A technical method of a preferred byte-type s-box, and a method for working a block cipher

Abstract

This invention discloses a preferred S-box construction method for block ciphers, wherein the preferred S-box is X. ‑1 The invention of the series structure of components and linear transformation components lies in generating sufficient jitter in the selection of S-boxes. This jittering method involves randomly permuting the connection of components and / or the input / output connections, comprehensively considering the linear diffusion logic P-boxes in block ciphers, and preferentially selecting S-boxes that contribute significantly to the destructive effect on the mask differential path. The technical advantage is that it increases the number of minimum differential active S-boxes or minimizes the probability of the maximum differential feature without increasing hardware or software costs. For low area performance, X is defined... ‑1 The elements are represented as composite or tower domains, and both the linear transformation element and its inverse transformation are XOR operations with three cyclic shifts. The optimal embodiment is equivalent to minimizing hardware area cost and maximizing differential security performance.

Description

Technical Field

[0001] This invention relates to the field of computer symmetric cryptography design and its industrial applications, and more specifically to a preferred byte-type S-box technique and a block cipher operating method. Background Technology

[0002] In the field of block cipher design, X -1 Byte-type S-boxes are widely used in block ciphers. Industry standards include, but are not limited to, AES and Camellia (the world's leading standard competitor), SM4 and ARIA (national standards). All S-boxes employ a 256-tuple multiplicative inverse design, offering the strongest resistance to differential, linear, and algebraic attacks.

[0003] The preferred embodiment of the invention patent "A Self-Reversible Block Cipher" (application number 2024114403213), EWES (as defined in claim 7), is a competing design to AES and SM4, and the S-box used is also X. -1 Type byte type S-box.

[0004] Regarding the design of block ciphers for SPN structures, the abstract of "Structural Cryptanalysis" (authored by Sun Bing in the Journal of Cryptology) states: "Structural cipherptanalysis refers to cipher methods that are independent of the nonlinear components of cryptographic algorithms, such as impossible differential analysis, zero-correlation linear analysis, and lower bounds for calculating the number of active S-boxes, etc..." Summary of the Invention

[0005] The background technology invention patent embodiment EWES only discloses the ROM table of the S-box, and does not disclose the preferred S-box construction method, technical principle, algebraic expression and corresponding technical effect analysis.

[0006] This instruction manual reading guide states: those prefixed with ☆☆ are the highest level summaries, mainly summarizing the technical problems, inventive concepts, and key technical effects of the invention; those prefixed with ☆ followed by a serial number indicate the content of the invention.

[0007] Regarding the X described in the background art -1 In selecting the S-box for the byte type, the inventors discovered that the designers of AES, SM4, ARIA, and Camellia did not consider the impact of the interaction between the linear layer components and the S-box on the differential path.

[0008] The basis for the above conclusions, for example, is that the AES designers only claim that, based on the wide trajectory strategy, the minimum difference feature is calculated according to the number of minimum difference active S-boxes, and the calculation method corresponds to 2 for each active difference S-box. -6The differential probability, in short, did not mention the effect of linkage with the S-box. Another basis is that the definitions of all S-boxes are very concise. For example, the S-box of AES is first defined as 5 cyclic shift XOR as linear transformation elements, and then connected in series with X -1 Logical transformation, where X -1 The field representation of the irreducible polynomial is m(x) = x⁸ + x⁴ + x³ + x + 1.

[0009] To explore the synergistic effect between the linear diffusion component and the S-box component, a general differential path analysis model for the SPN structure or the odd-even-odd self-reversible structure is first presented.

[0010] Differential path: S-box layer -> Linear layer 1 -> S-box layer -> Linear layer 2 -> S-box layer -> Linear layer 3 -> S-box layer..... When designing EWES, the inventors first innovated the overall structure, then optimized the linear diffusion layer with the largest number of branches under modulo 2 constraints, and then evaluated the minimum number of active S-boxes by linking linear layers based on the cryptanalysis principles of the background technology. The final step is the selection of the S-box layer, which is the content of this invention; based on the background technology, X is proposed to be selected. -1 Type-byte S-boxes, such as S-boxes that directly use AES.

