A 16-bit s-box construction method and device based on a misty structure

Abstract

The application discloses a 16-bit S-box construction method and device based on a MISTY structure, and belongs to the field of information security. The method is characterized in that four 8-bit S-boxes are selected, and four rounds of iteration calculation are performed on high and low 8-bit data by using a MISTY type round function structure. In the method, S-box substitution, modulo addition mixing and data exchange are sequentially performed on the high 8-bit data in each of the first three rounds; and S-box substitution and modulo addition mixing are performed in the fourth round, and then the result is directly output. Finally, the result is spliced into 16-bit output. The application further provides a hardware device for implementing the method. The method utilizes the regularity of the MISTY structure, is easy to implement by using a hardware pipeline, and enhances nonlinearity by using modulo addition operation. The 16-bit S-box constructed by using the method is excellent in cryptographic properties such as differential uniformity, nonlinearity and algebraic degree, and a good balance between security and implementation efficiency is achieved.

Description

Technical Field

[0001] This invention relates to the field of information security, and in particular to a 16-bit S-box construction technique based on the MISTY structure. Background Technology

[0002] In symmetric cryptography, Shannon's principles of confusion and diffusion are general design principles for modern practical symmetric cryptography. The confusion principle states that the designed block cipher should have a highly complex dependency relationship between the key, plaintext, and ciphertext, such that this dependency is unexploitable by attackers. Nonlinear cryptographic components are the main components responsible for confusion in symmetric cryptography, with S-boxes being the most common and important type. To resist various known attacks, S-boxes need to possess good cryptographic properties, such as algebraic degree, difference uniformity, and nonlinearity. Difference uniformity is a crucial indicator of an S-box's resistance to differential analysis; the smaller the difference uniformity, the stronger the resistance, and vice versa. Nonlinearity is a crucial indicator of an S-box's resistance to linear analysis; the larger the nonlinearity, the stronger the resistance, and vice versa. In algebraic analysis, integral analysis, and other cryptanalytic techniques, a high algebraic degree is often required for the S-box to resist such attacks.

[0003] The construction methods of S-boxes mainly include mathematical construction methods, cryptographic structure-based construction methods, and random selection test methods. The input length of an S-box is typically 4 bits or 8 bits. However, in recent years, with the improvement of computing power, 4-bit and 8-bit S-boxes, due to their lower complexity, are no longer sufficient to resist cryptanalysis using high-performance computing, especially attacks from quantum computing. Compared to 4-bit and 8-bit S-boxes, 16-bit S-boxes can provide cryptographic algorithms with higher algebraic order, lower differential feature probabilities, and lower linear feature probabilities, thus enabling the designed cryptographic algorithms to more effectively resist attack threats. Currently, the design of large-state S-boxes has become a research hotspot and trend both domestically and internationally. Xu Hong et al. constructed a 16-bit S-box based on a 16-level NFSR in their NBC cryptographic algorithm design. The algebraic number was 15, the difference uniformity was 22, and the nonlinearity was 31982. This S-box has excellent cryptographic properties, but it requires 20 iterations and has a large implementation delay. Shibutani K et al. constructed a 16-bit S-box based on the SPS structure in their Piccolo cryptographic algorithm design. The algebraic number was 9, the difference uniformity was 104, and the nonlinearity was 30720. Although the implementation cost of this S-box is low, its cryptographic properties are not good.

[0004] The MISTY structure is a cryptographic design structure introduced by M. Matsui based on the research results of the Feistel structure. This cryptographic structure has the advantage of supporting parallel implementation of two rounds of operations. Modular addition is widely used in cryptographic algorithm design. For example, the lightweight cryptographic algorithm SPECK uses modular addition as the only non-linear cryptographic component. Summary of the Invention

[0005] The technical problem to be solved by this invention is to provide a 16-bit S-box implementation scheme with excellent cryptographic properties and easy software and hardware implementation, which addresses the difficulty in achieving a good balance between cryptographic properties and implementation effectiveness of the S-box generated by known 16-bit S-box construction methods.

[0006] The technical solution adopted by this invention to solve the above-mentioned technical problems is a method for constructing a 16-bit S-box based on the MISTY structure, comprising the following steps:

[0007] Step S1: Select four 8-bit S-boxes;

[0008] Step S2: For any two 8 bits, use them as the high 8 bits and low 8 bits to form 16 bits of input data. Based on 4 8-bit S-boxes, use the MISTY type round function structure to execute the first to fourth rounds of iterative calculation in sequence.

