Lightweight stream cipher for hardware root of trust

Abstract

A circuit comprises a first device comprising a nonlinear feedback shift register, a second device comprising a nonlinear feedback shift register, a third device comprising a ring generator, selection-combination devices, and an encryption device. Each of the selection-combination devices is configured to output one of bits of a keystream which is derived from a combination of first one or more bits and second one or more bits. The first one or more bits are generated based on a first group of bits outputted from the first device and a third group of bits outputted from the third device. The second one or more bits are generated based on a second group of bits outputted from the second device and a fourth group of bits outputted from the third device. The encryption device is configured to combine bits for encryption with bits of the keystream to generate encrypted bits.

Description

Lightweight Stream Cipher for Hardware Root of TrustFIELD OF THE DISCLOSED TECHNIQUES

[0001] The presently disclosed techniques relate to the field of hardware security and trust. Various implementations of the disclosed techniques may be particularly useful for encrypting and decrypting test data.BACKGROUND OF THE DISCLOSED TECHNIQUES

[0002] Stream ciphers play a host of roles in securing variety of digital ecosystems such as authentication, attestation, firmware updates, chip identity handling, and cryptographic keys and functions management. In the area of integrated circuit test, stream ciphers are typically integrated into silicon as customized security blocks. Their mission is to encrypt and decrypt streams of test data by combining them with the cipher-produced, cryptographically secure pseudorandom keystreams to yield encrypted or decrypted streams of test stimuli and test responses. Since the combination is typically accomplished through exclusive-or operations, binary additive ciphers make up a vast majority of stream ciphers that have been implemented.

[0003] Many stream cipher designs are based on nonlinearly filtered sequences produced by linear feedback shift registers. In some other designs, linear feedback shift registers can be replaced with nonlinear feedback shift registers. Comprehensive surveys of these conventional solutions can be found in the following review papers: S.A. Jassim and A.K. Farhan, “A survey on stream ciphers for constrained environments,” in Proc. Babylon Int. Conf, on Information Technology and Science, 2021, pp. 228-233; M.A. Philip and Vaithiyanathan, “A survey on lightweight ciphers for loT devices,” in Proc. Int. Conf, on Technological Advancements in Power and Energy, 2017; G. Yao and U. Parampalli, “Cryptanalysis of the class of maximum period Galois NLFSR-based streamciphers,” Cryptography and Communications, Springer, vol. 13, pp. 847-864, 2021; N. Yerukala, V. Kamakshi Prasad, and A. Apparao, “Performance and statistical analysis of stream ciphers in GSM communications,” J. of Communications Software and Systems, vol. 16, no. 1, pp. 11-18, March 2020.

[0004] Efficient as they are on communication platforms, the conventional solutions may not be acceptable in test applications due to hardware complexity. Furthermore, the System-on- Chip (SoC) integration flow, distinguished by the prevalence of design reuse, may generate extra iterations since pre-designed intellectual property (IP) soft cores often need to be fine-tuned and incrementally optimized until the register-transfer-level synthesis process reaches the best trade-off between performance, area footprint, security, power, and testability. Hence, it is desirable to develop lightweight stream cyphers that are compact, fast, self-testable, easily synthesizable, and implementable within resource-constrained devices.BRIEF SUMMARY OF THE DISCLOSED TECHNIQUES

[0005] Various aspects of the disclosed technology relate to stream ciphers constructed based on nonlinear feedback shift registers and ring generators. In one aspect, there is a circuit, comprising: a first device comprising an m -b it nonlinear feedback shift register; a second device comprising an w-bit nonlinear feedback shift register; a third device comprising an A-bit ring generator; selection-combination devices, each of the selection-combination devices being configured to output one of bits of a keystream, the one of bits of the keystream being derived from a combination of first one or more bits and second one or more bits, the first one or more bits being generated based on a first group of bits outputted from the first device and a third group of bits outputted from the third device, the second one or more bits being generated based on a second group of bits outputted from the second device and a fourth group of bits outputted from the third device; and anencryption device configured to combine bits for encryption with bits of the keystream to generate encrypted bits, h, m and n may be pairwise distinct.

[0006] The first device may further comprise an expander with inputs coupled to outputs of the m-bit nonlinear feedback shift register, the second device may further comprise an expander with inputs coupled to outputs of the n -bit nonlinear feedback shift register, and the third device may further comprise an expander with inputs coupled to outputs of the Zz-bit ring generator.

[0007] The A-bit ring generator may be an A-bit hybrid ring generator. The A-bit hybrid ring generator may comprise a mask register and is reconfigurable by a selection mask loaded into the mask register.

[0008] Each of the m-bit nonlinear feedback shift register, the w-bit nonlinear feedback shift register, and the A-bit ring generator may be configured to receive an initial value for initialization.

[0009] The m-bi t nonlinear feedback shift register and the w-bit nonlinear feedback shift register may be maximum-length nonlinear feedback shift registers, and the A-bit ring generator may be a maximum-length ring generator.

[0010] Each of the selection devices may comprise an XOR gate configured to perform the combination, a first multiplexer configured to receive the first group of bits as input bits and the third group of bits as selection bits, and a second multiplexer configured to receive the second group of bits as input bits and the fourth group of bits as selection bits.

