Lightweight stream cipher for hardware roots of trust

Abstract

A circuit comprising a first device, a second device, a third device, a selection combining device, and an encryption device, the first device comprising a non-linear feedback shift register, the second device comprising a non-linear feedback shift register, the third device comprising a ring generator. Each of the selection combining devices is configured to output one of bits of a keystream, the one of bits of the keystream derived from a combination of a first one or more bits and a second one or more bits. The first one or more bits generated based on a first set of bits output from the first device and a third set of bits output from the third device. The second one or more bits generated based on a second set of bits output from the second device and a fourth set of bits output from the third device. The encryption device configured to combine a bit to be encrypted with a bit of the keystream to generate an encrypted bit.

Description

Technical Field

[0001] The technology disclosed herein relates to the field of hardware security and trust. Various implementations of the disclosed technology are particularly advantageous for encrypting and decrypting test data. Background Technology

[0002] Stream ciphers play numerous roles in securing various digital ecosystems, such as authentication, proof-of-care, firmware updates, chip identity processing, and cryptographic key and function management. In the field of integrated circuit testing, stream ciphers are often integrated into silicon chips as custom security modules. Their task is to encrypt and decrypt test data streams by combining them with cryptographically generated, cryptographically secure pseudo-random key streams, thereby producing encrypted or decrypted test stimulus and response streams. Since this combination is typically accomplished through an XOR operation, binary addition ciphers constitute the vast majority of implemented stream ciphers.

[0003] Many stream cipher designs are based on nonlinear filtering sequences generated by linear feedback shift registers. In some other designs, linear feedback shift registers can be replaced by nonlinear feedback shift registers. A comprehensive review of these conventional solutions can be found in the following review papers: SA Jassim and AK Farhan, “A survey on stream ciphers for constrained environments,” in Proc. Babylon Int. Conf. on Information Technology and Science, 2021, pp. 228-233; MA Philip and Vaitiyanathan, “A survey on lightweight ciphers for IoT devices,” in Proc. Int. Conf. on Technological Advancements in Power and Energy, 2017; G. Yao and U. Parampalli, “Cryptanalysis of the class of maximum period Galois NLFSR-based stream ciphers,” Cryptography and Communications, Springer, vol. 13, pp. 847-864, 2021; N. Yerukala, V. Kamakshi Prasad, and A. Apparao, “Performance and statistical analysis of stream ciphers in GSM communications,” J. of Communications Software and Systems, vol. 16, no. 1, pp. 11-18, March 2020.

[0004] While efficient on communication platforms, conventional solutions may be unacceptable in test applications due to hardware complexity. Furthermore, the System-on-Chip (SoC) integration process, characterized by widespread design reuse, can generate additional iterations, as pre-designed intellectual property (IP) soft cores typically require fine-tuning and incremental optimization until the register-transfer level synthesis process achieves an optimal trade-off between performance, area footprint, security, power consumption, and testability. Therefore, there is a desire to develop lightweight stream ciphers that are compact, fast, self-testable, easy to synthesize, and implementable in resource-constrained devices. Summary of the Invention

[0005] Various aspects of this disclosure relate to stream ciphers constructed based on nonlinear feedback shift registers and ring generators. In one aspect, a circuit is provided comprising: a first device including an m-bit nonlinear feedback shift register; a second device including an n-bit nonlinear feedback shift register; a third device including an h-bit ring generator; selection and combination devices, each of which is configured to output a bit in a keystream, said bit being derived from a combination of a first or more bits and a second or more bits, the first or more bits being generated based on a first set of bits output from the first device and a third set of bits output from the third device, the second or more bits being generated based on a second set of bits output from the second device and a fourth set of bits output from the third device; and an encryption device configured to combine the bit to be encrypted with bits in the keystream to generate an encrypted bit. h, m, and n can be pairwise distinct.

[0006] The first device may further include an expander whose input is coupled to the output of the m-bit nonlinear feedback shift register, the second device may further include an expander whose input is coupled to the output of the n-bit nonlinear feedback shift register, and the third device may further include an expander whose input is coupled to the output of the h-bit ring generator.

[0007] The h-bit ring generator can be an h-bit hybrid ring generator. The h-bit hybrid ring generator can include a mask register and can be reconfigured by loading a selection mask into the mask register.

[0008] Each of the m-bit nonlinear feedback shift register, the n-bit nonlinear feedback shift register, and the h-bit ring generator can be configured to receive an initial value for initialization.

[0009] The m-bit nonlinear feedback shift register and the n-bit nonlinear feedback shift register can be maximum-length nonlinear feedback shift registers, and the h-bit ring generator can be a maximum-length ring generator.

[0010] Each of the selection devices may include: an XOR gate configured to perform the combination; a first multiplexer configured to receive the first group of bits as input bits and the third group of bits as selection bits; and a second multiplexer configured to receive the second group of bits as input bits and the fourth group of bits as selection bits.

