A compression array module and an optimized implementation method thereof for a ZUC-256 stream cipher algorithm

Abstract

The application discloses a hardware design method and device for efficiently executing a ZUC-256 stream cipher algorithm, and aims to solve the problems of excessively high delay and excessively large register resource consumption caused by multi-input modulo (2 n -1) addition operation in the existing ZUC-256 stream cipher hardware. 31 The method can realize low-delay multi-input modulo (2 31 -1) addition operation without inserting a pipeline register by constructing a modulo (2 31 -1) adder based on a compression array. Based on the method, the hardware device realized by the application can effectively improve the encryption rate of the ZUC-256 algorithm while reducing the register resource consumption, is suitable for 5G communication and other scenes with strict requirements on encryption performance and area constraint, and has a significant throughput-area ratio advantage.

Description

Technical Field

[0001] This application relates to the field of cryptographic hardware acceleration, and in particular to a compressed array modulator and its optimized implementation method for the ZUC-256 stream cipher algorithm. Background Technology

[0002] With the rapid development of communication systems, users have placed higher demands on the real-time performance and security of data transmission. Encryption algorithms not only need to possess strong resistance to attacks but also need to achieve high throughput within a limited area. Especially in mobile communication scenarios, where data volume is large and transmission is frequent, end-to-end encryption and decryption need to be completed in a short time. Therefore, stream cipher algorithms are commonly used to meet the requirements of continuous encryption and fast response. Compared with block cipher algorithms, stream ciphers have advantages such as low latency, simple structure, and low logical overhead, making them more suitable for physical layer and link layer encryption in communication systems.

[0003] Against this backdrop, China's independently designed ZUC-128 stream cipher algorithm was adopted by the 3rd Generation Partnership Project (3GPP) in 2011 as the third data confidentiality and integrity protection algorithm in 4G mobile communication systems. ZUC-128 is widely used in data encryption and authentication processes in 4G networks, playing a crucial supporting role in information security. However, with the improvement of computing power and the gradual maturation of quantum computers, an enhanced version, ZUC-256, was introduced to improve the anti-attack capability of the ZUC-128 algorithm. The ZUC-256 algorithm significantly improves security strength by extending the length of the key and initialization vector to 256 bits and increasing the complexity of the initialization process. However, the complexity of ZUC-256 also brings higher implementation costs, including a longer critical path and more complex multi-input modulo (2^2) schemes. 31 -1) The addition operations and more control logic make it difficult to directly apply to area-constrained and power-sensitive edge computing devices. Therefore, improving the hardware implementation efficiency of the ZUC-256 algorithm is a key issue that urgently needs to be addressed for the widespread application of ZUC-256 in the field of communications.

[0004] Appendix Figure 1 The overall structure of the ZUC-256 algorithm is shown. Most existing designs implement the LFSR update operation in the ZUC-256 algorithm by constructing a pipeline, which handles the multi-input modulus (2^356) update operation. 31 -1) The addition operation is decomposed into multiple two-input modulo (2) operations. 31 -1) addition operation, and modulo (2) of adjacent inputs. 31 -1) Pipelines are constructed by inserting registers between addition operations. The modulus (2) of the two inputs...31 -1) Addition operations are often used as shown in the appendix. Figure 2 With appendix Figure 3 The serial mode (2) shown 31 -1) Structure and parallel module (2) 31 -1) Add structure. However, the above method has the following problems:

[0005] 1. The introduction of multiple 31-bit registers in the pipeline construction of LFSR resulted in additional resource consumption;

[0006] 2. Lack of overall optimization for multi-input modules (2) 31 -1) Addition operation, so that the optimization is focused on the modulus (2) of the two inputs. 31 -1) Addition operation;

[0007] 3. Although pipelined architecture reduces LFSR latency, it lacks a system-wide approach to balance overall pipeline latency, resulting in a significant reduction in the modulus (2) of the FSM. 32 Operations become the new critical path;

[0008] The ZUC-256 hardware device designed using the above method cannot achieve a high operating frequency, has poor throughput performance, and has high hardware overhead, making it only suitable for scenarios where latency and area are not critical. Summary of the Invention

[0009] Based on this, it is necessary to propose a novel hardware design method for the ZUC-256 stream cipher algorithm to address the aforementioned technical problems.