[0011] In another aspect, there are one or more non-transitory computer-readable media storing computer-executable instructions for causing one or more processors to perform a method, the method comprising: creating the above circuit in a circuit design.

[0012] Certain inventive aspects are set out in the accompanying independent and dependent claims. Features from the dependent claims may be combined with features of the independent claims and with features of other dependent claims as appropriate and not merely as explicitly set out in the claims.

[0013] Certain objects and advantages of various inventive aspects have been described herein above. Of course, it is to be understood that not necessarily all such objects or advantages may be achieved in accordance with any particular embodiment of the disclosed techniques. Thus, for example, those skilled in the art will recognize that the disclosed techniques may be embodied or carried out in a manner that achieves or optimizes one advantage or group of advantages as taught herein without necessarily achieving other objects or advantages as may be taught or suggested herein.BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 illustrates an example of a circuit for encryption that may be implemented according to various embodiments of the disclosed technology.

[0015] Figure 2A illustrates an example selection-combination device that may be implemented according to various embodiments of the disclosed technology.

[0016] Figure 2B illustrates another example selection-combination device that may be implemented according to various embodiments of the disclosed technology.

[0017] Figure 3 illustrates an example encryption device that may be implemented according to various embodiments of the disclosed technology.

[0018] Figure 4A illustrates an example expander that may be implemented according to various embodiments of the disclosed technology.

[0019] Figure 4B illustrates an example expander that may be implemented according to various embodiments of the disclosed technology.

[0020] Figure 5 illustrates an example of an A-bit hybrid ring generator that may be implemented according to various embodiments of the disclosed technology.

[0021] Figure 6A illustrates an example conventional 32-bit ring generator that implements a primitive polynomial.

[0022] Figure 6B illustrates an example 32-bit hybrid ring generator and its feedback function.

[0023] Figure 7 illustrates an example programmable hybrid ring generator that may be implemented according to various embodiments of the disclosed technology.

[0024] Figure 8 A illustrates an example programmable hybrid ring generator which is used to show the initialization process.

[0025] Figure 8B illustrates a single step back of the selection mask register fed by a logic 1 from the programmable hybrid ring generator shown in Fig. 8 A.

[0026] Figure 8C illustrates the resultant step back of the programmable hybrid ring generator (shown in Figs. 8 A and 8B) itself.

[0027] Figure 9 illustrates an example of a 26-bit maximum-length nonlinear feedback shift register that may be implemented according to various embodiments of the disclosed technology.

[0028] Figure 10 illustrates an example of a 28-bit maximum-length nonlinear feedback shift register that may be implemented according to various embodiments of the disclosed technology.

[0029] Figure 11 illustrates an example of a programmable computer system with which various embodiments of the disclosed technology may be employed.DETAILED DESCRIPTION OF THE DISCLOSED TECHNIQUES

[0030] Various aspects of the disclosed technology relate to stream ciphers constructed based on nonlinear feedback shift registers and ring generators. In the following description, numerous details are set forth for the purpose of explanation. However, one of ordinary skill in the art will realize that the disclosed technology may be practiced without the use of these specific details. In other instances, well-known features have not been described in detail to avoid obscuring the disclosed technology.

[0031] Some of the techniques described herein can be implemented in software instructions stored on a computer-readable medium, software instructions executed on a computer, or some combination of both. Some of the disclosed techniques, for example, can be implemented as part of an electronic design automation (EDA) tool. Such methods can be executed on a single computer or on networked computers.

[0032] Although the operations of the disclosed methods are described in a particular sequential order for convenient presentation, it should be understood that this manner of description encompasses rearrangements, unless a particular ordering is required by specific language set forth below. For example, operations described sequentially may in some cases be rearranged or performed concurrently. Moreover, for the sake of simplicity, the disclosed flow charts and block diagrams typically do not show the various ways in which particular methods can be used in conjunction with other methods.

[0033] The detailed description of a method or a device sometimes uses terms like “configure” and “generate” to describe the disclosed method or the device function / structure. Such terms are high-level descriptions. The actual operations or functions / structures thatcorrespond to these terms will vary depending on the particular implementation and are readily discernible by one of ordinary skill in the art.

[0034] As used in this disclosure, the singular forms “a,” “an,” and “the” include the plural forms unless the context clearly dictates otherwise. Additionally, the term “includes” means “comprises.” Moreover, unless the context dictates otherwise, the term “coupled” means electrically or electromagnetically connected or linked and includes both direct connections or direct links and indirect connections or indirect links through one or more intermediate elements not affecting the intended operation of the circuit.

[0035] Additionally, as used herein, the term “design” is intended to encompass data describing an entire integrated circuit device. This term also is intended to encompass a smaller group of data describing one or more components of an entire device such as a portion of an integrated circuit device nevertheless.

