128 bits, and is used for storing an initial 128-bit key; the selection function takes part of the state bits of the LFSR and the NFSR as input, and selects specific key bits from the non-volatile register according to the selection function output result to participate in subsequent operations; (1.3) The algorithm output function is composed of linear terms, quadratic nonlinear terms and a 9-variable function h; in the selection of state bits, the state bits not used by the update functions of LFSR and NFSR and the selection function are preferentially selected to enhance the independence and unpredictability of the output; z t denotes the key stream bit output by the algorithm at time t, and the output function is: Among them, h(x) contains 9 input variables, the algebraic degree is 5, the correlation immunity order is 3, and the nonlinearity is 240, h(x)=h(x0,x1,x2,x3,x4,x5,x6,x7,x8), and is defined as follows: h(x) = x0x1x2x7x8 + x0x1x2x7 + x0x1x2x8 + x0x1x2 + x0x1x3x7x8 + x0x1x3x7 + x0x1x4x7x8 + x0x1x4x7 + x0x1x4x8 + x0x1x4 + x0x1x5x7x8 + x0x1x5x7 + x0x1x6x7x8 + x0x1x6x8 + x0x1x7x8 + x0x1x8 + x0x2x3x7x8 + x0x2x3x7 + x0x2x3x8 + x0x2x3 + x0x2x4x7x8 + x0x2x4x8 + x0x2x5x7x8 + x0x2x5x7 + x0x2x5x8 + x0x2x5 + x0x2x6x7x8 + x0x2x6x8 + x0x2x7x8 + x0x2x8 + x0x3x4x7x8 + x0x3x4x7 + x0x3x5x7x8 + x0x3x5x7 + x0x3x6x7x8 + x0x3x6x7 + x0x3x8 + x0x3 + x0x4x5x7x8 + x0x4x5x7 + x0x4x6x7x8 + x0x4x6x8 + x0x4x7 + x0x4 + x0x5x6x7x8 + x0x5x6x7 + x0x5x7x8 + x0x5x7 + x0x6x7 + x0x6x8 + x0x7x8 + x1x2x3x7x8 + x1x2x4x7x8 + x1x2x4x8 + x1x2x5x7x8 + x1x2x6x7x8 + x1x2x6x8 + x1x2x7 + x1x2x8 + x1x2 + x1x3x4x7x8 + x1x3x5x7x8 + x1x3x6x7x8 + x1x3x7 + x1x4x5x7x8 + x1x4x5x8 + x1x4x6x7x8 + x1x4x7 + x1x4 + x1x5x6x7x8 + x1x5x6x7 + x1x5x7x8 + x1x5x7 + x1x5x8 + x1x6x7 + x1x8 + x1 + x2x3x4x7x8 + x2x3x5x7x8 + x2x3x6x7x8 + x2x4x5x7x8 + x2x4x5x8 + x2x4x6x7x8 + x2x4x7x8 + x2x4x8 + x2x5x6x7x8 + x2x5x6x8 + x2x5x8 + x2x6x7x8 + x2x6x8 + x2x7x8 + x2 + x3x4x5x7x8 + x3x4x5x7 + x3x4x6x7x8 + x3x4x6x7 + x3x5x6x7x8 + x3x5x7x8 + x3x6x7x8 + x3x6x7 + x3x7 + x3 + x4x5x6x7x8 + x4x5x6x8 + x4x6x7x8 + x4x6x8 + x4x7 + x5x7x8 + x5 + x6 + x7x8 + x7 + x8 + 1; (1.4) Set initial key and initial vector, fill the state bits of LFSR and NFSR; output the bits output by the output function to participate in the state update of LFSR and NFSR with the selection function; combine the dynamic initialization method to complete the initialization process; (1.5) Generate the key stream through iteration.