[0010] A compression array converter includes: three compression sections;

[0011] The first compression layer consists of two sets of CSAs, each containing n three-input single-bit CSAs. The first set of CSA processing units processes the multi-input modulo-2 in the LFSR. n The first three input bits of the -1 addition operation are subjected to single-bit three-input addition to generate the partial sum SUM1 and carry CARRY1 for each bit; the second group of CSA performs a multi-input modulo 2 operation on the LFSR. n The last three input bits of the -1 addition operation are subjected to single-bit three-input addition to generate the partial sum SUM2 and carry CARRY2 for each bit.

[0012] The second compression layer consists of a set of CSAs; each CSA contains n three-input single-bit CSAs, where the input of the i-th CSA from left to right is CARRY1, the output of the first compression layer. i-1 SUM1 i With SUM2 iThe CSA0 input signal is CARRY1. n-1 SUM10 and SUM20, output as the new part and SUM3 with carry CARRY3;

[0013] The third compression layer consists of a set of CSAs; each CSA contains n three-input single-bit CSAs, where the input of the i-th CSA from left to right is the CARRY3 output from the second compression layer. i-1 SUM3 i CARRY2 output from the first compression layer i-1 The input signal for CSA0 is CARRY3. n-1 CARRY2 n-1 And SUM30, finally output the new part and SUM4 with carry CARRY4;

[0014] Modulo (2) of part SUM4 and carry CARRY4 n -1) Addition operation.

[0015] In one embodiment, the portion and SUM4 are divided with the carry CARRY4 into low-order groups. Bit and High The bit has two parts, denoted as S. L S H C L and C H ;

[0016] two The bit full adder calculates S respectively L +C L +1 and S L +C L +0, the output results are {Carry L1 Sum L1} and {Carry L0 Sum L0};

[0017] two The bit full adder calculates S respectively H +C H +1 and S H +C H +0, the output results are {Carry H1 Sum H1} and {Carry H0 Sum H0};

[0018] Based on the selection criteria for the carry signal generation, for Sum L1 Sum L0 SumH1 and Sum H1 Select and splice to obtain the model (2) n -1) The output of the addition operation.

[0019] In one embodiment, the compression array modulator is a compression array modulator (2). 31 -1) Adder, the first compression part, the second compression part and the third compression part all output 31 bits of data.

[0020] An optimized implementation of the ZUC-256 stream cipher algorithm using a modulo-adder in a compressed array, in LFSR multi-input modulo-2 n The -1 addition operation uses the aforementioned compressed array modulo adder to obtain a multi-input modulo (2) operation. n -1) The result of addition.

[0021] In one embodiment, the compression array modulator is a compression array modulator (2). 31 -1) Adder.

[0022] In one embodiment, for the modulus 2 in the FSM 32 The addition operation is used to perform bit width division calculations to balance the delay difference between FSM and LFSR.

[0023] The above-mentioned compression array modulo-adder and its optimized implementation of the ZUC-256 stream cipher algorithm, and the proposed CAMA (Compression Array Modulo-Adder) directly implement multi-input modulo-(2) cipher. n -1) Addition operation, no need to convert multiple input modulo (2) n -1) The addition operation is decomposed into multiple two-input modulo operations (2) n -1) Addition operation, eliminating the need for each two-input modulo (2) operation. n -1) The overhead of adding and inserting registers. CAMA compared to two-input modulo-2 n -1) The adder only increases the delay of the compression part, which only adds the delay of the 3-stage single-bit CSA. This is much smaller than the modulus (2^3) of the two inputs. n -1) Adder delay. Attached Figure Description

[0024] Figure 1 This is a schematic diagram of the ZUC-256 algorithm;

[0025] Figure 2 It is the serial mode (2) used in existing technology 31 -1) Add structural diagram;

[0026] Figure 3 It is the parallel module (2) used in existing technology31 -1) Add structural diagram;

[0027] Figure 4 This is a hardware implementation diagram of the ZUC-256 algorithm implemented in one embodiment;

[0028] Figure 5 This is a schematic diagram of the structure of the CAMA used in one embodiment of the invention;

[0029] Figure 6 One embodiment of the invention uses the module (2) 31 -1) Add structural diagram;

[0030] Figure 7 This is a timing diagram of the hardware structure initialization phase implemented in one embodiment;

[0031] Figure 8 This is a timing diagram of the working stages of the hardware structure implemented in one embodiment. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0033] In one embodiment, such as Figure 5 As shown, a schematic diagram of a CAMA structure is provided, including: a three-layer compression section.