[0011] In another aspect, one or more non-transitory computer-readable media are provided, storing computer-executable instructions for causing one or more processors to perform a method comprising: creating the circuit described above in a circuit design.

[0012] Certain aspects of the invention are set forth in the appended independent and dependent claims. Features from dependent claims may be suitably combined with features of the independent claim and other dependent claims, not merely as expressly set forth in the claims.

[0013] The various objects and advantages of the invention have been described above. It should be understood, of course, that not all such objects or advantages can necessarily be achieved according to any particular embodiment of the disclosed technology. Therefore, for example, those skilled in the art will recognize that the disclosed technology can be implemented or performed in a manner that achieves or optimizes one or more advantages as taught herein, without necessarily achieving other objects or advantages as may be taught or suggested herein. Attached Figure Description

[0014] Figure 1 Examples of circuits for encryption that can be implemented according to various embodiments of the disclosed technology are shown.

[0015] Figure 2A Examples of selected combination devices that can be implemented according to various embodiments of the disclosed technology are shown.

[0016] Figure 2B Another example of a selection of combination devices is shown that can be implemented according to various embodiments of the disclosed technology.

[0017] Figure 3 Example cryptographic devices that can be implemented according to various embodiments of the disclosed technology are shown.

[0018] Figure 4A Example extenders that can be implemented according to various embodiments of the disclosed technology are shown.

[0019] Figure 4B Example extenders that can be implemented according to various embodiments of the disclosed technology are shown.

[0020] Figure 5Examples of h-bit mixing ring generators that can be implemented according to various embodiments of the disclosed technology are shown.

[0021] Figure 6A An example of a conventional 32-bit ring generator that implements primitive polynomials is shown.

[0022] Figure 6B An example 32-bit hybrid ring generator and its feedback function are shown.

[0023] Figure 7 An example programmable hybrid ring generator that can be implemented according to various embodiments of the disclosed technology is shown.

[0024] Figure 8A An example programmable hybrid ring generator is shown to illustrate the initialization process.

[0025] Figure 8B It shows the output from Figure 8A The single-step back of the selection mask register fed by logic 1 of the programmable hybrid ring generator shown.

[0026] Figure 8C It shows ( Figure 8A and Figure 8B The programmable hybrid ring generator (as shown) itself generates step back.

[0027] Figure 9 An example of a 26-bit maximum-length nonlinear feedback shift register that can be implemented according to various embodiments of the disclosed technology is shown.

[0028] Figure 10 An example of a 28-bit maximum-length nonlinear feedback shift register that can be implemented according to various embodiments of the disclosed technology is shown.

[0029] Figure 11 Examples of programmable computer systems that can employ various embodiments of the disclosed technology are shown. Detailed Implementation

[0030] Various aspects of this disclosure relate to stream ciphers constructed based on nonlinear feedback shift registers and ring generators. In the following description, numerous details are set forth for purposes of explanation. However, those skilled in the art will recognize that the disclosed techniques can be practiced without using these specific details. In other instances, well-known features have not been described in detail to avoid obscuring the disclosed techniques.

[0031] Some of the techniques described herein can be implemented in software instructions stored on a computer-readable medium, in software instructions executed on a computer, or in some combination of both. Some of the disclosed techniques can be implemented, for example, as part of an electronic design automation (EDA) tool. These methods can be executed on a single computer or on a networked computer.

[0032] Although the operations of the disclosed methods are described in a specific order for ease of presentation, it should be understood that this description includes rearrangement unless the specific language below requires a particular order. For example, operations described sequentially may be rearranged or executed concurrently in certain situations. Furthermore, for simplicity, the disclosed flowcharts and diagrams generally do not show the various ways in which a particular method can be used in conjunction with other methods.

[0033] Detailed descriptions of methods or devices sometimes use terms such as “configuration” and “generation” to describe the disclosed method or device function / structure. These terms are high-level descriptions. The actual operation or function / structure corresponding to these terms will vary depending on the specific implementation and will be readily discernible to those skilled in the art.

[0034] As used in this disclosure, the singular forms “a,” “an,” and “the” include the plural forms unless the context clearly specifies otherwise. Furthermore, the term “comprising” means “including.” Moreover, unless the context specifies otherwise, the term “coupled” means an electrical or electromagnetic connection or link, and includes both direct connections or links and indirect connections or links through one or more intermediate elements that do not affect the intended operation of the circuit.

[0035] Furthermore, as used herein, the term "design" is intended to encompass data describing the entire integrated circuit device. The term is also intended to encompass smaller datasets describing one or more components of the entire device (e.g., a portion of the integrated circuit device).

[0036] Figure 1Examples of encryption circuitry 100, which can be implemented according to various embodiments of the disclosed technology, are shown. Circuitry 100 includes a first device 110, a second device 120, a third device 130, a plurality of selectable combination devices 140, and an encryption device 150. The first device 100 includes an m-bit nonlinear feedback shift register 115. The second device 120 includes an n-bit nonlinear feedback shift register 125. The third device 130 includes an h-bit ring generator 135. The values ​​of h, m, and n can be different from each other. The m-bit nonlinear feedback shift register 115, the n-bit nonlinear feedback shift register 125, and the h-bit ring generator 135 can be initialized by uploading initial values ​​181, 182, and 183, respectively. The initial values ​​181, 182, and 183 can be encoded first and then decoded during the initialization of circuitry 100.