[0011] The inventors discovered that, given a path "linear layer 1" -> "linear layer 2" -> "linear layer 3", not all S-boxes can guarantee that the given difference path will be 2... -6 This means that the probability of a certain S-box contributing a differential feature is not 2. -6 Instead, 2 -7 Or (with a high probability) 0, the fact that certain S-box selections disrupt certain differential paths is precisely the property desired by block cipher designers; these are referred to as S-boxes that contribute to the disruption of differential paths. Based on the above findings, the inventors devised a method for optimizing S-boxes. The main idea is that for certain differential paths that are the least weighted differential paths, the S-box selection will generate a large amount of random jitter, and the S-box that kills all least weighted paths will be optimized.

[0012] All the differential paths with the lowest weight from "Linear Layer 1" to "Linear Layer 2" to "Linear Layer 3" have been compiled. It was found that there are dozens of paths with a minimum weight of 21. The following is the differential path with the lowest weight represented by a mask.

[0013] S box -> 1800-65d5 -> S box -> 65d5-8e41 -> S box -> 8e41-6060 -> S box S box -> 1c00-3535 -> S box -> 3535-8cac -> S box -> 8cac-0094 -> S box S box -> 3000-caab -> S box -> caab-8d81 -> S box -> 8d81-0107 -> S box.

[0014] The method to generate jitter is to treat the byte-type S-box as an X-box. -1 The series connection of the element and the linear transformation element allows the element to be connected and / or the input and output of the S-box to a certain random bit permutation, which is the degree of freedom of jitter.

[0015] Theoretical analysis and evaluation suggest that if the jitter has a sufficient number of degrees of freedom and the number of minimum weight paths is relatively small, there is a high probability of finding an S-box that kills all minimum weight paths. Through long-term exhaustive testing on a high-performance workstation, at least two sets of S-boxes were found that can kill all differential paths of weight 21 and all of weight 22. For EWES, disregarding the destructive contribution of S-boxes, based on the wide-trajectory strategy, the number of minimum differential active S-boxes in 4 rounds is 21; after adopting optimized S-boxes, the number of minimum differential active S-boxes in 4 rounds reaches as high as 23.

[0016] In summary, the key invention of this embodiment, which is also the EWES S-box selection method, is to generate sufficient jitter in the S-box selection to preferentially select the S-box that contributes the most to the disruption of the masked differential path. The preferred effect is that the number of minimum differential active S-boxes ranges from 21 to 23. The main selection idea has been stated; some more detailed conclusions will be presented in Embodiment 1.

[0017] Specific embodiment 2 provides a better replacement scheme for the S-box of SM4; the smaller cost is that only the S-box entry bit is randomly jittered to achieve the desired effect, and the maximum differential probability of the T component of SM4 mapping itself is reduced from 2. -19 Reduced to 2 -20 In terms of overall technical effects, after being empowered by this invention, the original 20 rounds of differential diffusion effect are equal to 19 rounds of replacement effect.

[0018] The S-box entry bit replacement path cannot be connected, 2 21 , 2 20 , 2 19 , 2 18 ; Compared to the original S box: (01234567)->(01234567) 56100,7722,180 , 3,0; Preferred S-box: (01234567)->(19375264) 56090,7780,135, 0,0.

[0019] ☆☆The first inventive point of this invention is that the selection of the S-box generates a sufficient amount of random jitter, wherein the random jitter is to permutate a certain random bit in the component connection and / or input / output connection; taking into account the linkage between the S-box and the linear layer of the block cipher, the S-box that contributes more to the destructive effect on the mask differential path is preferred.

[0020] ☆1. A technical method for selecting a preferred byte-type S-box, wherein the byte-type S-box is X -1 The series structure of the element and the linear transformation element, The invention point 1 is that the selection of the S-box generates enough random jitter, which is to cause the component connection and / or input / output connection to be replaced by a random bit. Taking into account the interaction between the S-box (nonlinear confusion component) and the P-box of the block cipher linear diffusion logic, the S-box that makes a large contribution to the destructive effect of the mask differential path is selected. The criterion for a large contribution to the destructive effect is that the differential feature probability is 0 or relatively smaller.

[0021] The masked differential path clearly corresponds to the differential path with the minimum number of active S-boxes; otherwise, there is no point in discussing it. A relatively smaller range is the set of S-boxes generated by random jitter.

[0022] The side effects of "random jitter": First, compared to the S-box definition in the background technology, random jitter makes the S-box definition of this invention less concise in form, and it is highly likely to involve random bit permutation. This side effect is precisely the main basis for determining whether it falls within the protection scope of this invention; if there is no technical effect, there is no need to make the S-box definition complicated and less concise.