[0009] In the first to third rounds of iterative calculation, the following operations are performed sequentially in each round:

[0010] Perform a corresponding 8-bit S-box replacement on the current high 8 bits of data;

[0011] Perform a modulo addition operation between the replaced high 8 bits and the current low 8 bits.

[0012] Swap the high and low 8 bits of data;

[0013] In the fourth round of iterative calculation, the following operations are performed sequentially:

[0014] Perform the fourth iteration of 8-bit box replacement on the current high 8 bits of data, and denote the result as y0;

[0015] Perform a modulo addition operation between y0 and the current lower 8 bits of data, update y0, and record the current lower 8 bits of data as y1;

[0016] Step S3: Output 16-bit data y=y0||y1, where y0 represents the high 8 output bits of y, y1 represents the low 8 output bits of y, and || represents concatenation.

[0017] This invention also provides an S-box device obtained using the above method. Based on the construction method of this invention, by appropriately selecting four 8-bit S-boxes that satisfy the corresponding cryptographic properties, a 16-bit S-box with excellent cryptographic properties and easy software and hardware implementation can be generated.

[0018] The beneficial effects of this invention are:

[0019] 1) It supports two-round pipelined execution of operations, thereby reducing latency and improving performance in hardware implementation;

[0020] 2) The difference from the original MISTY cryptographic structure is that it uses non-linear modular addition operation instead of the usual XOR operation, which can enhance the cryptographic properties of the constructed S-box. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of the construction process of the 16-bit S-box of the present invention;

[0022] Figure 2 This is a schematic diagram of the four-round iterative calculation of the present invention;

[0023] Figure 3 This is a pipeline processing diagram for 4 rounds of iterative computation. Detailed Implementation

[0024] The invention will now be further described with reference to the accompanying drawings, but this is not intended to limit the invention.

[0025] like Figure 1 As shown, a method for constructing a 16-bit S-box based on the MISTY structure and modular addition operations specifically includes the following steps:

[0026] Step 1: Select four 8-bit S-boxes: S0, S1, S2, and S3.

[0027] Step 2: For any 16-bit raw input x = x0|| x1, where x0 represents the high 8 bits of x, x1 represents the low 8 bits of x, and || denotes concatenation. The S-box performs 4 rounds of iterative calculation, as follows: Figure 2 As shown, the output variables y0 and y1 are obtained:

[0028] Step 2.1: Perform the first round of iterative calculation using the 8-bit S-box S0, which is done in three steps:

[0029] Step 2.1.1: Calculate x0 = S0[x0]. Input the value of the high 8 bits x0 (0~255) into S0, perform a lookup table, and reassign x0 using the output of S0, i.e., replace S0;

[0030] Step 2.1.2: Receive the original input x0 and the original input x1, and perform a modulo addition operation to calculate x0 = x0 ⊞ x1, where ⊞ represents modulo 256 addition. The modulo addition operation can also be any value other than 8 modulo 256. n Addition is an operation, but other moduli would introduce unnecessary and inefficient complexity;

[0031] Step 2.1.3: Swap x0 and x1, i.e., temp=x0, x0=x1, x1=temp, where temp is a temporary variable, and output the high 8 bits x0 and low 8 bits x1 updated in the first round of iteration.

[0032] Step 2.2: Perform the second round of iterative calculation using the 8-bit S-box S1, which is done in three steps:

[0033] Step 2.2.1: Receive x0 from the first round output and x1 from the original input, and calculate x0 = S1[x0];

[0034] Step 2.2.2: Calculate x0 = x0 ⊞ x1;

[0035] Step 2.2.3: Swap x0 and x1, i.e., temp=x0, x0=x1, x1=temp, and output the updated x0 and x1 for the second round of iteration.

[0036] Step 2.3: Perform the third round of iterative calculation using the 8-bit S-box S2, which is done in three steps:

[0037] Step 2.3.1: Receive x0 from the first round of iteration output and x1 from the second round of iteration output, and calculate x0 = S2[x0];

[0038] Step 2.3.2: Calculate x0 = x0 ⊞ x1;

[0039] Step 2.3.3: Swap x0 and x1, i.e., temp=x0, x0=x1, x1=temp, and output the updated x0 and x1 in the third round of iteration.