3. A method for implementing a small-state stream cipher based on a condition selection function according to claim 2, characterized in that, The design selection function in step (2) is specifically as follows: (2.1) 128-bit initial key is represented as , 128-bit initial vector is represented as ; 128-bit non-volatile memory is filled with 128-bit key, the state of the filled non-volatile register is ; (2.2) For this 128-bit non-volatile internal state, in clock cycle t, the key selection bit k t The calculation is: wherein r, p, q are all index subscripts of the initial key in the non-volatile memory, , , ; dv is the perturbation value, dv = s1 + s2, , a perturbation is applied when k p ≠ k q+64 , dv∧(k p + k q+64 ) is the conditional perturbation term.

4. The method for implementing a small-state stream cipher based on a condition selection function according to claim 3, characterized in that, The algorithm initialization implementation in step (3) is specifically as follows: (3.1) Fill the 90-bit NFSR register with the first 90 bits of the initialization vector IV; fill the first 38 bits of the LFSR register with the last 38 bits of the initialization vector IV; then fill the middle 22 bits of the LFSR with the filling vector PD, where PD = (PD0, ..., PD0). 21 )=1 22 The remaining positions of the LFSR are filled with 0 bits. (3.2) Set iteration variable t=0; (3.3) call the selection function and output the key selection bit k according to step (2.2) t ; (3.4) call the output function and output the key stream bit z according to step (1.3) t . (3.4) Calculate the output value of the LFSR update function, XOR it with the key stream bit z t and update the result to the LFSR, i.e.: (3.5) take the first state bit of the LFSR , the key stream bit z t , the key selection bit k t XOR the output value of the NFSR update function and update the NFSR with the result, i.e. (3.6) The algorithm iterates 128 rounds, and the process of steps (3.3) to (3.5) is repeated every round, and t=t+1 is executed every iteration; (3.7) The algorithm enters the dynamic initialization stage, selects part of the state bits of LFSR and NFSR to generate a dynamic integer dval with a value range of 0-127 for algorithm iteration, and ensures that the number of algorithm iterations is unpredictable; during iteration, the algorithm repeats steps (3.3) to (3.5) for dval times, and t=t+1 is executed every iteration; the calculation method of dval is as follows: (3.8) The algorithm repeats steps (3.3) to (3.5) for 256 rounds, and t=t+1 is executed every iteration, and then the initialization is completed; the output bits generated in each round in the above iteration process will be fed back to the update process of LFSR and NFSR.

5. A method for implementing a small-state stream cipher based on a condition selection function according to claim 4, characterized in that, The generation of the key stream in step (4) is specifically as follows: (4.1) Set the length of the plaintext data m as p; (4.2) Perform state update operation on LFSR, and the LFSR update function is defined as follows: (4.3) Call the selection function to output the key selection bit k t ; (4.4) XORing the first bit of the LFSR with the key selection bit k output by step (4.3) t , the output value of the NFSR update function, and the result is used for the state update of the NFSR, at which time the NFSR update function is defined as follows: (4.5) calling the output function to output z t ; (4.6) Let t = t + 1, p = p - 1; if p ≠ 0, go to step (4.2) to continue the next iteration; otherwise, end the iteration, and the keystream bits z generated in sequence t Concatenate in sequence to obtain the final keystream sequence z.

6. A method for implementing a small-state stream cipher based on a condition selection function according to claim 5, characterized in that, The data encryption and decryption implementation in step (5) is specifically as follows: (5.1) The data encryption process is as follows; (5.1.1) Input plaintext m and the key stream z generated in step (4); (5.1.2) XOR the m and z bit by bit, and the operation result is the ciphertext c, and the mathematical expression is as follows: where p represents the length of m, c i is the i-th bit of the ciphertext, m i is the i-th bit of the plaintext, z i is the i-th bit of the keystream; (5.2) The data decryption process is as follows; (5.2.1) Input ciphertext c and the key stream z generated in step (4); (5.2.2) XOR the c and z bit by bit, and the operation result is the plaintext m, and the mathematical expression is as follows: Wherein, p represents the length of the ciphertext c.

Images