[0036] Fig. 1 illustrates an example of a circuit 100 for encryption that may be implemented according to various embodiments of the disclosed technology. The circuit 100 comprises a first device 110, a second device 120, a third device 130, a plurality of selectioncombination devices 140, and an encryption device 150. The first device 100 comprises an m-bit nonlinear feedback shift register 115. The second device 120 comprises an w-bit nonlinear feedback shift register 125. The third device 130 comprises an A-bit ring generator 135. The values of h, m, and n may be pairwise different. The m-bit nonlinear feedback shift register 115, the w-bit nonlinear feedback shift register 125, and the A-bit ring generator 135 may be initialized by uploading initial values 181, 182 and 183, respectively. The initial values 181, 182 and 183 may be encoded first and then be decoded during a process for initializing the circuit 100.

[0037] With various implementations of the disclosed technology, the m-bit nonlinear feedback shift register 115 and the w-bit nonlinear feedback shift register 125 can be implementedusing maximum-length nonlinear feedback shift registers, and the A-bit ring generator 135 can be implemented using a maximum-length ring generator. Both ring generators and nonlinear feedback shift registers are finite state machines. A finite state machine can exist in a finite number of states. A maximum- length finite state machine refers to a finite state machine with a maximum number of states. The periods for an m-bit maximum- length nonlinear feedback shift register, an w-bit maximum-length nonlinear feedback shift register, and an A-bit maximum-length ring generator are 2"' - I, 2" - I , and 2h- 1 , respectively. An w-bit ring generator implementing a primitive polynomial of degree n is a maximum-length ring generator. Sometimes, maximum- length nonlinear feedback shift registers and maximum-length ring generators are also referred to as primitive nonlinear feedback shift registers and primitive ring generators, respectively.

[0038] Each of the selection-combination devices 140 can be configured to output one of bits of a keystream 190, the one of bits of the keystream 190 being derived from a combination of first one or more bits generated based on bits outputted from the first device and second one or more bits generated based on bits outputted from the second device. Specifically, a first group of bits outputted from the first device 110 and a third group of bits outputted from the third device 130 are employed to generate the first one or more bits; and a second group of bits outputted from the second device 120 and a fourth group of bits outputted from the third device 130 are employed to generate the second one or more bits.

[0039] Fig. 2A illustrates an example selection-combination device 200 that may be implemented according to various embodiments of the disclosed technology. The selection-combination device 200 comprises two multiplexers 210, 220 and an XOR gate 240. The multiplexer 210 is configured to select a bit from a first group of bits 215 outputted from a device comprising a nonlinear feedback shift register like the first device 110 in Fig. 1 based on a third group of bits 233 outputted from a device comprising a ring generator like the third device 130 in Fig. 1. Similarly, the multiplexer 220 is configured to select a bit from a second group of bits 225 outputted from a devicecomprising a nonlinear feedback shift register like the second device 120 in Fig. 1 based on a fourth group of bits 234 outputted from a device comprising a ring generator like the third device 130 in Fig. 1. The XOR gate 240 is configured to combine the two bits separately selected by the two multiplexers 210 and 220 into a keystream bit 245. In effect, the selection-combination device 200 outputs a sum modulo 2 of two bits, each of which is picked randomly from one of the two group of bits 215 and 225 produced by the two nonlinear feedback shift registers, respectively. Assuming that the two multiplexers 210 and 220 both accept v data inputs, the scheme shown in Fig. 1 enables in total v2dynamic pairs of the two bit streams generated by the two nonlinear feedback shift registers to produce a single keystream, one pair (combination) per clock cycle. For example, if v = 4, then each of the selection-combination devices 140 in Fig. 1 allows one to combine two nonlinear streams at a time in one of 16 different ways.

[0040] Fig. 2B illustrates another example selection-combination device 250 that may be implemented according to various embodiments of the disclosed technology. The selection-combination device 250 comprises two groups of AND gates 260, 270 and a combination device 290. The group of AND gates 260 is configured to filter bits of a first group of bits 265 outputted from a device comprising a nonlinear feedback shift register like the first device 110 in Fig. 1 based on a third group of bits 283 outputted from a device comprising a ring generator like the third device 130 in Fig. 1. Similarly, the group of AND gates 260 is configured to filter bits of a second group of bits 275 outputted from a device comprising a nonlinear feedback shift register like the second device 120 in Fig. 1 based on a fourth group of bits 284 outputted from a device comprising a ring generator like the third device 130 in Fig. 1. The combination device 290 is configured to combine the bits separately generated by the two groups of AND gates 260 and 270 into a keystream bit 295.

[0041] Referring back to Fig. 1, the encryption device 150 is configured to combine bits for encryption 160 with bits of the keystream 190 to generate encrypted bits 170. Fig. 3illustrates an example encryption device 300 that may be implemented according to various embodiments of the disclosed technology. The encryption device 300 comprises a plurality of XOR gates 310. Each of the plurality of XOR gates 310 is configured to combine one of bits of a keystream 320 with one of bits for encryption 330 into one of encrypted bits 340.

[0042] Referring back to Fig. 1, each of the first device 110, the second device 120, and the third device 130 may further comprise an expander. The expander can expand the output space for each of the m -bi t nonlinear feedback shift register 115, the w-bit nonlinear feedback shift register 125, and the A-bit ring generator 135. In the case of the A-bit ring generator 135, the expander can also serve as a phase shifter, reducing the structural and linear dependencies between the outputs of the A-bit ring generator 135.