[0037] Using various embodiments of the disclosed technology, the m-bit nonlinear feedback shift register 115 and the n-bit nonlinear feedback shift register 125 can be implemented using a maximum-length nonlinear feedback shift register, and the h-bit ring generator 135 can be implemented using a maximum-length ring generator. Both the ring generator and the nonlinear feedback shift register are finite state machines. A finite state machine can exist in a finite number of states. A maximum-length finite state machine refers to a finite state machine with a maximum number of states. The periods of the m-bit maximum-length nonlinear feedback shift register, the n-bit maximum-length nonlinear feedback shift register, and the h-bit maximum-length ring generator are 2... m –1、2 n –1 and 2 h -1. An n-bit ring generator that implements an nth-degree primitive polynomial is a maximum-length ring generator. Sometimes, maximum-length nonlinear feedback shift registers and maximum-length ring generators are also referred to as primitive nonlinear feedback shift registers and primitive ring generators, respectively.

[0038] Each selection combination device 140 can be configured as a bit in the output keystream 190, the bit in the keystream 190 being derived from a combination of a first or more bits generated based on bits output from the first device and a second or more bits generated based on bits output from the second device. Specifically, a first set of bits output from the first device 110 and a third set of bits output from the third device 130 are used to generate the first or more bits; and a second set of bits output from the second device 120 and a fourth set of bits output from the third device 130 are used to generate the second or more bits.

[0039] Figure 2AExample selection combination device 200, which can be implemented according to various embodiments of the disclosed technology, is shown. Selection combination device 200 includes two multiplexers 210 and 220 and an XOR gate 240. Multiplexer 210 is configured to be based on a device including a ring generator (such as...) Figure 1 The third set of bits 233 output from the third device 130 in the device (such as the nonlinear feedback shift register) is from the device (such as the third device 130 in the device) Figure 1 The first device 110 in the first group of bits 215 outputs selects one bit. Similarly, the multiplexer 220 is configured to select a bit based on the output of a device including a ring generator (such as...). Figure 1 The fourth set of bits 234 output from the third device 130 in the device (such as the nonlinear feedback shift register) is from the device (such as the third device 130 in the device) Figure 1 The second device 120 in the selection combines two bits selected by the two multiplexers 210 and 220 into a keystream bit 245. In practice, the selection combining device 200 outputs a modulo-2 sum of two bits, each bit randomly selected from one of the two sets of bits 215 and 225 generated by two nonlinear feedback shift registers. Assuming both multiplexers 210 and 220 accept v data inputs, then... Figure 1 The scheme shown allows the two bit streams generated by the two nonlinear feedback shift registers to form a total of v 2 A single keystream is generated by dynamic pairing, with one pair (combination) per clock cycle. For example, if v=4, then... Figure 1 Each of the selected combination devices 140 allows for the simultaneous combination of two nonlinear flows in one of 16 different ways.

[0040] Figure 2B Another example of a selection combination device 250, which can be implemented according to various embodiments of the disclosed technology, is shown. The selection combination device 250 includes two sets of AND gates 260, 270 and a combination device 290. One set of AND gates 260 is configured to be based on a device including a ring generator (such as...) Figure 1 The third set of bits 283 output by the third device 130 in the middle, for devices including nonlinear feedback shift registers (such as Figure 1 The first set of bits 265 output from the first device 110 in the first part is filtered. Similarly, a set of AND gates 260 is configured to filter the bits from a device including a ring generator (such as...). Figure 1 The fourth set of bits 284 output from the third device 130 in the middle, for devices including nonlinear feedback shift registers (such as Figure 1 The second set of bits 275 output by the second device 120 in the middle is filtered. The combining device 290 is configured to combine the bits generated by the two sets of AND gates 260 and 270 respectively into key stream bits 295.

[0041] Return to reference Figure 1 The encryption device 150 is configured to combine the bit to be encrypted 160 with the bits of the key stream 190 to generate the encrypted bit 170. Figure 3 An example encryption device 300 that can be implemented according to various embodiments of the disclosed technology is shown. The encryption device 300 includes a plurality of XOR gates 310. Each of the plurality of XOR gates 310 is configured to combine a bit of a key stream 320 with a bit of a bit to be encrypted 330 to form a bit of an encrypted bit 340.

[0042] Return to reference Figure 1 Each of the first device 110, the second device 120, and the third device 130 may further include an expander. The expander can expand the output space of each of the m-bit nonlinear feedback shift register 115, the n-bit nonlinear feedback shift register 125, and the h-bit ring generator 135. In the case of the h-bit ring generator 135, the expander can also act as a phase shifter, reducing the structural and linear dependencies between the outputs of the h-bit ring generator 135.

