JP2005077517A - Encryption/decryption device and encryption/decryption method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an encryption/decryption device and an encryption /decryption method for performing repeated arithmetic operations and key expansion for use in the same, capable of operating at a high speed and being packaged efficiently. <P>SOLUTION: The encryption/decryption device (1) includes data conversion means (13-1 to 13-4) for converting data using a data conversion table, processing means (11, 14) for calculating the converted data and a key, and a key register (15) for storing the key. By repeating the data conversion with the data conversion means (13-1 to 13-4) and the arithmetic operations with the processing means (11, 14) in a plurality of rounds, the data are encrypted. The encryption/decryption device (1) also includes a control means (16) for updating the key stored in the key register (15), by using the data conversion means (13-1 to 13-4) during the unoccupied time generated in the data conversion means (13-1 to 13-4), while the data being processed by the processing means (11, 14). <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an encryption / decryption device and an encryption / decryption method, and more particularly, to an encryption / decryption device and an encryption / decryption method that perform repetitive calculation and key expansion used therefor.

  The Rijndael block cipher method was adopted as the next generation standard encryption method (AES).

  FIG. 6 is a schematic explanatory diagram of the Linedale block encryption method.

  The Linedale block encryption method includes a sub-byte (byte substitution) process S1, a shift row process S2, a mix column process S3, and a round key addition process S4.

  FIG. 7 is a diagram for explaining the operation of the sub-byte process S1.

  The sub-byte process S1 is a non-linear byte replacement process and is a process for converting the bytes of each array element into different values. In the Linedale block encryption method, the conversion in the byte sub-process is an affine transformation of the inverse element of the Galois prescription polynomial.

Galois prescription polynomial is 1 byte, 8 bits b0-b7 input data,
b7 * X ^ 7 + b6 * X ^ 6 + b5 * X ^ 5 + b4 * X ^ 4 + b3 * X ^ 3 + b2 * X ^ 2 + b1 * X + b0
It is prescribed by.

  The sub-byte processing S1 is, for example,

によって、定義される。通常は、変換テーブルｓ−ｂｏｘに展開し、配列要素のバイトの値に基づいて変換テーブルｓ−ｂｏｘから値を読み出すことにより変換値が取得される。

Defined by Usually, the conversion value is acquired by expanding the conversion table s-box and reading the value from the conversion table s-box based on the byte value of the array element.

  In the subbyte processing S1, for example, as shown in FIG. 6, each element a0,0 to ai, j to a3,5 of the array of 6 columns and 4 rows is converted into 6 columns and 4 rows corresponding to the conversion table s-box. Converted to array elements b0,0 to bi, j to b3,5. The elements b0,0 to bi, j to b3,5 of the array of 6 columns and 4 rows are output as the processing result of the subbyte processing S1.

  The output of the sub-byte processing S1 is next subjected to column shifting in shift row processing S2.

  FIG. 8 is a diagram for explaining the operation of the shift row process S2.

  In the shift row processing S2, for example, as shown in FIG. 7, the first column C0 is not shifted, the second column C1 is shifted by "1" bits in the direction of arrow A, and the third column C2 is shifted by "2" in the direction of arrow A. The fourth column C3 is shifted in the direction of arrow A by “3” bits.

  In FIG. 8, the case where one row has a 6-bit configuration has been described. However, when one row has a 4-bit configuration, the first column C0 is not shifted as in FIG. “1” bit shift in the A direction, the third column C2 is shifted by “2” bit in the arrow A direction, and the fourth column C3 is shifted by “3” bit in the arrow A direction. If one row has an 8-bit configuration, the first column C0 is not shifted, the second column C1 is shifted by "1" bits in the direction of arrow A, and the third column C2 is "2" bits in the direction of arrow A. Shift the fourth column C3 by “4” bits in the direction of arrow A.

  As for the output of the shift row process S2, the array elements are then mixed in the row direction by the mix column process S3.

  FIG. 9 is an operation explanatory diagram of the mix column process S3.

  When the mix column processing S3 is an input polynomial a (x), an output polynomial b (x), and a fixed polynomial c (x),

で表される。

It is represented by

  At this time, the polynomial c (x) is

で表される。なお、‘０３’、‘０２’、‘０１’は１６進表示を示す。

It is represented by Note that '03', '02', and '01' indicate hexadecimal display.