[0034] The first compression layer includes two sets of carry-holding adders. Each CSA processing unit contains n three-input single-bit CSAs. The first set of CSA processing units processes the multi-input modulo (2^n) bits in the LFSR. n -1) The first three input bits of the addition operation are processed by single-bit three-bit addition to generate the partial sum SUM1 and carry CARRY1 for each bit; the second group of CSA processing units processes the multi-input modulo (2) in the LFSR. n -1) The last three inputs of the addition operation perform a three-input addition operation on a single bit, generating a partial sum of each bit SUM2 and a carry CARRY2.

[0035] The second-layer compression section includes a set of CSA processing units; each CSA contains n three-input single-bit CSAs, and the input of the i-th CSA processing unit from left to right is the CARRY1 output from the first-layer compression section. i-1 SUM1 i With SUM2 i The CSA0 input signal is CARRY1. n-1SUM10 and SUM20, output as new parts and SUM3 with carry CARRY3.

[0036] The third compression layer includes a set of CSA processing units; each CSA contains n three-input single-bit CSAs, and the input of the i-th CSA processing unit from left to right is the CARRY3 output from the second compression layer. i-1 SUM3 i CARRY2 output from the first compression layer i-1 The input signal for CSA0 is CARRY3. n-1 CARRY2 n-1 And SUM30, finally output the new part and SUM4 with carry CARRY4.

[0037] Modulo (2) of part SUM4 and carry CARRY4 n -1) Addition operation.

[0038] Specifically, using a compressed array module (2 31 -1) Taking the adder as an example, the input compression part uses a single-bit carry-save adder (CSA) to convert the multi-input modulus (2) of the LFSR module in the ZUC-256 algorithm into a single-bit carry-save adder (CSA). 31 -1) The six 31-bit operands in the addition operation are compressed into two 31-bit operands. The overall compression process is as follows:

[0039] For ease of description, the appendix will be attached. Figure 1 In the LFSR, S0 is denoted as A,2 8 S0 is denoted as B,2 20 S4 is denoted as C,2 21 ·S 10 Noted as D,2 17 ·S 13 Noted as E,2 15 ·S 15 It is denoted as F.

[0040] The input for Level One (the first compression layer) is m = {m0, m1, ... m}. 29 ,m 30} and n={n0,n1,…n 29 ,n 30}. Where m i Represents {A i B i C i}, n j Represents {D j E j ,F j(i and j represent the current position of the data). Level one has two sets of CSA processing units, each containing 31 three-input single-bit CSAs. The first set of CSAs performs three-input addition on the corresponding bits of the three inputs A, B, and C, generating a partial sum SUM1 and a carry CARRY1 for each bit. Similarly, the second set of CSAs performs the same operation on D, E, and F, obtaining the corresponding partial sum SUM2 and a carry CARRY2. Level one compresses six 31-bit data (A, B, C, D, E, F) into four 31-bit data (SUM1, CARRY1, SUM2, CARRY2). Since Level one only performs single-bit addition and does not involve carry chain propagation, the delay of Level one is the delay of a single-level single-bit adder.

[0041] Level two (the second compression layer) receives the inputs from Level one, along with SUM1, SUM2, and the carry signal CARRY1. Level two also consists of a set of CSA processing units. For ease of description, [the following will be used]. Figure 5 In Level 2, CSAs are numbered from left to right as CSA0 to CSA0. 30 The CSA0 input signal is CARRY1. 30 SUM10 and SUM20. For other CSAs... i The inputs are CARRY1 i-1 SUM1 i With SUM2 i For example, CARRY10, SUM11, and SUM21 are used as inputs to CSA1. The outputs of Leveltwo are the new part and SUM3 with carry CARRY3, respectively. Level two compresses three 31-bit data (SUM1, SUM2, CARRY1) into two 31-bit data (SUM3, CARRY3). Similarly, since L2 only performs single-bit addition and does not involve carry chain propagation, the delay of Level two is the delay of a single-bit adder.