[0043] Fig. 4A illustrates an example expander 400 that may be implemented according to various embodiments of the disclosed technology. The expander 400 comprises eight XOR gates 420. Each of the eight XOR gates 420 is configured to receive signals from a unique combination of two, three or four outputs of a device 410 to generate one of eight output signals of the expander 400. As such, the expander 400 expands the four outputs of the device 410 into eight outputs. Here, the device 410 can be a nonlinear feedback shift register or a ring generator.

[0044] Fig. 4B illustrates another example expander 450 that may be implemented according to various embodiments of the disclosed technology. The expander 450 comprises thirteen XOR gates 470. Each of the thirteen XOR gates 470 is configured to combine two of fourteen outputs of a device 460 to generate an output signal for the expander 450. These thirteen outputs of the XOR gates 470 and the original fourteen outputs of the device 460 form twenty-seven outputs of the expander 450, almost doubling the number of the outputs of the device 460. Here, the device 460 can be a nonlinear feedback shift register or a ring generator. It should be noted that while the two example expanders 400 and 450are both based on XOR gates, other devices can also be employed to construct an expander.

[0045] Given a ring generator, logic synthesis of expanders can entail finding a set of linear combinations of the generator outputs (called XOR taps) such that each of the resulting sequences, obtained by adding these stages, will be shifted with respect to every other sequence by at least a prespecified number of bits. The process may comprise selecting XOR tap combinations randomly and then checking if a sequence produced by a linear combination of newly selected XOR taps does not overlap with sequences generated on already existing outputs. The checking step can be based on simulating dual ring generators. For a ring generator, its dual form has the direction of all feedback nets reversed, i.e., XOR gates are placed on the outputs of flip-flops that originally drove feedback taps, while feedback lines originate at the former locations of the XOR gates. Seeding a dual ring generator with a pattern whose Hamming weight is 1 and running this circuit for q clock cycles can result in a ring generator state where locations of Is identify the outputs of the original ring generator that need to be added to produce a sequence spaced q shifts up a reference, i.e., a sequence originating from a flip-flop that hosted the 1 in the initial state of the dual ring generator. Details of this approach can be found in G. Mrugalski, J. Raj ski, and J. Tyszer, “Ring generators - new devices for embedded test applications,” IEEE Trans. Computer-Aided Design Integr. Circuits Syst. , vol. 23, no. 9, pp. 1306-1320, Sep. 2004.

[0046] The expander for a nonlinear feedback shift register is also be referred to as a linear filter, filtering linearly outputs of the nonlinear feedback shift register. It can be made of XOR gates whose fan-in is either two or three to reduce its hardware footprint. Although linear functions that take as inputs at least two stages of a given w-bit primitive nonlinear feedback shift register yield a sequence with a period of 2” - 1, little is known about the distribution of overlapping A tuples across a single period of such a sequence. The number of different ^-tuples in the same sequence remains an open problem, too. Forexample, three different output sequences observed in a 26-bit nonlinear feedback shift register (like the one shown in Fig. 9 which will be described in detail later) can give rise to 70 new sequences with the period of 226- 1 produced by 2-input XOR gates, and additional 783 sequences of the same period obtained by virtue of 3-input XOR gates. Sequences with the highest counts of overlapping 26-tuples can be formed by the following linear filters: X2 + xg (65 174 655 overlapping 26-tuples), xo + Xi (56 623 103), xo + X24 (51 445 759), xo + X21 (49 082367), xo + X23 + X24 (48 529407), and xo + X20 + X24 (48 369 663).

[0047] Referring back to Fig. 1, the A-bit ring generator 135 can be a hybrid ring generator. An A-bit hybrid ring generator comprises an A-bit circular shift register (aka. a ring counter) and a number of feedback taps running up and down alternatively. Fig. 5 illustrates an example of an A-bit hybrid ring generator 500 that may be implemented according to various embodiments of the disclosed technology. The A-bit hybrid ring generator 500 comprises h state elements 510, & feedback-enable devices 520 for & feedback lines 530, 540. The h state elements 510 are coupled to each other to form an A-bit ringlike structure in a schematic diagram. The A-bit ringlike structure has a top row and a bottom row, of which each has at least one of the h state elements 510 and at least one of the k feedbackenable devices 520. Each of the k feedback-enable devices 520 is coupled to a state element on a different row through one of the k feedback lines 530, 540. Not only do the feedback lines 530, 540 have different directions: the feedback lines 530 pointing upwards and the feedback lines 540 pointing downwards, but they are also distributed alternatively. The A-bit hybrid ring generator 500 may be initialized by an initial value as mentioned previously. In some embodiments of the disclosed technology, the feedback function of the A-bit hybrid ring generator 500 can be reprogrammed by a secret selection mask, which will be discussed in detail later.