  When Expression (3) to Expression (2) are displayed in a matrix of 4 rows,

で表される。

It is represented by

  As shown in FIG. 9 according to equation (4), the array elements a0, j, a1, j, a2, j, a3, j in the j-th row are the array elements a0, j, a1, j, a2, in the j-th row. j, a3, and j are converted into array elements b0, j, b1, j, b2, j, and b3, j mixed. The array elements b0, j, b1, j, b2, j, b3, j are arranged as array elements on the jth row.

  The output of the mix low process S3 is then added to the round key in a round key addition process S4.

  FIG. 10 is a diagram for explaining the operation of the round key addition process S4.

  The round key addition process S4 takes an exclusive OR EXOR of the outputs a0,0 to a3,5 of the mix law process S3 and the round keys k0,0 to k3,5 generated according to a predetermined key schedule. It is processing. The result b0,0 to b3,5 of the exclusive OR of the outputs a0,0 to a3,5 of the mixrow processing S3 obtained by the round key addition processing S4 and the round keys k0,0 to k3,5 is the round key addition. It is output as the processing result of processing S4.

  The sub-byte processing S1, shift row processing S2, mix column processing S3, and round key addition processing S4 are performed for a predetermined round, and the input data is encrypted.

  At this time, the round key is generated based on the encryption key according to the key schedule. The key schedule includes a key expansion process and a round key selection process.

The key expanded by the key expansion process is, for example, a linear array of 4-byte words.
At startup, it is an encryption key, and a round key is generated by passing through an s-box. The next round key is generated by passing the previous round key through the s-box.

In the round key selection process, the round key generated by the key expansion process is selected as the round key of the round key addition process S4. (See Non-Patent Document 1)
Joan Daemen and Vincent Rijmen, “AES proposal: Rijndael, document version 2”, [online], September 3, 1999, NIST: National Institute of Standards and Technology, [search August 13, 2003], p.8 -P.16, Internet <URL: http://csrc.nist.gov/CryptoToolkit/aes/rijndael/Rijndael-ammended.pdf>

  An object of the present invention is to provide an encryption / decryption device and an encryption / decryption method that can be implemented efficiently at high speed.

  The present invention provides data conversion means (13-1 to 13-4) for converting data using a data conversion table, processing means (11, 14) for calculating converted data and keys, and keys for storing the keys. A register (15), and the data conversion by the data conversion means (13-1 to 13-4) and the arithmetic processing by the processing means (11, 14) are repeated a plurality of rounds to encrypt / decrypt the data. An encryption / decryption device (1) for performing data conversion means (13) in the free time generated in the data conversion means (13-1 to 13-4) during data processing by the processing means (11, 14). The control means (16) for updating the key stored in the key register (15) using -1 to 13-4) is provided.

  Further, according to the present invention, the data conversion means (13-1 to 13-4) converts the block data constituting the data for each predetermined period for each row, and the control means (16) uses the final clock for each round. A key register in which key data constituting a key is input to the data conversion means (13-1 to 13-4), and the key data is converted from the data conversion means (13-1 to 13-4) by the first clock for each round. (15) is taken in.

  Further, the present invention is characterized in that the data conversion means (13-1 to 13-4) is constituted by a nonvolatile memory in which a data conversion table is stored.

  Further, the present invention is characterized in that data conversion tables (13-1 to 13-4) having the same data configuration are provided for each column.

  According to the present invention, it is not necessary to provide a timing for the key expansion process in each round by performing the key expansion process using the empty time of the repetitive calculation occurring at the boundary of each round. Encryption period can be shortened, and encryption can be performed efficiently at high speed.

  FIG. 1 shows a block diagram of an embodiment of the present invention.

  The encryption / decryption device 1 of this embodiment includes a round key addition unit 11, an input selection unit 12, s-boxes 13-1 to 13-4, a shift row / mix column processing unit 14, a round key register 15, a controller 16, It consists of a round counter 17.