[0042] The inputs of Level 3 (the third compression layer) include the output of Level 2, SUM3, carry CARRY3, and carry CARRY2 from Level 1. The connection method for the carry signal is consistent with L2; specifically, except for CARRY3... 30 CARRY2 30 Besides SUM30 as the input for the first CSA, for other CSAs... i The inputs are CARRY3 i-1 CARRY2i-1 With SUM3 i For example, CARRY30, CARRY20, and SUM31 are used as inputs to CSA1. Levelthree ultimately outputs a new part and SUM4 with a carry CARRY4. Thus, the six 31-bit input data (A, B, C, D, E, F) of the LFSR are compressed into two 31-bit data (SUM4, CARRY4) for subsequent modulo (2^32) operations. 31 -1) The adder completes the final model (2) 31 -1) Addition operation. Similarly, since only single-bit addition is performed in L3 and carry chain propagation is not involved, the delay of Level 2 is the delay of a single-bit adder.

[0043] In one embodiment, the portion and SUM4 are divided with the carry CARRY4 into low-order groups. Bit and High The bit has two parts, denoted as S. L S H C L and C H ;

[0044] two The bit full adder calculates S respectively L +C L +1 and S L +C L +0, the output results are {Carry L1 Sum L1} and {Carry L0 Sum L0};

[0045] two The bit full adder calculates S respectively H +C H +1 and S H +C H +0, the output results are {Carry H1 Sum H1} and {Carry H0 Sum H0};

[0046] Based on the selection criteria for the carry signal generation, for Sum L1 Sum L0 Sum H1 and Sum H1 Select and splice to obtain the model (2) n -1) The output of the addition operation.

[0047] Specifically, using a compressed array module (231 -1) Taking the adder as an example, after the input data is compressed by the compression array, six data points are compressed into two data points. Modulo (2) 31 -1) Addition operation: Divides two data points into two parts, the lower 16 bits and the higher 15 bits, denoted as S. L S H C L and C H Two 16-bit full adders calculate S respectively. L +C L +1 and S L +C L +0, the output results are denoted as {Carry L1 Sum L1} and {Carry L0 Sum L0 Two 15-bit full adders calculate S respectively. H +C H +1 and S H +C H +0, the output results are denoted as {Carry H1 Sum H1} and {Carry H0 Sum H0 Finally, based on the selection criteria generated by the carry signal, Sum is... L1 Sum L0 Sum H1 and Sum H1 Select and splice to obtain the final model (2) 31 -1) The result of the addition operation. This is based on the bit width modulus (2). 31 -1) The delay of the adder is approximately equivalent to the delay of a 16-bit adder. The selection logic is shown in Table 1. This invention uses CAMA to convert the multi-stage modulo (2) in the LFSR. 31 -1) The addition operation latency is reduced to that of a 19-bit adder. However, other modulo addition operations still exist in the entire hardware system, therefore this invention applies the bit width partitioning strategy to modulo(2) addition operations. 32 Additives are used to balance the delays at each stage of the system pipeline. (Appendix) Figure 3 In the overall hardware system architecture shown, Mod(2 31 -1) Adder represents the modulus (2) 31 -1) Adder, where Adder represents the modulus (2) 32 Adder. Mod(2) 31 -1) Adder uses the two-input modulus (2) shown in Appendix 5. 31 -1) Adder. And modulus (2) 32 The adder also uses a bit-width partitioning strategy, and its hardware structure is shown in the attached figure. Figure 6 As shown.

[0048] Table 1 Modulus (2) 31 -1) Adder output selection logic

[0049]

[0050] In one embodiment, a method for optimizing the ZUC-256 stream cipher algorithm using a modulator in a compression array is provided, characterized in that the multi-input modulo (2) converter in the LFSR... n -1) The addition operation uses the compressed array modulus adder in the above embodiment to obtain a multi-input modulus (2) n -1) The result of addition.

[0051] ZUC-256 is a word-operation-based stream cipher algorithm. Its encryption and decryption process consists of two parts: an initialization phase and a working phase. The algorithm takes a 256-bit key and a 184-bit initialization vector as input and outputs a continuous 32-bit key stream. The overall structure is shown in the attached figure. Figure 1 As shown, the system consists of three parts: first, a 496-bit long LFSR module; second, a Bit Reorganization (BR) layer, which is mainly used to extract some stored content from the LFSR and concatenate it into four 32-bit words for use in the finite state automaton and output processing below; and finally, an FSM, which contains two 32-bit words R1 and R2 as memory units in the FSM.

[0052] First, let's define the following symbols:

[0053] ·Denote the modulo 2 of an integer 32 Addition is

[0054] · Let the modulus (2) of integers x and y be (2) 31 -1) The addition is (x+y)mod(2) 31 -1);

[0055] · Let the bitwise XOR operation be...