[0048] The A-bit hybrid ring generator 500 can be configured to become a maximum-length finite state machine, likewise Fibonacci or Galois linear feedback shift registers. A hybridring generator can accelerate circulation of data injected into the register and can employ, in many cases, fewer feedback taps than the number of terms of the deployed characteristic polynomial. Fig. 6A illustrates an example conventional 32-bit ring generator 610 that implements a primitive polynomial 620. For a ring generator, a given feedback loop, corresponding to tap x is created by encompassing k adjacent flip-flops, beginning with the leftmost ones. For example, in Fig. 6A, the first feedback loop, corresponding to the feedback tap x4, is created by encompassing four adjacent flip-flops 14-17; the second feedback loop, corresponding to the feedback tap x5, is created by encompassing five adjacent flip-flops 14-18; and the third feedback loop, corresponding to the feedback tap x6, is created by encompassing six adjacent flip-flops 13-18. In the figure, each of the symbols 615 for the 32-bit ring generator 610 represents a pair of two- input XOR gates (feedback-enable devices) while each of the other same symbols represents a single two-input XOR gates (feedback-enable devices). In total, the 32-bit ring generator 610 has nineteen XOR gates (feedback-enable devices), corresponding to the number of the corresponding feedback function terms in primitive polynomial 620 except terms 32 and 0.

[0049] Fig. 6B illustrates an example 32-bit hybrid ring generator 630 and its feedback function 640. The 32-bit hybrid ring generator 630 has only five XOR gates 633, 635 as feedbackenable devices and can generate the linearly recurrent bit sequence as the conventional 32-bit ring generator 610. The feedback function 640 is written in a way by placing a minus sign in front of terms representing feedback lines going up. Compared with the conventional 32-bit ring generator 610, the reduction of feedback-enable device count is 19 / 5 = 3.8. The three XOR gates 633 and the two XOR gates 635 are placed alternatively on the top row and the bottom row of the 32-bit hybrid ring generator 630, respectively. As such, the upward feedback lines and the downward feedback lines not only do not cross each other but also are placed alternatively with respective to each other. Moreover, all of these upward / downward feedback lines are distributed in the ringlike structureapproximately uniformly. The numbers of flip-flops between neighboring feedback lines or between a neighboring feedback line and a neighboring end of the 32-bit hybrid ring generator 630 are: 2, 4, 3, 3, 2, 2 for the top row (from left to right) and 3, 3, 3, 3, 2, 2 for the bottom row (from left to right). Thus, numbers of two groups of flip flops on the top row or on the bottom row between any three neighboring feedback lines or between two neighboring feedback lines and their neighboring end of the 32-bit hybrid ring generator 630 are equal or differ by no more than two. Such a structure allows designers to minimize area and routing complexity, optimize wire sizing, and make the overall layout compact.

[0050] A maximum-length hybrid ring generator can be found by working with a chosen structure rather than a feedback polynomial. It allows one to pick a preferable hybrid ring generator distinguished by its size, feedback taps and their orientation, or other constraints. Given an A-bit hybrid ring generator, its primitiveness can be verified in O(n2) time by using a technique described in J. Raj ski and J. Tyszer, “Primitive polynomials over GF(2) of degree up to 660 with uniformly distributed coefficients,” J. of Electronic Testing: Theory and Application, vol. 19, pp. 645-657, 2003. If the test fails, another hybrid ring generator can be tried by relaxing some of the constraints, primarily locations of feedback taps. Having found a maximum-length hybrid ring generator, the Berlekamp-Massey algorithm may retrieve the corresponding polynomial as described in J. Rajski, M. Trawka, J. Tyszer, and B. Wlodarczak, “Hybrid ring generators for in-system test applications,” in Proc. European Test Symp., 2023, pp. 1-6. As can be seen, hybrid ring generators can be a planar, regular, and high-speed circuit that features reduced internal fan-outs, minimal delays on critical paths, and small XOR gate counts. It lets designers minimize area and routing complexity, optimize wire sizing, and make the overall layout as compact as possible.

[0051] Hybrid ring generators can also be designed to work as reconfigurable (programmable) circuits with thousands of primitive feedback polynomials. Fig. 7 illustrates an exampleprogrammable hybrid ring generator 700 that may be implemented according to various embodiments of the disclosed technology. The programmable hybrid ring generator 700 comprises a 24-bit ring-like selection mask register 710. The 24-bit ring-like selection mask register 710 can be loaded with a selection mask 720 that determines the current feedback polynomial when this unit is in operation. Specifically, bits stored in triplets of flip-flops of the 24-bit ring-like selection mask register 710 determine destinations for signals produced by stems. For example, the location to which the stem of a feedback line 730 is connected to is based upon bits stored in three flip-flops 731, 732 and 733.

[0052] To initialize the programmable hybrid ring generator 700, the selection mask 710 and an initial value, both encoded, can separately be shifted into the corresponding registers using an XOR gate 740. When the selection mask register 710 is receiving data, clocking of ring generator part of the programmable hybrid ring generator 700 is disabled and vice versa. Next, the two sequences are blended with each other by running both registers in parallel until the selection mask register 710 reaches a state representing a desired feedback function and the ring generator part settles down to a predefined initial state.