[0043] Figure 4A An example expander 400, which can be implemented according to various embodiments of the disclosed technology, is shown. Expander 400 includes eight XOR gates 420. Each of the eight XOR gates 420 is configured to receive a signal from a unique combination of two, three, or four outputs of device 410 to generate one of the eight output signals of expander 400. Thus, expander 400 expands the four outputs of device 410 into eight outputs. Here, device 410 may be a nonlinear feedback shift register or a ring generator.

[0044] Figure 4B Another example expander 450, which can be implemented according to various embodiments of the disclosed technology, is shown. Expander 450 includes thirteen XOR gates 470. Each of the thirteen XOR gates 470 is configured to combine two of the fourteen outputs of device 460 to generate the output signal of expander 450. These thirteen outputs of XOR gates 470 and the original fourteen outputs of device 460 form twenty-seven outputs of expander 450, nearly doubling the number of outputs of device 460. Here, device 460 may be a nonlinear feedback shift register or a ring generator. It should be noted that although both example expanders 400 and 450 are based on XOR gates, other devices may also be used to construct expanders.

[0045] For a given ring generator, the logic synthesis of the expander may require finding a set of linear combinations of the generator outputs (called XOR taps) such that each resulting sequence obtained by adding these stages will be offset by at least a pre-specified number of bits relative to each of the others. This process may include randomly selecting a combination of XOR taps and then checking whether the sequence produced by the linear combination of the newly selected XOR taps overlaps with a sequence already generated on the existing outputs. This checking step can be based on simulating a dual ring generator. For a ring generator, its dual form reverses the direction of all feedback networks; that is, the XOR gate is placed on the output of the flip-flop that initially drives the feedback tap, and the feedback line starts at the previous position of the XOR gate. By graphically seeding the dual ring generator with a Hamming weight of 1 and running the circuit for q clock cycles, a ring generator state can be produced where the positions of the 1s identify which outputs of the original ring generator need to be added to produce a sequence shifted q bits relative to a reference, i.e., derived from the sequence of flip-flops that accommodate the 1s in the initial state of the dual ring generator. For details of this method, see G. Mrugalski, J. Rajski, and J. Tyszer, “Ringgenerators – new devices for embedded test applications,” IEEE Trans.Computer-Aided Design Integr. Circuits Syst., vol. 23, no. 9, pp. 1306-1320, Sep. 2004.

[0046] An extender used for a nonlinear feedback shift register, also known as a linear filter, linearly filters the output of the nonlinear feedback shift register. It can be constructed from XOR gates with fan-in of two or three to reduce its hardware footprint. Although a linear function taking at least two stages of a given n-bit primitive nonlinear feedback shift register as input produces a period of 2... n Sequences of -1 are known, but little is known about the distribution of overlapping k-tuples within a single period of such sequences. The number of distinct n-tuples in the same sequence also remains an open question. For example, in 26-bit nonlinear feedback shift registers (such as...) Figure 9 The three distinct output sequences observed in (the one shown and will be described in detail later) can produce a period of 2 from a 2-input XOR gate. 26 70 new sequences with a period of -1, and another 783 sequences with the same period obtained by means of a 3-input XOR gate. The sequence with the highest number of overlapping 26-tuples can be formed by the following linear filters: x2 + x9 (65,174,655 overlapping 26-tuples), x0 + x1 (56,623,103), x0 + x24 (51445759), x0 + x 21 (49082367), x0 + x 23 + x 24 (48529407) and x0 + x 20 + x 24 (48369663).

[0047] Return to reference Figure 1 The h-bit ring generator 135 can be a hybrid ring generator. The h-bit hybrid ring generator includes an h-bit circular shift register (also known as a ring counter) and multiple feedback taps that alternately move up and down. Figure 5 An example of an h-bit hybrid ring generator 500, implementable according to various embodiments of the disclosed technology, is shown. The h-bit hybrid ring generator 500 includes h state elements 510 and k feedback enable devices 520 for k feedback lines 530, 540. The h state elements 510 are coupled to each other in the schematic diagram to form an h-bit ring structure. The h-bit ring structure has a top row and a bottom row, wherein each row has at least one of the h state elements 510 and at least one of the k feedback enable devices 520. Each of the k feedback enable devices 520 is coupled to a state element in a different row via one of the k feedback lines 530, 540. The feedback lines 530, 540 not only have different orientations—feedback line 530 points upwards and feedback line 540 points downwards—but they are also alternately distributed. The h-bit hybrid ring generator 500 can be initialized with the initial values ​​described above. In some embodiments of the disclosed technology, the feedback function of the h-bit hybrid ring generator 500 can be reprogrammed by a secret selection mask, which will be discussed in detail later.