[0023] The engineering costs of "random jitter": First, software lookup tables and GFNI instructions are insensitive to random jitter, meaning that regardless of the random permutation, all software overhead is the same. Because random permutation results in a line delay range of only 8 bits, the overhead of all ASICs and FPGAs is almost negligible. The main conclusion of the comparative experiment 3 in Example 3 is that random jitter has no impact on area performance.

[0024] How many "random jitters" are there: if X -1 With one linear transformation element selected, there are up to 8! * 8! * 8! degrees of freedom; with two linear transformation elements, the degrees of freedom are even greater; and because X -1 And the linear transformation element also has a degree of freedom in selection. Conclusion: ☆1. The degree of freedom in selection can be extremely large.

[0025] ☆1 Technical effect: Without considering the implementation cost of the S-box, the block cipher using the preferred S-box has a better resistance to differential attacks. It can be considered that a large destructive contribution is equivalent to a good resistance to differential attacks.

[0026] ☆2. According to the technical method of ☆1, the number of bytes in the P box does not exceed 16 bytes.

[0027] Firstly, the S-box and P-box can be directly constructed into block ciphers using the SP structure or the odd-even-odd structure, such as in Example 1, AES, and ARIA. Alternatively, they can be directly constructed into block ciphers using the feistl structure or the generalized feistl structure, such as in Example 2 and Camellia.

[0028] The main reason for proposing the ☆2 technical feature is that even calculating the branch count and connection relationships of a typical 16-byte box can be implemented on a high-performance workstation. The differential feature analysis of the 16-byte P-box is equivalent to extracting 1-32 byte mask combinations from a 32-byte box.

[0029] Based on the implementation methods of Embodiments 1 and 2, it is necessary to first calculate the number of differential branches of the linear transformation, and then solve the connection of the low-weight linear transformation. This is because calculating the number of branches for a 16-byte SP component is equivalent to a minimum codeweight of 32 bytes, and the codeweight unit is bytes (which happens to match the S-box of the protected subject of this invention). Referring to the main idea of ​​the background patent, a 32-byte wide parity sub-matrix is ​​first calculated, 9 bytes are extracted from the 32 bytes, and the minimum codeweight is determined by solving the equation. In summary, when the SP component is small, based on the computing power of a high-performance workstation and the technical inspiration of the embodiments, the implementation of ☆1 is highly feasible.

[0030] To provide a counterexample, if the P-box is as large as 32 bytes, it is equivalent to extracting 1-64 bytes of mask combinations from 64 bytes. The time and space complexity are obviously astronomical, and the technical methods of embodiments 1 and 2 of this invention cannot be supported for implementation because the computing power and space consumption are too great.

[0031] Regarding the technical means and objectives of ☆1 and ☆2, this paper summarizes the technical problems and objectives of the present invention, and addresses X. -1 The selection of S-boxes of various byte types prioritizes those that contribute most to the destructive impact of long differential paths. The technical problem addressed in this invention is innovative because the key challenge lies in the requirement for a highly sophisticated differential path analysis module to utilize this technique. The implementation of these techniques is based on the inventors' research into optimal differential attack paths and the evaluation through computer program selection, requiring both mathematical knowledge and strong implementation capabilities. In summary, the inventors' technical approach can at least calculate the number of branches in a 16-byte SPN structure, identify long links in masked differential paths, and evaluate their destructive contribution by incorporating them into the S-box difference table.

[0032] For X -1 This invention aims to provide technical solutions (☆3 to ☆6) for low-area ASIC and FPGA implementations of components and linear transformation components, and evaluate the rationality of the designs. (Practical X) -1The design and selection of components and linear transformation components must precede, ☆1 and ☆2; after the linear layer of EWES is finalized, X needs to be selected. -1 A type of S-box. Design goal: Minimize hardware area; similar to AES, reuse of X-box needs to be considered. -1 The issue is with the components; specifically, the hardware area of ​​the bidirectional S-box should be minimized. It primarily targets the S-box of AES. The consensus in cryptographic design is that the absence of linear transformation components is advantageous against algebraic attacks. The design concept of the S-box component is that X... -1 Directly selecting the composite domain (preferably the tower domain) and choosing three cyclic shifts for the linear elements is clearly superior to the S-box and S-type of AES in form. -1 The box has low operating costs.

[0033] The inventors discovered that, firstly, certain block ciphers need to consider the performance of bidirectional S-boxes, i.e., the X-1 elements of the S-box are reused for encryption and decryption. Secondly, the inverse transformation parameters of certain cyclic shift parameters a, b, and c are advantageous for constructing bidirectional S-boxes with low area.