  The round key adder 11 is supplied with input data from the input port Pin1, is supplied with data subjected to shift row processing and mix column processing from the shift row / mix column processing unit 14, and is also supplied with round keys from the round key register 15. Is done. The round key addition unit 11 calculates an exclusive OR of the data from the input port Pin1 or the data from the shift row / mix column processing unit 14 and the round key from the round key register 15 based on a command from the controller 16. And output from the output port Pout.

  The input selection unit 12 is supplied with output data from the round key addition unit 11 and a round key from the round key register 15. The input selection unit 12 selectively outputs the output data from the round key addition unit 11 or the round key from the round key register 15 based on a command from the controller 16. The data selected by the input selection unit 12 is supplied to the s-boxes 13-1 to 13-4.

  The s-box 13-1 is composed of, for example, a ROM (read only memory). The ROM constituting the s-box 13-1 stores a data conversion table, and outputs output data corresponding to the data selected by the input selection unit 12 based on a command from the controller 16. The data conversion table stored in the s-box 13-1 stores a numeric string having a predetermined pattern. The input data is converted into data not related to the input data by passing through the s-box 13-1.

  The s-boxes 13-2 to 13-4 have the same configuration as the s-box 13-1, and the same data conversion is performed. Four columns of data can be converted simultaneously by s-boxes 13-1 to 13-4. By converting four columns of data into four rows by the s-boxes 13-1 to 13-4, it is possible to convert the data in a matrix of 4 rows × 4 columns.

  Since the ROM constituting the s-box 13-1 to s-box 13-4 inputs data at one clock and outputs conversion data at the next one clock, 2 is used to input the data and obtain conversion data. A clock is required. The data converted by the s-boxes 13-1 to 13-4 is supplied to the shift row / mix column processing unit 14 and the round key register 15 based on a command from the controller 16.

  The shift row / mix column processing unit 14 takes in the data converted by the s-boxes 13-1 to 13-4 based on the command from the controller 14, and performs the shift row processing and the mix column processing based on the command from the controller 14. Do. The output data of the shift row / mix column processing unit 14 is supplied to the round key addition unit 11.

  The round key register 15 stores data from the s-boxes 13-1 to 13-4 based on a command from the controller 14. The round key stored in the round key register 15 is supplied to the round key adding unit 11 and the input selecting unit 12 based on a command from the controller 16.

  The controller 16 is supplied with control data for instructing encryption from the control port Pc. A round counter 17 is connected to the controller 16.

  Here, the operation of the controller 16 will be described with reference to the drawings.

  FIG. 2 shows a processing flowchart of arithmetic processing by the controller 16 according to an embodiment of the present invention.

  When encryption is instructed, the controller 16 first resets the round counter 17 to “0” in step S1-1. Next, in step S1-2, the controller 16 takes the input data from the input port Pin1 into the round key adding unit 11, and arranges the round key adding unit 11 in a matrix.

  Next, in step S1-3, the controller 16 takes in the round key from the round key register 15 by the round key addition unit 11, calculates the exclusive OR with the input data, and outputs it to the output port Pout.

  Next, the controller 16 increments the round counter 17 in step S1-4. Next, the controller 16 controls the input selection part 12 by step S1-5, selects the data from the round key addition part 11, and supplies it to s-box 13-1 to 13-4. The data selected by the input selection unit 12 is subbyte processed through the s-boxes 13-1 to 13-4. The sub-byte process is a process corresponding to the sub-byte process S1 shown in FIGS. The data subjected to the sub-byte processing in the s-boxes 13-1 to 13-4 is supplied to the shift row / mix column processing unit 14.

  In step S1-6, the controller 16 controls the shift row / mix column processing unit 14 to perform shift row processing. The shift row processing here is processing equivalent to the shift row processing S2 shown in FIGS.

  Next, in step S1-7, the controller 16 refers to the count value Rn of the round counter 12 and determines whether or not the count value Rn of the round counter 17 has reached the predetermined number of rounds Rc.

  The round number Rc is determined in advance by the data block size, the encryption key, and the key size of the round key. For example, the block size is 128 bits, the key size is 128 bits, the round number Rc is “10”, the block size is 128 bits, the key size is 192 bits, the round number Rc is “12”, the block size is 128 bits, and the key size is 256 bits. The round number Rc is “14”, the block size is 192 bits, the key size is 128 bits, the round number Rc is “12”, the block size is 192 bits, the key size is 192 bits, and the round number Rc is “12”. The size is 192 bits, the key size is 256 bits, the round number Rc is “14”, the block size is 256 bits, the key size is 128 bits, the round number Rc is “14”, the block size is 256 bits, and the key size is 192 bits. Round number Rc is "14", block size 256 bit, round number Rc in the key size of 256 bits are determined to "14".