[0048] The h-bit hybrid ring generator 500 can be configured as a maximum-length finite state machine, similar to a Fibonacci or Galois linear feedback shift register. The hybrid ring generator can accelerate the circulation of data injected into the register and, in many cases, can use fewer feedback taps than the number of terms in the characteristic polynomial employed. Figure 6A An example conventional 32-bit ring generator 610 is shown to implement the primitive polynomial 620. For the ring generator, the corresponding tap x... k A given feedback loop is created by starting with the leftmost trigger and covering k adjacent triggers. For example, in Figure 6A In the middle, corresponding to the feedback tap x 4 The first feedback loop is created by encompassing four adjacent flip-flops 14-17; corresponding to feedback tap x 5The second feedback loop is created by encompassing five adjacent flip-flops 14-18; corresponding to feedback tap x 6 The third feedback loop is created by encompassing six adjacent flip-flops 13-18. In this diagram, each symbol 615 of the 32-bit ring generator 610 represents a pair of two-input XOR gates (feedback enable devices), while each of the other identical symbols represents a single two-input XOR gate (feedback enable device). The 32-bit ring generator 610 has a total of nineteen XOR gates (feedback enable devices), corresponding to the number of corresponding feedback function terms in the primitive polynomial 620, excluding terms 32 and 0.

[0049] Figure 6B An example 32-bit hybrid ring generator 630 and its feedback function 640 are shown. The 32-bit hybrid ring generator 630 has only five XOR gates 633 and 635 as feedback enable devices and can produce the same linear recursive bit sequence as a conventional 32-bit ring generator 610. The feedback function 640 is written by placing a negative sign before the terms representing the upward feedback lines. Compared to the conventional 32-bit ring generator 610, the number of feedback enable devices is reduced by 19 / 5 = 3.8. Three XOR gates 633 and two XOR gates 635 are alternately placed on the top and bottom rows of the 32-bit hybrid ring generator 630, respectively. In this way, the upward and downward feedback lines not only do not cross each other, but are also alternately placed relative to each other. Furthermore, all these upward / downward feedback lines are distributed approximately uniformly in the ring structure. The number of flip-flops between adjacent feedback lines or between adjacent feedback lines and adjacent ends of the 32-bit hybrid ring generator 630 is as follows: 2, 4, 3, 3, 2, 2 in the top row (from left to right); and 3, 3, 3, 3, 2, 2 in the bottom row (from left to right). Therefore, in either the top or bottom row, the number of flip-flops in two sets between any three adjacent feedback lines or between two adjacent feedback lines and the adjacent ends of the 32-bit hybrid ring generator 630 is equal or approximately two. This structure allows designers to minimize area and wiring complexity, optimize linewidth, and achieve a compact overall layout.

[0050] The maximum length hybrid ring generator can be found by processing the selected structure rather than the feedback polynomial. This allows for the selection of a preferred hybrid ring generator, distinguished by its size, feedback taps and their orientation, or other constraints. Given an h-bit hybrid ring generator, the optimal length can be found using the technique described in J. Rajski and J. Tyszer, “Primitive polynomials over GF(2) of degree up to 660 with uniformly distributed coefficients,” J. of Electronic Testing: Theory and Application, vol. 19, pp.645-657, 2003, in O(n 2 Its primitiveness can be verified within a short timeframe. If the test fails, another hybrid ring generator can be tried by relaxing some of the constraints (mainly the location of the feedback tap). Once the maximum-length hybrid ring generator is found, the Berlekamp-Massey algorithm can retrieve the corresponding polynomial as described in J. Rajski, M. Trawka, J. Tyszer, and B. Włodarczak, “Hybrid ring generators for in-system test applications,” in Proc. European Test Symp., 2023, pp. 1–6. It can be seen that the hybrid ring generator can be a planar, regular, and high-speed circuit with reduced internal fan-out, minimal delay on the critical path, and a small number of XOR gates. It allows designers to minimize area and routing complexity, optimize linewidth, and make the overall layout as compact as possible.

[0051] Hybrid ring generators can also be designed as reconfigurable (programmable) circuits with thousands of primitive feedback polynomials. Figure 7 An example programmable hybrid ring generator 700, which can be implemented according to various embodiments of the disclosed technology, is shown. The programmable hybrid ring generator 700 includes a 24-bit ring select mask register 710. The 24-bit ring select mask register 710 may be loaded with a select mask 720 that determines the current feedback polynomial when the unit is running. Specifically, bits stored in the flip-flop triplets of the 24-bit ring select mask register 710 determine the destination of the signal generated by the trunk. For example, the location to which the trunk of the feedback line 730 is connected is based on bits stored in three flip-flops 731, 732, and 733.

[0052] To initialize the programmable hybrid ring generator 700, the selection mask 710 and the initial value (both encoded) are shifted into their respective registers using XOR gate 740. When the selection mask register 710 receives data, the clock of the ring generator section of the programmable hybrid ring generator 700 is disabled, and vice versa. Next, the two sequences are mixed by running the two registers in parallel until the selection mask register 710 reaches a state representing the desired feedback function and the ring generator section stabilizes to a predefined initial state.