[0034] ☆3. According to the technical method of ☆1, the X -1 The domain representation of a component uses a composite domain definition.

[0035] To save hardware space, the industry implements AES and SM4 S-boxes based on composite fields, with the tower field being a special case of the composite field. Subfields within the composite field are then further implemented using composite fields. ☆3 Technical Effects, X -1 Defining a composite field directly obviously saves area and avoids the overhead of field isomorphism.

[0036] This invention allows the linear transformation element to degenerate into a straight-through connection, i.e., an equivalent identity matrix transformation; the advantage is that the differential diffusion characteristic remains optimal, except for X. -1 There are no other overheads; the downside is that the algebraic expressions become simpler, which reduces the effectiveness against algebraic attacks, so it is generally not recommended by the cryptography community and industry.

[0037] The technical feature of ☆6 is the optimal embodiment of ☆3, and the output ROM table is shown in one of the figures of this invention.

[0038] ☆4. According to the technical method of ☆3, the linear transformation element is a 3-cycle shift XOR.

[0039] To improve resistance to algebraic attacks, the S-cell of AES introduces five cyclic shift XOR operations; the technical effect and invention objective of ☆4 is that three cyclic shifts result in a relatively area-saving and transistor-saving design while simultaneously improving resistance to algebraic attacks. It should be noted that not all cyclic shift XOR operations are reversible, but the linear transformations in this invention and the background technology are assumed to be reversible.

[0040] ☆5. According to the technical method of ☆4, the three cyclic shift exclusive-or parameters are a, b, and c, where a, b, and c satisfy the relationship, g(x) = x <<< a ⊕ x <<< b ⊕ x <<< c and g -1 (x) = x <<< (8 - a) ⊕ x <<< e ⊕ x <<< f.

[0041] For the invention purpose of ☆5, in order to minimize the area performance of the bidirectional S-box, the inventor's research conclusion is as follows. The cyclic shift needs to be limited. Briefly speaking, the linear element g(x) of the S-box and the inverse of the linear element g -1 (x) need to be limited. g(x) = x <<< a ⊕ x <<< b ⊕ x <<< c; and g -1 (x) = x <<< (8 - a) ⊕ x <<< e ⊕ x <<< f.

[0042] There are two technical effects of ☆5. First, instantiate the S -1 box. The linear transformation element of the S -1 box is also a three-cyclic shift exclusive-or design that is relatively area-saving and transistor-saving. On the other hand, when instantiating the bidirectional S-box, the attached Figure 2 link can be adopted to reuse the X -1 unit. According to the direction control selection of "g(x) or x <<< a", "x <<< (8 - a) or g -1 (x)", the circuit wiring cost is obviously smaller than that of the design where it is not 8 - a. Comparative experiment 2 in Example 3 can prove this.

[0043] For the invention purpose of ☆6, the existing common sense in the industry is to use the composite field (even more specifically, the tower field) to implement the non-linear logic part of AES and SM4 in order to reduce the area overhead. Therefore, directly using the composite field to define X -1 is an area-saving design.

[0044] ☆6. According to the technical method of ☆5, limit the domain representation of X -1 to be constructed from the tower field, GF(16 2 ) = GF(16) / x 2 ⊕ X ⊕ 4'b1110, where GF(16) = GF(4) / x 2 ⊕ X ⊕ 2'b10, GF(4) = GF(2) / x 2 ⊕ X ⊕ 10.

[0045] The test results of Example 3 can prove that the area cost of ☆6 is significantly better than the performance of the AES S-box.

[0046] ☆7. A block cipher working method. The block cipher uses a byte-type S-box as a non-linear confusion element. The invention point is that the S-box conforms to the definitions of ☆1 - ☆6.

[0047] In summary, the effects of ☆7 technology are: ☆1 and ☆2 are equivalent to a design with better resistance to differential attacks; ☆3-☆6 are equivalent to a design that saves transistors and area.

[0048] ☆8 An apparatus for implementing a block cipher method, the apparatus being in the form of a computer, server, hardware computing circuit, etc., the apparatus including a memory and a processor, the memory storing a computer program, the computer program being configured to be executed by the processor, and when the computer program is executed, implementing the block cipher method described in ☆7. Attached Figure Description

[0049] The red markings in the attached figures correspond to the technical features or effects of invention points 1 (☆1 and ☆2), while the blue markings in the attached figures correspond to the technical features and effects of invention points 2 (☆3 to ☆6).