[0040] Step 2.4: Perform the fourth round of iterative calculation using the 8-bit S-box S3, which is done in two steps:

[0041] Step 2.4.1: Receive x0 from the third round of iteration output and x1 from the second round of iteration output, and calculate y0=S3[x0];

[0042] Step 2.4.2: Calculate y0 = y0 ⊞ x1, y1 = x1, and output y0 and y1 obtained in the fourth iteration.

[0043] Step 3: Concatenate y0 and y1 to obtain a 16-bit output variable y = y0||y1, where y0 represents the high 8 bits of y and y1 represents the low 8 bits of y.

[0044] The above four iterations adopt a unified MISTY-type round function structure, such as... Figure 3 As shown:

[0045] In each round, the high 8 bits are replaced with an 8-bit S-box (x0=S). i [x0], where the value of S-box index i ranges from 0 to 3).

[0046] Next, the model is mixed (x0 = x0 ⊞ x1);

[0047] Finally, swap the high 8 bits and low 8 bits of the data, that is, the left and right halves of the data (except for the last round).

[0048] This consistent wheel structure allows hardware implementation to simply call the same logic units repeatedly, greatly simplifying circuit design.

[0049] Due to the regularity and symmetry of the MISTY structure, it possesses the following hardware advantages:

[0050] Supports pipelined processing: When multiple 16-bit data are input continuously, different rounds of operations can be performed on different data within one clock cycle, achieving a good balance between throughput and area;

[0051] Round functions are reusable: the same set of logic units can be used for time-division multiplexing of the four rounds of iteration, reducing hardware overhead;

[0052] Low-latency path: Each round contains only one table lookup, one modulo addition, and one swap. The critical path is short, which is beneficial for high-frequency implementation.

[0053] A 16-bit S-box device for implementing the above method includes:

[0054] The input register is used to latch 16 bits of input data;

[0055] The high 8-bit register and the low 8-bit register are used to store the current high 8 bits of data and the low 8 bits of data respectively during the iteration process;

[0056] The storage unit is used to store a lookup table for four 8-bit S-boxes;

[0057] The MISTY structure operation unit is logically connected to the high 8-bit register, the low 8-bit register and the storage unit, and is configured to perform the four rounds of iterative calculations as described above to generate 16-bit output data.

[0058] The output register is used to latch the 16-bit output data.

[0059] Example:

[0060] The 8-bit S-boxes in the embodiments all adopt the 8-bit lightweight S-box Sbox involved in ZL 202010994280.8. Boolean functions f1(x2, x3, x4, x5, x6, x7)=(x3&x6)⊕(x4&x7) and f2(x2, x3, x4, x5,x6, x7)=(x4&x6)⊕(x5&x7) are selected, where & represents bitwise AND and ⊕ represents bitwise XOR, resulting in the 8-bit S-box Sbox. Its truth table is as follows:

[0061] 0x00,0x04,0x08,0x0c,0x10,0x95,0x18,0x9d,0x20,0x64,0xaa,0xef,0x30,0xf5,0xbb,0x7f,0x40,0x44,0x49,0x4d,0x52,0xd7,0x5b,0xde,0x60,0x24,0xeb,0xae,0x72,0xb7,0xf8,0x3c,0x80,0x14,0x88,0x1c,0x91,0x84,0x99,0x8c,0xa2,0x76,0x28,0xfc,0xb3,0xe6,0x38,0x6d,0xc0,0x56,0xc9,0x5f,0xd3,0xc4,0xda,0xcd,0xe2,0x34,0x69,0xbf,0xf1,0xa6,0x7b,0x2c,0x01,0x65,0x19,0x7e,0x11,0xf4,0x09,0xee,0x05,0x21,0x9c,0xba,0x94,0x31,0x0d,0xab,0x5a,0x3d,0x41,0x25,0x48,0xaf,0x53,0xb6,0xdf,0xf9,0x45,0x61,0x4c,0xea,0xd6,0x73,0x81,0x77,0x98,0x6c,0x90,0xe7,0x89,0xfd,0x15,0xa3,0x8d,0x39,0x85,0xb2,0x1d,0x29,0xdb,0x2d,0xc1,0x35,0xc8,0xbe,0xd2,0xa7,0xcc,0x7a,0x57,0xe3,0x5e,0x68,0xc5,0xf0,0x02,0x06,0xa8,0xed,0x50,0xd5,0xfa,0x3e,0x22,0x66,0x0a,0x0e,0x70,0xb5,0x59,0xdc,0x46,0x42,0xac,0xe9,0x97,0x12,0x7d,0xb9,0x26,0x62,0x4f,0x4b,0xf7,0x32,0x9f,0x1a,0x2a,0xbd,0x82,0x54,0x79,0x6f,0xd1,0x86,0x8a,0x5d,0xa0,0x36,0xd8,0x8e,0xf3,0xe4,0xfe,0x6b,0x16,0xc2,0x2e,0x3a,0xc6,0x93,0x1e,0xcb,0x74,0xe0,0xcf,0x9b,0xa4,0xb1,0x03,0x67,0xfb,0xdd,0x51,0xb4,0xa9,0x0f,0x07,0x23,0x3f,0x58,0xd4,0x71,0xec,0x0b,0x9e,0xb8,0x27,0x43,0x4e,0xe8, 0xf6,0x13,0x1b,0x7c,0x63,0x47,0x4a,0xad,0x33,0x96,0x78,0x8f,0x83,0x37, 0x2b,0x5c,0xd0,0xe5,0x6e,0xd9,0x55,0xa1,0xbc,0x8b,0x87,0xf2,0x75,0xc3, 0xce,0x3b,0xa5,0x92,0x1f,0x6a,0xe1,0x17,0x9a,0x2f,0xb0,0xc7,0xca,0xff. ,