[0053] Although the 24-bit select mask register 710 can enable 2 24 -1 feedback configurations are possible, but only a portion of them may correspond to primitive polynomials. This can be achieved by systematically setting all 2... 24 -1 feedback network and run primitive tests to obtain the number of primitive polynomials that can be used in conjunction with the hybrid ring generator. Clearly, a programmable hybrid ring generator of a size common to many applications can provide the programming capability of millions of polynomials.

[0054] The input sequence used in the above process can be obtained by using O(h) backward logic simulation of two registers, starting from the final selection mask and the state of the hybrid ring generator. Figure 8A An example programmable hybrid ring generator 800 is shown to illustrate the initialization process. In addition to its circular shift register, the programmable hybrid ring generator 800 also includes a selection mask register 810. In the figure, Boolean variables a, …, g represent the contents of the flip-flops in the circular shift register, except for one flip-flop 820 set to 1. In principle, this technique reverses the direction of all connections in the programmable hybrid ring generator 800, except for the feedback tap, whose mask gradually appears in the selection mask register 810 as initialization proceeds. It allows backward execution of a given programmable hybrid ring generator even if a single flip-flop is not controlled by the selection mask register. Its predecessor can then feed the selection mask register and make it easy to recover the previous bit of the mask, thereby recovering the feedback function to backtrack the programmable hybrid ring generator one more step.

[0055] Figure 8B A single-step back is shown in the select mask register 810 fed by logic 1 from the programmable hybrid ring generator 800. Figure 8CThe step back generated by the programmable hybrid ring generator 800 itself is shown. Note that certain flip-flops in the selection mask register 810 control the two feedback taps in a mutually exclusive manner. This is to avoid a feedback network with two opposite settings that are not separated by any flip-flops in the ring generator section of the programmable hybrid ring generator 800; such a network would make a given hybrid ring generator irreversible because certain states could be reached from both predecessors.

[0056] Return to reference Figure 1 The m-bit nonlinear feedback shift register 115 and the n-bit nonlinear feedback shift register 125 can be of Galois type. The period of the k-bit primitive (maximum length) nonlinear feedback shift register is 2. k -1 (Including missing states requires adding circuitry driven by all k variables; typically, this approach does not justify the incremental enhancement). In principle, each flip-flop can be updated by its own individual feedback function. As in a hybrid ring generator, a k-bit nonlinear feedback shift register can include a k-bit circular shift register and multiple feedback taps driven by Boolean functions of up to five variables. At least one of these functions needs to be nonlinear. To make the nonlinear feedback shift register layout-friendly and capable of high-speed operation, the structure can be further optimized so that each feedback function is fed by a maximum of five consecutive flip-flops, and where possible, these input variables are positionally constrained to the "upper" portion of the register.

[0057] Figure 9 An example of a 26-bit maximum-length nonlinear feedback shift register 900, which can be implemented according to various embodiments of the disclosed technology, is shown. The three flip-flops (2, 5, and 8) of the 26-bit maximum-length nonlinear feedback shift register 900 are driven by three functions 910 shown in the figure via XOR gates. The symbol “~” used in the three functions 910 indicates logical inversion. Figure 9The corresponding algebraic normal form (ANF) for the feedback function 920 is also shown, which can be verified using the method proposed in E. Dubrova, “A transformation from the Fibonacci to the Galois NLFSRs,” IEEE Trans. on Inf. Theory, vol. 55, no. 11, pp. 5263-5271, Nov. 2009. To summarize the many details, the presented structure is first reduced to its equivalent Fibonacci form, whose feedback function can be easily retrieved, and then used to obtain the algebraic normal form using a well-known algorithm. A notation is adopted in which all variables are replaced with their indices, and all product terms containing more than a single variable are grouped in brackets. For example, the algebraic normal form of the 26-bit maximum-length nonlinear feedback shift register 900 can be written as 0, 7, (20, 21), (13, 14, 16), (19, 20, 21), (12, 13, 14, 16). It is worth noting that this particular nonlinear feedback shift register has a fully planar structure, making it suitable for efficient place-and-route steps, thus providing a placement-friendly and timing-optimized solution.

[0058] Figure 10 Examples of a 28-bit maximum-length nonlinear feedback shift register 1000, implementable according to various embodiments of the disclosed technology, are shown. The 28-bit maximum-length nonlinear feedback shift register 1000 has six fully nonlinear feedback taps. Its algebraic normal form is 0, 14, 23, 6, (10, 9), (11, 14), (23, 25), (23, 26), (6, 8), (10, 8, 9), (12, 15, 16), (18, 19, 20), (23, 25, 26), (16, 18, 19, 20). Compared to this nonlinear feedback shift register implemented using direct ANF that requires 10 AND gates and even more 2-input XOR gates, the 28-bit maximum-length nonlinear feedback shift register 1000 is area-optimized, using only 6 AND gates and 6 XOR gates, thus achieving a significant reduction in gate count and latency.