[0050] Figure 1 Example 1: Demonstration of the effect of the preferred S-box on the differential path disruption; Figure 2 A diagram illustrating the preferred embodiment of invention point 2. Figure 2 The blue part is the embodiment of ☆5; Figure 3 . Circuit diagram for pressure test of the area index of the 4-layer S-box to examine the technical effect of invention point 2; Figure 4 .X -1 The optimal implementation of the component is the ROM table, more specifically, defined by ☆6X. -1 ROM table of components; Figure 5 The test vector is calculated by decomposing the preferred S-box.

[0051] Specific implementation methods.

[0052] Example 1: Optimization of S-box parameters based on EWES for maximizing destructive contribution S-box X -1 The components and linear transformation components are first selected; for details of the selection process and indicators, please refer to "Example 3" below. The degrees of freedom that generate random jitter are the a, b, c, Pi and Pf arrangements, approximately 8! * 8! * 40 degrees of freedom jitter.

[0053] Since the linear layers and overall structure of EWES have been selected, the differential path with the minimum mask weight (minimum number of active S-boxes) can be found by computer search using the concept of structural cryptanalysis (background technique).

[0054] For EWES, considering only structural analysis, there are dozens of paths with a minimum weight of 21. Below is a typical path example represented by a mask.

[0055] S box -> 1800-65d5 -> S box -> 65d5-8e41 -> S box -> 8e41-6060 -> S box S box -> 1c00-3535 -> S box -> 3535-8cac -> S box -> 8cac-0094 -> S box S box -> 3000-caab -> S box -> caab-8d81 -> S box -> 8d81-0107 -> S box The method to generate jitter is to treat the byte-type S-box as an X-box. -1 The series connection of the element and the linear transformation element allows the element to be connected and / or the input and output of the S-box to a certain random bit permutation, which is the degree of freedom of jitter.

[0056] Theoretical analysis and evaluation suggest that if the jitter has sufficient degrees of freedom and the number of minimum weight paths is relatively small, there is a high probability of finding an S-box that kills all minimum weight paths. Through long-term exhaustive testing on a high-performance workstation, at least two sets of S-boxes were found, which can kill all differential paths of weights 21 and 22. For EWES, disregarding the destructive contribution of S-boxes, the number of minimum differential active S-boxes in 4 rounds is 21. After optimizing the S-boxes, the number of minimum differential active S-boxes in 4 rounds reaches as high as 23.

[0057] Background technology structure analysis results: 1->10->14->21->*->*->40 The technical effects of the preferred S-box of the present invention are: 1->10->16->23->*->*->42.

[0058] Example 2: The empowerment modification of the S-box of the SM4 algorithm according to the present invention The SM4 standard initially only disclosed the ROM table. The 2007 paper "Analysis of the SMS4 Block Cipher" presented the properties of the SM4 S-box and its algebraic expression S(x) = I(x*A1+C1)*A2+C2. The paper argued that it is difficult to derive the algebraic expression from only the ROM table information. This argument supports the claim that the EWES invention patent, lacking an algebraic expression for its S-box, effectively did not disclose its construction method.

[0059] According to the paper, SM4, due to its sequence recursion and the overall structure of the generalized fessel, naturally possesses high-probability difference paths with special difference patterns that flip with periodic oscillations. The most common are difference paths combining △ and ○, as well as those combining ○, α, β, and α⊕β, where ○ represents 0 difference. The inventors believe that SM4 does not block these high-probability difference paths like Camellia does, nor does it have a p(△->△) index for the preferred T component. Below, a high-probability difference characteristic path is first given, and then the high-probability p(△->△) difference path △->△ of SM4 is found.

[0060] Input differences: △, △, △, ○, β Recursive direction of the sequence Round 1: △, △, ○, △, Round 2: △, ○, △, △, Round 4: △, △, △, △•p1, Round 21: △•p6, △•p7, ○•p8, △•p8, Round 22: △•p7, ○•p8, △•p8, △•p8.

[0061] The T component first passes through 4 S-boxes and then through the MDS matrix. Clearly, the maximum difference only considers 3 active S-boxes because the SM4 MDS is cyclically shifted and equivalent. Therefore, we only need to trace the 00******->00****** difference path. If all 3 S-boxes are permeable, there are a total of 64005 possibilities. Substituting these into the S-box difference table, we find 3... -19 The high probability of △->△.