[0053] Although the 24-bit selection mask register 710 may enable any of I24- 1 feedback configurations, only a fraction of them may correspond to primitive polynomials. The number of primitive polynomials that can be used in conjunction with hybrid ring generators can be obtained by systematically setting all I24- 1 feedback nets and running the primitiveness test. Clearly, programmable hybrid ring generators of sizes common to many applications can offer a multimillion-polynomial programming capability.

[0054] The input sequence used by the above process can be obtained by virtue of O(Zz) backward logic simulation of both registers, beginning with a final selection mask and a hybrid ring generator state. Fig. 8A illustrates an example programmable hybrid ring generator 800 which is used to show the initialization process. In addition to its circular shift register, the programmable hybrid ring generator 800 comprises a selection mask register 810. Inthe figure, Boolean variables a, g represent the content of flip-flops in the circular shift register except for one flip-flop 820 being set to 1. In principle, this technique reverses direction of all connections of the programmable hybrid ring generator 800 but feedback taps whose masks show up gradually in the selection mask register 810 as initialization progresses. It allows one to run a given programmable hybrid ring generator backwards provided there is a single flip-flop of the programmable hybrid ring generator that is not controlled by the selection mask register. Then its predecessor can feed the selection mask register and make it possible to easily recover a previous bit of the mask, and thus a feedback function, to carry the programmable hybrid ring generator another step backwards.

[0055] Fig. 8B shows a single step back of the selection mask register 810 fed by a logic 1 from the programmable hybrid ring generator 800. Fig. 8C shows the resultant step back of the programmable hybrid ring generator 800 itself. Note that certain flip-flops of the selection mask register 810 control two feedback taps in a mutually exclusive manner. This is to avoid having two oppositely disposed feedback nets, not separated by any flipflops of the hybrid ring generator part of the programmable hybrid ring generator 800; such nets make a given hybrid ring generator irreversible as certain states would be reachable from two predecessors.

[0056] Referring back to Fig. 1, the m-bit nonlinear feedback shift register 115 and the w-bit nonlinear feedback shift register 125 can be of Galois type. A A-bit primitive (maximumlength) nonlinear feedback shift register has a period of 2k- 1 (inclusion of a missing state requires adding a circuit driven by all k variables; usually such a solution does not justify this incremental enhancement). In principle, every flip-flops can be updated by its own individual feedback function. As in a hybrid ring generator, a A-bit nonlinear feedback shift register may comprise a A-bit circular shift register and a number of feedback taps driven by Boolean functions of up to five variables. At least one of these functions needs to be nonlinear. To make a nonlinear feedback shift register layout-friendly and capable of operating at high speed, the structure can be further optimized in such a way that each feedback function is fed by five consecutive flip-flops at the most, and these input variables are location-constrained to the “upper” section of the register, if possible.

[0057] Fig. 9 illustrates an example of a 26-bit maximum-length nonlinear feedback shift register 900 that may be implemented according to various embodiments of the disclosed technology. Three flip-flops (2, 5, and 8) of the 26-bit maximum-length nonlinear feedback shift register 900 are driven, through XOR gates, by three functions 910 shown in the figure. The symbolused in the three functions 910 denotes a logic inversion. Fig. 9 also shows the corresponding algebraic normal form (ANF) of the feedback function 920, which can be verified by using a method presented in E. Dubrova, “A transformation from the Fibonacci to the Galois NLFSRs,” IEEE Trans, on Inf. Theory, vol. 55, no. 11, pp. 5263-5271, Nov. 2009. Boiling the many details down, the presented structure is first brought back to its equivalent Fibonacci format whose feedback function can be easily retrieved, and then is used to obtain the algebraic normal form by means of well-known algorithms. A notation is adopted where all variables are replaced with their indexes, and all product terms comprising more than a single variable are grouped by parentheses. For instance, the algebraic normal form of the 26-bit maximum-length nonlinear feedback shift register 900 can be written down as 0, 7, (20, 21), (13, 14, 16), (19, 20, 21), (12, 13, 14, 16). It is worth noting that this particular nonlinear feedback shift register has a fully planar structure, and thus it is amenable to efficient place-and- route steps that provide layout-friendly and timing-optimized solutions.

[0058] Fig. 10 illustrates an example of a 28-bit maximum-length nonlinear feedback shift register 1000 that may be implemented according to various embodiments of the disclosed technology. The 28-bit maximum-length nonlinear feedback shift register 1000 has six all-nonlinear feedback taps. Its algebraic normal form is given by 0, 14, 23, 6, (10, 9), (11, 14), (23, 25), (23, 26), (6, 8), (10, 8, 9), (12, 15, 16), (18, 19, 20), (23, 25,26), (16, 18, 19, 20). In contrast to a direct ANF-based implementation of this nonlinear feedback shift register that would need 10 AND gates and even more 2-input XOR gates, the 28-bit maximum- length nonlinear feedback shift register 1000 is area optimized and employs just six AND gates and six XOR gates, thus achieving a visible reduction of both the gate count and the latency.