[0056] • Let the bit string concatenation operation be ||;

[0057] • Circular shift to the left is <<<, circular shift to the right is >>>;

[0058] • Logical left shift <<, logical right shift >>;

[0059] ·→ indicates an assignment operation.

[0060] (1) Linear feedback shift register

[0061] The LFSR consists of 16 31-bit register units S i The array consists of (i = 0…15), and all elements are defined in the finite field GF(2). 31 -1) Above. The initial state of the LFSR is loaded by concatenating the key, initialization vector, and fixed constants according to specific rules. Depending on the algorithm stage of ZUC-256 (initialization stage, working stage), the LFSR has different update mechanisms.

[0062] Initialization phase: Each time, a new state is generated based on the feedback value v calculated from the LFSR state and the FSM output W. The update process in the initialization phase is as follows:

[0063] 1.v=(2 15 ·S 15 +2 17 ·S 13 +2 21 ·S 10 +2 20 ·S4+(1+2 8 )·S0)mod(2 31 -1);

[0064] 2. ifv = 0, thentv = 2 31 -1;

[0065] 3.u = W >> 1;

[0066] 4.S 16 = (v+u)mod(2) 31 -1);

[0067] 5.ifS 16 =0thensetS 16 =2 31 -1;

[0068] 6.(S 16 ,S 15 ,…,S2,S1)→(S 15 ,S 14 ,…,S1,S0).

[0069] Working status: Each update requires no external input; the update value S is calculated based on the LFSR status. 16 :

[0070] 1.S 16 =(2 15 ·S 15 +2 17 ·S 13 +2 21 ·S 10 +2 20 ·S4+(1+28 )·S0)mod(2 31 -1);

[0071] 2.ifS 16 =0thensetS 16 =2 31 -1;

[0072] 3.(S 16 ,S 15 ,…,S2,S1)→(S 15 ,S 14 ,…,S1,S0);

[0073] (2) Bit Recombination Layer

[0074] The bit recombination layer extracts specific bits from designated registers in the linear feedback shift register and concatenates them to generate four 32-bit words (X0, X1, X2, X3) for use in finite state machine operations and key stream generation. The specific concatenation method is as follows:

[0075] 1. X0 = s 15H ||s 14L ;

[0076] 2.X1=s 11L ||s 9H ;

[0077] 3.X2=s 7L ||s 5H ;

[0078] 4.X3=s 2L ||s 0H ;

[0079] Where s iH For register unit s i The high 16 bits, and s jL For register unit s j The lower 16 bits.

[0080] (3) Finite state machine

[0081] The finite state machine contains two 32-bit registers, R1 and R2, used to perform nonlinear transformations on the outputs X0, X1, and X2 of the bit recombination module to generate intermediate variable W. The calculation process is as follows:

[0082]

[0083] 4. R1 = S(L1(W) 1L ||W 2H ));

[0084] 5. R² = S(L²(W)2L ||W 1H ));

[0085] W iL Representing the intermediate variable W i The lower 16 bits, W iH Representing the intermediate variable W i The high 16 bits of the matrix represent four S-boxes placed side-by-side, where S = (S0, S1, S0, S1) and L1 and L2 are two maximum-distance separable matrices. The definitions are as follows:

[0086]

[0087] The initialization phase process is as follows:

[0088] 1. Initialize the 16 register units of the LFSR (concatenate the key, initialization vector, and fixed constants and fill them into the 31 units of the LFSR), and at the same time initialize the registers in the FSM: R1 = R2 = 0;

[0089] 2. Execute BR and FSM to generate intermediate variable W; feed W back to the linear feedback shift register, which updates its state according to the rules of the initialization phase;

[0090] 3. Repeat step 2 for a total of 32 iterations;

[0091] 4. Execute BR and FSM again, and update LFSR according to the rules of the working phase. At this point, the initialization phase is complete.

[0092] part

[0093] After the initialization phase, the workflow for the working phase is as follows:

[0094] 1. Execute BR to extract the status information from LFSR;

[0095] 2. Execute FSM to obtain the intermediate variable W, and calculate... A 32-bit key stream word Z is obtained, where Z is the output of this round;

[0096] 3. Update the LFSR status according to the rules of the working phase to prepare for the next round of calculation;

[0097] 4. Repeat steps 1, 2, and 3 as needed.