[0062] S-box input: 002cf5cd 00c30290 00d2c822 S-box outputs: 00383904 00908145 00e9bf58 Linear transformation: 002cf5cd 00c30290 00d2c822.

[0063] Difference probability: 2 6 ×2 6 ×2 7 2 7 ×2 6 ×2 6 2 7 ×2 6 ×2 6 .

[0064] By employing the technical means of ☆1 or ☆2 of this invention, only the entry bit is replaced, and a better S and design with p (△->△) index is found.

[0065] The S-box entry bit replacement path cannot be connected, 2 21 , 2 20 , 2 19 , 2 18 ; Compared to the original S box: (01234567)->(01234567) 56100,7722,180 , 3,0; Preferred S-box: (01234567)->(19375264) 56090,7780,135, 0,0.

[0066] In terms of resistance to differential characteristics, the new SM4 algorithm, empowered by ☆1 or ☆2, achieves 19 rounds, which is equivalent to the original design of 20 rounds, resulting in a significant improvement in resistance to differential performance.

[0067] Example 3: S-box design process for EWES for Invention Point 1 After the linear layer of EWES is defined, X needs to be selected. -1 An S-shaped box. The main design concept is X... -1 Directly select the composite domain (preferably the tower domain), and choose 3 cyclic shifts for the linear element; compared to AES's X... -1 Logical and linear transformation logic, in form, is clearly superior to the S-box and S-box of AES. -1 The box has low operating costs.

[0068] The inventors discovered that the inverse transformation parameters of certain cyclic shift parameters a, b, and c are also exactly three cyclic shift parameters e, f, and g, with some of g, e, and f satisfying the constraint g = 8 - a. The inventors found that the area overhead of bidirectional S-boxes constructed using parameters a, b, c, and (8 - a), f, and e is naturally very small. This is because the wiring results a and (8 - a) can be reused. For specific implementation methods, please refer to the appendix. Figure 2 The blue component will be analyzed in more detail.

[0069] g = (8 - a); 3-in-1-out logic; g ≠ (8-a); 4-input 1-output logic + S and S -1 Directional control door.

[0070] Search the computer for all 40 results, separating them with semicolons (;). Each result is a, b, c, (8-a), f, and e. S1 below is the S-box of EWES, with parameters 1, 5, 3 for a, b, c, and 7, 3, 5 for (8-a), f, and e. Fixed-point elimination of linear affine factors is used; a, b, and c are represented by 8'h10, and 7, 3, and 5 by 8'ha2. (Appendix) Figure 2The red part contains random permutation parameters (☆1 random jitter parameters), with preferred random jitter parameters being "Pio=30672145" and "Pf=01267345". These can be determined according to the attached... Figure 4 Test vector verification.

[0071] 1,0,4, 7,2,6; 5,0,4, 3,2,6; 3,0,4, 5,2,6; 7,0,4, 1,2,6; 1,2,6, 7,0,4; 5,1,3, 3,5,7;3,1,5, 5,3,7; 7,1,3, 1,5,7; 1,3,5, 7,3,5; 5,1,7, 3,1,7; 3,1,7, 5,1,7; 7,1,5, 1,3,7; 1,3,7, 7,1,5; 5,2,6, 3,0,4;3,2,6, 5,0,4; 7,2,6, 1,0,4; 1,5,7, 7,1,3; 5,3,7, 3,1,5; 3,5,7, 5,1,3; 7,3,5, 1,3,5; 2,0,4, 6,0,4; 6,0,2, 2,0,6;4,0,2, 4,0,6; 0,1,5, 0,1,5; 2,0,6, 6,0,2; 6,0,4, 2,0,4;4,0,6, 4,0,2; 0,2,4, 0,4,6; 2,1,5, 6,1,5; 6,1,5, 2,1,5;4,1,5, 4,1,5; 0,2,6, 0,2,6; 2,3,7, 6,3,7; 6,2,4, 2,4,6;4,2,6, 4,2,6; 0,3,7, 0,3,7; 2,4,6, 6,2,4; 6,3,7, 2,3,7;4,3,7, 4,3,7; 0,4,6, 0,2,4.