[0059] A maximum-length nonlinear feedback shift register can be found by a hardware FPGA- based search engine. The FPGA-based search engine can comprise a large number of identical modules operating in parallel. The chief function of every module is to run a Galois nonlinear feedback shift register, structurally similar to those of Figs. 9 and 10, and to verify its period. It requires control signals to select a feedback function, and thus to setup a nonlinear feedback shift register which it is going to examine. The control part of the engine consists of a large, free-running, linear feedback shift register-based control data generator. In response to a request received from an individual module, it returns a pseudorandom sequence of signals that determine a nonlinear feedback function. It consists of several feedback taps, each being a product of up to five input variables. Consequently, a control sequence includes the number of feedback taps as well as bits that enable both successive taps and successive variables of a given tap. Additional bits indicate, per a feedback tap, whether a given input variable is to be inverted. Finally, there are bits encoding locations of the XOR gates - the outputs of the enabled taps, and signaling which outputs are to be inverted.

[0060] Primitive w-bit Galois nonlinear feedback shift registers employed by the disclosed technology can generate output sequences with the period of 2” - 1. Among them there is a sequence (and its shifted replicas) that satisfies the first two postulates of randomness: (1) in a period of the sequence, the 0 and 1 counts differ by at most 1, (2) in every period, 2kof runs have length k = 1, 2 ... , as long as the number of runs so indicated is greater than 1. For each of these lengths, there are as many 0-runs as 1-runs. Also, each / ?-tuple occurs in the sequences exactly once but a missing state which is a feedback functiondependent. Consider again the nonlinear feedback shift register 900 in Fig. 9. Sequences observed on the outputs of flip-flops 2, 1, 0, 25, 24 , ... , 9 contain all 226- 1 = 67 108 863 different (overlapping) 26-tuples. Two other sequences on flip-flops 6, 7, 8, and 3, 4, 5 have the period of 226- 1, as well. They comprise, however, 41 641 431 and 37963 775 different 26-tuples, respectively. In these two cases, certain 26-tuples occur more than once, whereas others are missing. In general, an w-bit Galois nonlinear feedback shift registers with m feedback taps yields as many as m different sequences (and their shifted replicas) having the period of 2” - 1, where m is also the number of groups of consecutive flip-flops separated by m XOR gates. The number of different / ?-tuples produced by each output can be used to rank them and thus to help the process of selecting sequences that will feed an associated linear filter.

[0061] Various examples of the disclosed technology may be implemented through the execution of software instructions by a computing device, such as a programmable computer. Accordingly, Fig. 11 shows an illustrative example of a computing device 1101. As seen in this figure, the computing device 1101 includes a computing unit 1103 with a processing unit 1105 and a system memory 1107. The processing unit 1105 may be any type of programmable electronic device for executing software instructions, but it will conventionally be a microprocessor. The system memory 1107 may include both a read-only memory (ROM) 1109 and a random access memory (RAM) 1111. As will be appreciated by those of ordinary skill in the art, both the read-only memory (ROM) 1109 and the random access memory (RAM) 1111 may store software instructions for execution by the processing unit 1105.

[0062] The processing unit 1105 and the system memory 1107 are connected, either directly or indirectly, through a bus 1113 or alternate communication structure, to one or more peripheral devices. For example, the processing unit 1105 or the system memory 1107 may be directly or indirectly connected to one or more additional memory storage devices, such as a “hard” magnetic disk drive 1115, a removable magnetic disk drive1117, an optical disk drive 1119, or a flash memory card 1121. The processing unit 1105 and the system memory 1107 also may be directly or indirectly connected to one or more input devices 1123 and one or more output devices 1125. The input devices 1123 may include, for example, a keyboard, a pointing device (such as a mouse, touchpad, stylus, trackball, or joystick), a scanner, a camera, and a microphone. The output devices 1125 may include, for example, a monitor display, a printer and speakers. With various examples of the computing device 1101, one or more of the peripheral devices 1115- 1125 may be internally housed with the computing unit 1103. Alternately, one or more of the peripheral devices 1115-1125 may be external to the housing for the computing unit 1103 and connected to the bus 1113 through, for example, a Universal Serial Bus (USB) connection.

[0063] With some implementations, the computing unit 1103 may be directly or indirectly connected to one or more network interfaces 1127 for communicating with other devices making up a network. The network interface 1127 translates data and control signals from the computing unit 1103 into network messages according to one or more communication protocols, such as the transmission control protocol (TCP) and the Internet protocol (IP). Also, the network interface 1127 may employ any suitable connection agent (or combination of agents) for connecting to a network, including, for example, a wireless transceiver, a modem, or an Ethernet connection. Such network interfaces and protocols are well known in the art, and thus will not be discussed here in more detail.