[0098] The following is in conjunction with the appendix Figure 4 , attached Figure 5 , attached Figure 6 , attached Figure 7 and attached Figure 8 The structure of the present invention will be described in detail below. The hardware structure of the ZUC-256 algorithm implemented in this invention is shown in the attached figure. Figure 4As shown. The gray box in the figure represents the register: S REG This represents the 16 31-bit shift registers in the LFSR. Sum represents the CAMA output result register, which is only used during the initialization state of the ZUC-256 algorithm. R1 and R2 represent the memory cell registers in the FSM, W is the FSM output result register, and Z is the generated stream key result register, which is only used in operating mode.

[0099] The hardware structure of this invention is controlled by a state machine, which contains three states: Idle, Initialization, and Working. The functions of each state and their transition relationships are shown in Table 2.

[0100] Table 2 Internal State Transition Process

[0101]

[0102] In the hardware structure of this invention, all registers remain in a reset state in the IDLE state. Upon receiving a start signal, it enters the INIT state on the next rising edge of the clock, and simultaneously loads the initial value of LFSR into S on this rising edge. REG In the register, R1 and R2 are simultaneously set to zero.

[0103] The timing sequence of the hardware of this invention after entering the INIT state is as follows. Figure 7 As shown. Sum and W are calculated in the first clock cycle T0 when entering the INIT state, and updated on the rising edge of T1. The values ​​of R1 and R2 are calculated in T1, and S is calculated using Sum and W. 16 It generates a shift signal and updates R1, R2, and S on the rising edge of T1. REG This completes one initialization cycle. Subsequent initialization processes simply repeat this process.

[0104] The present invention requires two clock cycles for the initialization state update operation, which is to solve the problem of calculating S during the initialization phase. 16 We need the values ​​of Sum and W. If we want to calculate Sum, W, and S... 16 Combined into one clock cycle, this means that one clock cycle must complete two modulo (2) operations. 31 -1) The computational delay of the addition operation will increase the output delay of the entire system, so the calculation is divided into two cycles. After executing the above process 32 times, the system enters the WORK state.

[0105] The timing sequence after entering the WORK state is shown in the attached figure. Figure 8As shown. After entering the WORK state, the shift and mode signals remain set to 1. During the first clock cycle T0 after entering the WORK state, Sum, Z, R1, and R3 are calculated. At the rising edge of T1, Sum is used as S... 16 Updated to S REG And update R1, R3, and Z. Because S 16 The value of Z is independent of W, so one working phase can be completed in one clock cycle. The value of Z at time T1 is discarded and not used as output. The Z values ​​generated in subsequent clock cycles are used as the generated key stream.

[0106] The steps for hardware encryption implemented in the ZUC-256 proposed in this invention are as follows:

[0107] Step 1: The hardware system is in IDEL state, waiting to receive the KEY and IV. Upon receiving the KEY and IV, it enters INIT state in the next clock cycle and loads the KEY and IV into S. REG middle.

[0108] Step 2: After entering the INIT state, perform the initialization state as described previously, and initialize the 7-bit counter cnt1 to zero. In the INIT state, increment by one in each clock cycle. When cnt1 counts to 64, the INIT state ends, and the next clock cycle enters the WORK state. cnt1[0] also serves as the enable signal for loading data into each register. cnt1[0] equals 1 as the enable signal for receiving signals in registers R1 and R2. cnt1[0] equals 0 as the enable signal for receiving signals in registers Sum and W. At the same time, cnt1[0] also serves as the enable signal for S. REG The shift signal.

[0109] Step 3: After entering the WORK state, cnt1 stops incrementing and remains at 7'd65. cnt1[0] equals 1. Registers R1 and R2 receive new data every clock cycle. REG A shift operation is also performed every clock cycle; the Sum and W registers are no longer updated. Figure 4 The mode signal is set to 0 in IDEL and INIT states, and set to 1 when entering WORK state. When the mode signal is 1, the value previously entered into the Sum register is used as S. 16 Updated to S REG And the Z register is updated every clock cycle.

[0110] Step 4: After entering the working state, output a set of keys every clock cycle. When a stop signal is received, key generation is stopped; when a start signal is received, key generation resumes; when a reset signal is received, return to the IDLE state.