[0072] To verify the technical effect of the present invention, the inventors designed an area index pressure testing platform, as shown in the appendix. Figure 3 The main design principle is to minimize the physical area cost of 4 S-boxes across 4 layers, simplify the peripheral circuitry to the lowest possible level, while ensuring the ability to test 3 types of S-boxes. The Verilog code first supports bidirectional S-boxes, and only one type is instantiated during synthesis. (Appendix) Figure 3 The circuit not only supports Modelsim simulation, but also supports verifying the physical effect of the EMP570 circuit through LEDs.

[0073] Firstly, besides the AES-S box, the X of other S boxes... -1 The component is equal to ☆6, and the linear transformation component is designed according to ☆4 and ☆5.

[0074] S-box definition: #Bidirectional S-box# S-box#S -1 Box / / Remarks S1: 281 232 248 / / Complies with ☆5, more specifically EWES's S box S2: 295 234 247 / / Compliant with ☆5 S3: 332 231 248 / / S box and S -1 Box meets ☆4, does not meet ☆5 S4: 316 240 247 / / S box and S -1 Box meets ☆4, does not meet ☆5 AES-S box: 404 309 288 / / AES code found online.

[0075] Comparative Experiment 1: AES unidirectional S-box and attached Figure 2 Comparison of S-box area indicators Comparison Methods and Conclusions: Area Indicators Comparison between AES-S Box and S1 / S2 / S3 / S4, Two-Way S Box, S Box and S -1 Each item in the box is smaller than the AES-S box; this demonstrates the significant technical effectiveness of ☆4 and ☆5.

[0076] Comparative Test 2: The technical advantages of ☆5 compared to ☆4 Comparison of methods and conclusions: The bidirectional S-box areas of S1 / S2 and S3 / S4 are 281 / 295 and 332 / 316, respectively, indicating that the g=8-a scheme can significantly reduce the bidirectional S-box area overhead.

[0077] Comparative Experiment 3: The effect of random jitter of ☆1 on the solid area The values ​​“281:295”, “232:234”, “231:240”, and “332:316” demonstrate that random jitter within 5% is both very small and largely consistent with the random fluctuation range of FPGA synthesis. The final conclusion is that random jitter does not affect the physical circuit area overhead.

[0078] Section 4: Evaluation of the Principles and Counting Problems of this Invention Given X -1The S-box is a byte-type S-box, corresponding to a 256x256 difference probability table. Based on known knowledge, the connection probability for each non-zero input row or output column is 126 2 / 256, 1 4 / 256, and 129 0s, represented using a base-2 logarithm (126 / 256 * X). -6 +1 / 256X -7 +129 / 256*X -∞ ).

[0079] Given a difference path connection, if we consider the connection of n S-boxes (see appendix) Figure 1 In Example 1, n is 5, and in Example 2, n is 3. The logarithm of the final probability distribution is expressed as (126 / 256*X). -6 +1 / 256X -7 +129 / 256*X -∞ ) n The best outcome for a destructive contribution is when the probability of a certain S-box connection is 0, and the probability that the given differential path is killed or not killed is equal to (127 / 255). n Clearly, the larger n is, the greater the probability that the differential path will be killed.

[0080] To explain how the destructive contribution works in its best-case scenario, let's first consider the appendix. Figure 1 In the case of C paths with minimum weight, there are an average of A linear combinations passing through the S-box input and an average of B linear combinations passing through the S-box output. To eliminate all paths with minimum weight, all C*A*B possibilities need to be eliminated. First, the probability of each possibility being eliminated is very high (essentially equal to 1 - (127 / 255)). n When the combination of C*A*B is very small (Example 1), and ☆1 just happens to provide the opportunity to repeatedly try to kill all C*A*B possibilities, it is possible that the difference probability table corresponding to a certain randomly jittering S-box will just kill all C*A*B possibilities.

[0081] When the C*A*B combination is very large (Example 2), even if ☆1 provides more or even the most trial opportunities, it will not eliminate all possible C*A*B combinations. In this case, finding an S-box with the smallest maximum difference feature, as in Example 2, is a good result. There is another situation where the C*A*B combination is too large for the computer to process. In this case, the technique of ☆1 cannot be implemented, and this situation will inevitably occur sooner or later. Taking Example 1 as an example, first eliminating all paths with the smallest weight 21, corresponding to a very small C*A*B combination, so the implementation of ☆1 quickly selects many S-boxes. For all paths with the smallest weight 22, corresponding to a larger C*A*B combination, the implementation of ☆1 barely finds only 2 sets of S-boxes that meet the conditions. Preliminary investigation reveals that the number of all paths with the smallest weight 23 is too large for a regular computer to handle, let alone C*A*B combinations.