[0059] Maximum-length nonlinear feedback shift registers can be found using a hardware-based FPGA search engine. An FPGA-based search engine can include a large number of identical modules running in parallel. The main function of each module is to operate structurally similar to... Figure 9 and Figure 10The engine uses a Galois nonlinear feedback shift register and verifies its period. It requires control signals to select the feedback function, thus setting the nonlinear feedback shift register it will examine. The engine's control section comprises a large, free-running, linear feedback shift register-based control data generator. In response to a request received from a single module, it returns a pseudo-random sequence of signals that determines the nonlinear feedback function. This sequence includes several feedback taps, each a product of up to five input variables. Therefore, the control sequence includes the number of feedback taps and bits indicating both the number of continuous taps and the number of continuous variables for a given tap. Additional bits indicate whether (for each feedback tap) a given input variable should be inverted. Finally, there are bits encoding the XOR gate positions (the outputs of the enabled taps) and bits indicating which outputs should be inverted.

[0060] The original n-bit Galois nonlinear feedback shift register used in this disclosure can generate a period of 2. n -1 output sequence. There exists a sequence (and its shifted copy) that satisfies the first two assumptions of randomness: (1) within a period of the sequence, the counts of 0 and 1 differ by at most 1; (2) in each period, the proportion of runs indicated by such a sequence is greater than 1. –k The lengths of the runs are k = 1, 2, … For each of these lengths, the number of 0 runs and 1 runs are equal. Furthermore, each n-tuple appears exactly once in the sequence, but missing states depend on the feedback function. Consider again… Figure 9 The nonlinear feedback shift register 900 in the circuit. The sequence observed at the outputs of flip-flops 2, 1, 0, 25, 24, …, 9 contains all 2 26 -1 = 67,108,863 distinct (overlapping) 26-tuples. The other two sequences on triggers 6, 7, 8 and 3, 4, 5 also have 2... 26 The period is -1. However, they contain 41,641,431 and 37,963,775 distinct 26-tuples, respectively. In both cases, some 26-tuples appear more than once, while others are missing. In general, an n-bit Galois nonlinear feedback shift register with m feedback taps produces up to m distinct sequences (and their shifted copies) with a period of 2. n -1, where m is also the number of consecutive flip-flop groups separated by m XOR gates. The number of distinct n-tuples produced by each output can be used to sort them, thereby aiding in the process of selecting the sequence to feed the associated linear filters.

[0061] Various examples of the technology disclosed herein can be implemented by executing software instructions using a computing device (e.g., a programmable computer). Therefore, Figure 11An illustrative example of a computing device 1101 is shown. As illustrated in the figure, the computing device 1101 includes a computing unit 1103 having a processing unit 1105 and a system memory 1107. The processing unit 1105 can be any type of programmable electronic device for executing software instructions, but it will conventionally be a microprocessor. The system memory 1107 may include a read-only memory (ROM) 1109 and a random access memory (RAM) 1111. As those skilled in the art will understand, both the read-only memory (ROM) 1109 and the random access memory (RAM) 1111 can store software instructions for execution by the processing unit 1105.

[0062] Processing unit 1105 and system memory 1107 are directly or indirectly connected to one or more peripheral devices via bus 1113 or an alternative communication structure. For example, processing unit 1105 or system memory 1107 may be directly or indirectly connected to one or more additional storage devices, such as a hard disk drive 1115, a removable disk drive 1117, an optical disk drive 1119, or a flash memory card 1121. Processing unit 1105 and system memory 1107 may also be directly or indirectly connected to one or more input devices 1123 and one or more output devices 1125. Input devices 1123 may include, for example, a keyboard, pointing devices (such as a mouse, touchpad, stylus, trackball, or joystick), a scanner, a camera, and a microphone. Output devices 1125 may include, for example, a monitor display, a printer, and speakers. For various examples of computing device 1101, one or more of peripheral devices 1115-1125 may be internally housed within computing unit 1103. Alternatively, one or more of the peripheral devices 1115-1125 may be located outside the housing of the computing unit 1103 and connected to the bus 1113 via, for example, a Universal Serial Bus (USB) connection.

[0063] In some implementations, computing unit 1103 may be directly or indirectly connected to one or more network interfaces 1127 for communicating with other devices constituting the network. Network interface 1127 converts data and control signals from computing unit 1103 into network messages according to one or more communication protocols, such as Transmission Control Protocol (TCP) and Internet Protocol (IP). Furthermore, network interface 1127 may employ any suitable connection proxy (or combination of proxies) to connect to the network, including, for example, a wireless transceiver, modem, or Ethernet connection. Such network interfaces and protocols are well known in the art and will not be discussed in detail here.

[0064] It should be understood that computing device 1101 is shown by way of example only and is not intended to be limiting. Various embodiments of the present disclosure may be implemented using one or more computing devices, including... Figure 11 The components of the computing device 1101 shown include only Figure 11 A subset of the components shown, or an alternative combination of components, including Figure 11 Components not shown. For example, various embodiments of the present disclosure may be implemented using a multiprocessor computer, a network of multiple single-processor and / or multiprocessor computers, or some combination of both.