[0111] The operating frequency, throughput, area, and throughput-area ratio of the ZUC-256 algorithm implemented using currently known ZUC algorithm implementation techniques (Scheme A in Yang et al.'s 2021 article "Optimized Implementations for ZUC-256 on FPGA" published in Wireless Pers Commun; Scheme B in Liu Yuntao et al.'s 2023 article "Hardware Design of ZUC-256 Stream Cipher with High Throughput Pipeline Structure" published in the Journal of Electronics) and the hardware implementation of the ZUC-256 algorithm proposed in this invention are shown in Table 3 on the Spartan-6 and Virtex-5 platforms.

[0112] Table 3 Performance Comparison of ZUC-256 Stream Cipher Implementation Schemes

[0113]

[0114] As shown in Table 3, on the Spartan-6 platform, this invention achieves a main frequency of 128.21MHz, a throughput of 4103Mbps, and uses 354 slices, resulting in an 18.0% improvement in throughput-to-area ratio compared to existing structures. On the Virtex-5 platform, the system achieves a throughput of 5334Mbps, using only 435 slices, reducing resource consumption by 48.64% compared to similar solutions, and improving throughput-to-area ratio by 97.5%.

[0115] The above description provides examples of the preferred embodiments of the present invention. Parts not detailed herein are common knowledge to those skilled in the art. The scope of protection of the present invention is determined by the claims. Any equivalent modifications based on the technical teachings of the present invention are also within the scope of protection of the present invention.

Claims

1. A compression array converter, characterized in that, include: Three-layer compression section; The first compression layer consists of two sets of carry-holding adders. Each set of CSAs contains n three-input single-bit CSAs. The first set of CSAs modulo-2 in the LFSR is applied. n The first three input bits of the -1 addition operation are subjected to single-bit three-input addition to generate the partial sum SUM1 and carry CARRY1 for each bit; the second group of CSA performs a multi-input modulo 2 operation on the LFSR. n The last three inputs of the -1 addition operation are subjected to a single-bit three-input addition operation to generate the partial sum of each bit SUM2 and the carry CARRY2; The second compression layer consists of a set of CSAs; each CSA contains n three-input single-bit CSAs, where the input of the i-th CSA from left to right is CARRY1, the output of the first compression layer. i-1 SUM1 i With SUM2 i The CSA0 input signal is CARRY1. n-1 SUM10 and SUM20, output as the new part and SUM3 with carry CARRY3; The third compression layer consists of a set of CSAs; each CSA contains n three-input single-bit CSAs, where the input of the i-th CSA from left to right is the CARRY3 output from the second compression layer. i-1 SUM3 i CARRY2 output from the first compression layer i-1 The input signal for CSA0 is CARRY3. n-1 CARRY2 n-1 And SUM30, finally output the new part and SUM4 with carry CARRY4; Modulo 2 for part and SUM4 with carry CARRY4 n -1 addition operation.

2. The compression array converter according to claim 1, characterized in that, Modulo 2 for part and SUM4 with carry CARRY4 n -1 addition operations include: Partial and SUM4 are divided into low-level groups with carry CARRY4. Bit and High The bit has two parts, denoted as S. L S H C L and C H ; two The bit full adder calculates S respectively L +C L +1 and S L +C L +0, the output results are {Carry L1 Sum L1 } and {Carry L0 Sum L0 }; two The bit full adder calculates S respectively H +C H +1 and S H +C H +0, the output results are {Carry H1 Sum H1 } and {Carry H0 Sum H0 }; Based on the selection criteria for the carry signal generation, for Sum L1 Sum L0 Sum H1 and Sum H1 Select and splice to obtain the model (2) n -1) The output of the addition operation.

3. The compression array converter according to claim 1, characterized in that, The compression array modulator is a compression array modulator 2. n The -1 adder outputs 31 bits of data from the first, second, and third compression layers.

4. An optimized implementation method of the ZUC-256 stream cipher algorithm using a modulator of a compressed array, characterized in that, LFSR Multi-input Modulo-2 n The -1 addition operation employs the compressed array modulus adder as described in any one of claims 1 to 3, resulting in a multi-input modulo (2) operation. n -1) The result of addition.

5. The method according to claim 4, characterized in that, The compression array modulator is a compression array modulator 2. 31 -1 adder.

6. The method according to claim 4, characterized in that, For the modulo 2 in FSM 32 The addition operation is used to perform bit width division calculations to balance the delay difference between FSM and LFSR.

Images