[0082] In summary, the smaller the C*A*B combination and the larger n is, the more random jitters t ☆1 provides, and the greater the probability that all minimum weight paths are killed. Theoretically, this can be roughly evaluated using probability formulas. Given C*A*B, n, and t, the probability of all minimum weight paths being killed is assessed. Generally, it is considered that if C*A*B is particularly large, the effect of ☆1 is not significant. Theoretically, the maximum value of t degrees of freedom does not exceed the square of the count of an 8×8 random invertible matrix, which is equivalent to ☆1 having two linear transformation elements with the largest possible degrees of freedom.

[0083] Example 5: The S-box energizing effect on AES is not obvious. Examples 1 and 2 achieved good technical results. Similarly, based on ☆1, the S-box of AES is randomly jittered or randomly selected. -1 The S-type box was used to examine whether it could effectively improve resistance to differential analysis.

[0084] The main conclusions are: AES has at least 26 active S-boxes in 5 rounds; the weight distribution of the minimum weight differential path is 1->4->16->4->1, dividing the path into two segments where collisions occur at weight 16. Finally, the C*A*B combination is very large; firstly, t is unable to kill this low-weight path; similarly, the C*A*B combination is exceptionally large, proving that the new differential analysis results are more than 2 times the number of active S-boxes for the wide trajectory. -6 The results of the differential probability analysis are slightly better. Therefore, compared to Examples 1 and 2, the ☆1 empowerment effect of Example 5 is not significant.

[0085] Expanding the scope of protection statement Since the differential path only considers the linear transformation part, this invention uses linear transformation elements for description. In practice, S-boxes are all linear affine transformations, meaning that a constant term is XORed at the S-box entrance or exit. For example, XORing the constant term in the S-boxes of AES and EWES eliminates fixed points. In short, transforming linear transformation elements into linear affine logic also falls within the scope of this invention.

[0086] The main idea of ​​this invention is to generate random jitter with constant area overhead, and to find and select S-boxes with large destructive contributions within our capabilities. Because the degree of freedom of random jitter is large, selecting the minimum weight differential path requires more refined construction costs. If the design definition of a certain S-box is not concise, and it is claimed that the analysis results of certain differential paths are significantly better than the coarse evaluation results of the wide trajectory strategy, the S-box design should be considered to fall within the protection scope of this invention.

[0087] The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and to implement it accordingly. Those skilled in the art will understand that various substitutions, changes, and modifications are possible without departing from the inventive point of the present invention. In short, the scope of protection of the present invention should not be limited to the content disclosed in the embodiments of this specification.

Claims

1. A technical method for selecting a preferred byte-type S-box, wherein the byte-type S-box is X -1 The series structure of the element and the linear transformation element is characterized by, The selection of the S-box is subject to random jitter, which is achieved by randomly permuting the connection of the component and / or the input / output connection of a certain bit. Taking into account the interaction between the S-box and the block cipher linear diffusion logic P-box, the S-box that contributes significantly to the disruption of the mask differential path is selected. The criterion for significant disruption is... The probability of the differential feature is 0 or relatively smaller.

2. The technical method according to claim 1, characterized in that, The number of bytes in the P box does not exceed 16 bytes.

3. The technical method according to claim 1 or 2, characterized in that, The X -1 The domain representation of a component uses a composite domain definition.

4. The technical method according to claim 3, characterized in that, The linear transformation element is a 3-cycle shift XOR.

5. The technical method according to claim 4, characterized in that, The three cyclic shift parameters are a, b, c, where a, b, c satisfy the relationship, g(x) = x <<< a ⊕ x <<< b ⊕ x <<< c and g -1 (x) = x <<< (8 - a) ⊕ x <<< e ⊕ x <<< f.

6. The technical method according to claim 5, characterized in that, The composite domain is a tower domain, and the tower domain is constructed using the following method. GF(16 2 =GF(16) / x2⊕X⊕4'b1110, where GF(16) =GF(4) / x2⊕X⊕2'b10, GF(4) =GF(2) / x2⊕X⊕1.

7. A block cipher operating method, wherein the block cipher uses a byte-type S-box as a non-linear confusion component, characterized in that, The S-box conforms to any of the definitions in claims 1 to 6.

8. An apparatus for implementing a block cipher method, the apparatus comprising a memory and a processor, the memory storing a computer program configured to be executed by the processor, wherein, when executed, the computer program implements the block cipher method of claim 7.

Images