[0064] It should be appreciated that the computing device 1101 is illustrated as an example only, and it is not intended to be limiting. Various embodiments of the disclosed technology may be implemented using one or more computing devices that include the components of the computing device 1101 illustrated in Fig. 11, which include only a subset of the components illustrated in Fig. 11, or which include an alternate combination of components, including components that are not shown in Fig. 11. For example, various embodiments of the disclosed technology may be implemented using a multi-processorcomputer, a plurality of single and / or multiprocessor computers arranged into a network, or some combination of both.Conclusion

[0065] Having illustrated and described the principles of the disclosed technology, it will be apparent to those skilled in the art that the disclosed embodiments can be modified in arrangement and detail without departing from such principles. In view of the many possible embodiments to which the principles of the disclosed technologies can be applied, it should be recognized that the illustrated embodiments are only preferred examples of the technologies and should not be taken as limiting the scope of the disclosed technology. Rather, the scope of the disclosed technology is defined by the following claims and their equivalents. We therefore claim as our disclosed technology all that comes within the scope and spirit of these claims.

Claims

What is claimed is:

1. A circuit, comprising: a first device comprising an m-bit nonlinear feedback shift register; a second device comprising an w-bit nonlinear feedback shift register; a third device comprising an A-bit ring generator; selection-combination devices, each of the selection-combination devices being configured to output one of bits of a keystream, the one of bits of the keystream being derived from a combination of first one or more bits and second one or more bits, the first one or more bits being generated based on a first group of bits outputted from the first device and a third group of bits outputted from the third device, the second one or more bits being generated based on a second group of bits outputted from the second device and a fourth group of bits outputted from the third device; and an encryption device configured to combine bits for encryption with bits of the keystream to generate encrypted bits.

2. The circuit recited in claim 1, wherein the first device further comprises an expander with inputs coupled to outputs of the m-bit nonlinear feedback shift register, the second device further comprises an expander with inputs coupled to outputs of the w-bit nonlinear feedback shift register, and the third device further comprises an expander with inputs coupled to outputs of the A-bit ring generator.

3. The circuit recited in claim 1, wherein the A-bit ring generator is a A-bit hybrid ring generator.

4. The circuit recited in claim 3, wherein the A-bit hybrid ring generator comprises a mask register and is reconfigurable by a selection mask loaded into the mask register.

5. The circuit recited in claim 1, wherein h, m and n are pairwise distinct.

6. The circuit recited in claim 1, wherein each of the m-bit nonlinear feedback shift register, the w-bit nonlinear feedback shift register, and the A -bit ring generator is configured to receive an initial value for initialization.

7. The circuit recited in claim 1, wherein the m-bit nonlinear feedback shift register and the w-bit nonlinear feedback shift register are maximum-length nonlinear feedback shift registers, and the A-bit ring generator is a maximum-length ring generator.

8. The circuit recited in claim 1, wherein each of the selection devices comprises an XOR gate configured to perform the combination, a first multiplexer configured to receive the first group of bits as input bits and the third group of bits as selection bits, and a second multiplexer configured to receive the second group of bits as input bits and the fourth group of bits as selection bits.

9. One or more computer-readable media storing computer-executable instructions for causing a computer to perform a method, the method comprising: creating a circuit in a circuit design, the circuit comprising: a first device comprising an m-bit nonlinear feedback shift register; a second device comprising an w-bit nonlinear feedback shift register; a third device comprising an A-bit ring generator; selection-combination devices, each of the selection-combination devices being configured to output one of bits of a keystream, the one of bits of the keystream being derived from a combination of first one or more bits and second one or more bits, the first one or more bits being generated based on a first group of bits outputted from the first device and a third group of bits outputted from the third device, the second one or more bits being generated based on a second group of bits outputted from the second device and a fourth group of bits outputted from the third device; and an encryption device configured to combine bits for encryption with bits of the keystream to generate encrypted bits.

10. The one or more computer-readable media recited in claim 9, wherein the first device further comprises an expander with inputs coupled to outputs of the m-bit nonlinear feedback shift register, the second device further comprises an expander with inputs coupled to outputs ofthe 77-bit nonlinear feedback shift register, and the third device further comprises an expander with inputs coupled to outputs of the A-bit ring generator.

11. The one or more computer-readable media recited in claim 9, wherein the h -bit ring generator is a A-bit hybrid ring generator.

12. The one or more computer-readable media recited in claim 11, wherein the A-bit hybrid ring generator comprises a selection mask and is reconfigurable by a selection mask loaded into the mask register.

13. The one or more computer-readable media recited in claim 9, wherein h, m and n are pairwise distinct.

14. The one or more computer-readable media recited in claim 9, wherein each of the m- bit nonlinear feedback shift register, the w-bit nonlinear feedback shift register, and the A-bit ring generator is configured to receive an initial value for initialization, each of the selection devices comprises an XOR gate configured to perform the combination, a first multiplexer configured to receive the first group of bits as input bits and the third group of bits as selection bits, and a second multiplexer configured to receive the second group of bits as input bits and the fourth group of bits as selection bits.

15. The one or more computer-readable media recited in claim 9, wherein the m-bit nonlinear feedback shift register and the w-bit nonlinear feedback shift register are maximumlength nonlinear feedback shift registers, and the A-bit ring generator is a maximum-length ring generator.

16. The one or more computer-readable media recited in claim 9, wherein each of the selection devices comprises an XOR gate configured to perform the combination, a first multiplexer configured to receive the first group of bits as input bits and the third group of bits as selection bits, and a second multiplexer configured to receive the second group of bits as input bits and the fourth group of bits as selection bits.

Images