[0062] When step 1 selects four 8-bit S-boxes S0, S1, S2, and S3, all of which are the aforementioned S-boxes.

[0063] After testing, the main cryptographic properties of the constructed 16-bit S-box are as follows:

[0064] 1) The difference uniformity is 20;

[0065] 2) The nonlinearity is 31878;

[0066] 3) The algebraic degree is 15.

[0067] In terms of implementation, each round of the Sbox requires only 4 bits for AND and 4 bits for XOR operations, and the entire 16-bit S-box construction method is based on the MISTY structure, supporting two rounds in parallel, such as... Figure 3 As shown, both hardware implementation cost and performance can be guaranteed.

[0068] The 16-bit S-box designed in the publicly available NBC cryptographic algorithm requires 20 rounds of computation, with each round requiring 3 bit AND, 1 bit NAND, and 8 bit XOR operations. Compared to this, the 16-bit S-box constructed in this example has lower differential uniformity, lower hardware implementation cost, and lower latency.

Claims

1. A method for constructing a 16-bit S-box based on the MISTY structure, characterized in that, Includes the following steps: Step S1: Select four 8-bit S-boxes; Step S2: For any two 8 bits, use them as the high 8 bits and low 8 bits to form 16 bits of input data. Based on 4 8-bit S-boxes, use the MISTY type round function structure to execute the first to fourth rounds of iterative calculation in sequence. In the first to third rounds of iterative calculation, the following operations are performed sequentially in each round: Perform a corresponding 8-bit S-box replacement on the current high 8 bits of data; Perform a modulo addition operation between the replaced high 8 bits and the current low 8 bits. Swap the high and low 8 bits of data; In the fourth round of iterative calculation, the following operations are performed sequentially: Perform the fourth iteration of 8-bit box replacement on the current high 8 bits of data, and denote the result as y0; Perform a modulo addition operation between y0 and the current lower 8 bits of data, update y0, and record the current lower 8 bits of data as y1; Step S3: Output 16-bit data y=y0||y1, where y0 represents the high 8 output bits of y, y1 represents the low 8 output bits of y, and || represents concatenation.

2. The method as described in claim 1, characterized in that, Modulo addition is specifically modulo 256 addition.

3. The method as described in claim 1 or 2, characterized in that, An 8-bit S-box is an 8-bit S-box with predetermined cryptographic properties, including differential uniformity, nonlinearity, and algebraic degree.

4. The method as described in claim 3, characterized in that, The four 8-bit S-boxes were all generated using the same construction method that included nonlinear Boolean functions.

5. The method as described in claim 1, characterized in that, The S-box replacement is specifically: x0 = S i [x0], x0 is the high-order 8 bits of data, S i Let i be an 8-bit box for the i-th iteration, where i ranges from 0 to 3.

6. A 16-bit S-box device based on the MISTY structure, characterized in that, include: The input register is used to latch 16 bits of input data; The high 8-bit register and the low 8-bit register are used to store the current high 8 bits of data and the low 8 bits of data respectively during the iteration process; The storage unit is used to store a lookup table for four 8-bit S-boxes; The MISTY structure arithmetic unit is logically connected to the high 8-bit register, the low 8-bit register and the storage unit, and is configured to perform the iterative calculation as described in claim 1 to generate 16-bit output data. The output register is used to latch the 16-bit output data.

Images