[0065] in conclusion

[0066] Having described and illustrated the principles of the disclosed technology, it will be apparent to those skilled in the art that modifications in arrangement and detail may be made to the disclosed embodiments without departing from these principles. Given the many possible embodiments to which the principles of the disclosed technology can be applied, it should be understood that the illustrated embodiments are merely preferred examples of the technology and should not be construed as limiting the scope of the disclosed technology. Rather, the scope of the disclosed technology is defined by the following claims and their equivalents. Therefore, we claim protection for all content falling within the scope and spirit of these claims as part of our disclosed technology.

Claims

1. A circuit comprising: The first device includes an m-bit nonlinear feedback shift register; The second device includes an n-bit nonlinear feedback shift register; The third device includes an h-position ring generator; Selecting a combination device, each of the selected combination devices is configured to be a bit in the output keystream, the bit in the keystream being derived from a combination of a first or more bits and a second or more bits, the first or more bits being generated based on a first set of bits output from the first device and a third set of bits output from the third device, and the second or more bits being generated based on a second set of bits output from the second device and a fourth set of bits output from the third device; and The encryption device is configured to combine bits to be encrypted with bits of the key stream to generate encrypted bits.

2. The circuit according to claim 1, wherein, The first device further includes an extender whose input is coupled to the output of the m-bit nonlinear feedback shift register; the second device further includes an extender whose input is coupled to the output of the n-bit nonlinear feedback shift register; and the third device further includes an extender whose input is coupled to the output of the h-bit ring generator.

3. The circuit according to claim 1, wherein, The h-position ring generator is an h-position hybrid ring generator.

4. The circuit according to claim 3, wherein, The h-bit mixing ring generator includes a mask register and can be reconfigured by loading a selection mask into the mask register.

5. The circuit according to claim 1, wherein, h, m, and n are all distinct.

6. The circuit according to claim 1, wherein, Each of the m-bit nonlinear feedback shift register, the n-bit nonlinear feedback shift register, and the h-bit ring generator is configured to receive an initial value for initialization.

7. The circuit according to claim 1, wherein, The m-bit nonlinear feedback shift register and the n-bit nonlinear feedback shift register are maximum-length nonlinear feedback shift registers, and the h-bit ring generator is a maximum-length ring generator.

8. The circuit according to claim 1, wherein, Each of the selection devices includes: an XOR gate configured to perform the combination; a first multiplexer configured to receive the first group of bits as input bits and the third group of bits as selection bits; and a second multiplexer configured to receive the second group of bits as input bits and the fourth group of bits as selection bits.

9. One or more computer-readable media storing computer-executable instructions, said computer-executable instructions for causing a computer to perform a method, said method comprising: In circuit design, a circuit is created, the circuit comprising: The first device includes an m-bit nonlinear feedback shift register; The second device includes an n-bit nonlinear feedback shift register; The third device includes an h-position ring generator; Selecting a combination device, each of the selected combination devices is configured to be a bit in the output keystream, the bit in the keystream being derived from a combination of a first or more bits and a second or more bits, the first or more bits being generated based on a first set of bits output from the first device and a third set of bits output from the third device, and the second or more bits being generated based on a second set of bits output from the second device and a fourth set of bits output from the third device; and The encryption device is configured to combine bits to be encrypted with bits of the key stream to generate encrypted bits.

10. One or more computer-readable media according to claim 9, wherein, The first device further includes an extender whose input is coupled to the output of the m-bit nonlinear feedback shift register; the second device further includes an extender whose input is coupled to the output of the n-bit nonlinear feedback shift register; and the third device further includes an extender whose input is coupled to the output of the h-bit ring generator.

11. One or more computer-readable media according to claim 9, wherein, The h-position ring generator is an h-position hybrid ring generator.

12. One or more computer-readable media according to claim 11, wherein, The h-bit hybrid ring generator includes a selection mask and can be reconfigured by loading the selection mask into the mask register.

13. One or more computer-readable media according to claim 9, wherein, h, m, and n are all distinct.

14. One or more computer-readable media according to claim 9, wherein, Each of the m-bit nonlinear feedback shift register, the n-bit nonlinear feedback shift register, and the h-bit ring generator is configured to receive an initial value for initialization. Each selection device includes: an XOR gate configured to perform the combination; a first multiplexer configured to receive the first group of bits as input bits and the third group of bits as selection bits; and a second multiplexer configured to receive the second group of bits as input bits and the fourth group of bits as selection bits.

15. One or more computer-readable media according to claim 9, wherein, The m-bit nonlinear feedback shift register and the n-bit nonlinear feedback shift register are maximum-length nonlinear feedback shift registers, and the h-bit ring generator is a maximum-length ring generator.

16. One or more computer-readable media according to claim 9, wherein, Each of the selection devices includes: an XOR gate configured to perform the combination; a first multiplexer configured to receive the first group of bits as input bits and the third group of bits as selection bits; and a second multiplexer configured to receive the second group of bits as input bits and the fourth group of bits as selection bits.

Images