  If the count value Rn of the round counter 17 has not reached the predetermined number of rounds Rc in step S1-7, the controller 16 controls the shift row / mix column processing unit 14 in step S1-8 to perform mix column processing. Do. Here, the mix column process is a process corresponding to the mix column process S3 shown in FIGS.

  The controller 16 repeats steps S1-3 to S1-8 with the count value Rn of the round counter 12 being a predetermined number of rounds Rc. When the count value Rn of the round counter 17 reaches a predetermined number of rounds Rc in step S1-7, the controller 16 determines from the round key and shift row / mix column processing unit 14 stored in the round key register 15 in step S1-9. Is calculated and output from the output port Pout. The data output from the output port Pout in step S1-9 is used as the encrypted / decrypted data.

  Next, key schedule processing by the controller 16 will be described with reference to the drawings.

  FIG. 3 shows a process flowchart of the key schedule process by the controller 16 according to the embodiment of the present invention.

  In the key schedule process, when encryption is instructed, the controller 16 takes the encryption key from the input port Pin2 into the round key register 15 in step S2-1. Next, in step S2-2, the controller 16 monitors whether or not it has become the fourth clock of each round, that is, the final clock of the round, and when it becomes the fourth clock in step S2-2, step S2 -3, the input selection unit 12 is controlled to select the round key data stored in the round key register 15 as the input to the s-boxes 13-1 to 13-4, and the s-boxes 13-1 to 13-4 are selected. Then, the round key is expanded again by returning to the round key register 15 again.

Next, in step S1-11, the controller 16 controls the input selection unit 12 to select the output of the round key register 15, and returns it to the round key register 15 again through the s-boxes 13-1 to 13-4. As a result, round key expansion processing is performed. Next, the controller 16 returns to step S1-5, calculates the exclusive OR of the round key developed again in step S1-11 and the data, and outputs it from the output port Pout.
The input selector 12 is controlled to select the output of the round key register 15, and return to the round key register 15 again through the s-boxes 13-1 to 13-4, thereby performing round key expansion processing.

  When the controller 16 detects the first clock that is the first clock of the round in step S2-4, the controller 16 controls the input selection unit 12 in step S2-5 to input it to the s-boxes 13-1 to 13-4. The output data of the round key adding unit 11 is selected, and the output data of the s-boxes 13-1 to 13-4 is taken into the round key register 15 as key data in step S2-6.

  In step S2-7, the controller 16 determines whether or not it is the final round based on whether the count value Rn of the round counter 17 is a predetermined count value Rc. If the determination result in step S2-7 is not the final round, the controller 16 returns to step S2-2 to continue the key expansion process, and if the determination result is the final round in step S2-7, the controller 16 The schedule process ends.

  As described above, there is no data input to the s-boxes 13-1 to 13-4. The round key data is input from the round key register 15 to the s-boxes 13-1 to 13-4 at the final clock of the round, and the s-box 13- The converted data obtained by converting the round key data from the s-boxes 13-1 to 13-4 at the first clock of the round without data output from 1 to 13-4 can be supplied to the round key register 15.

  Next, operation | movement of the encryption apparatus 1 is demonstrated using a timing chart.

  FIG. 4 is a timing chart at the start of a round according to an embodiment of the present invention, and FIG. 5 is a timing chart at the end of a round according to an embodiment of the present invention. 4 and 5, the first column is the data input timing to the s-boxes 13-1 to 13-4, the second column is the data input timing from the s-boxes 13-1 to 13-4, and the third column Is the count value Rn of the round counter 17, the fourth column, the seventh column to the ninth column are the round key states, the fifth column is the key register 15, the tenth column to the twelfth column are the next key states, The 13th to 16th columns indicate the state of input data to the s-boxes 13-1 to 13-4, and the 17th to 20th columns indicate the state of output data from the s-boxes 13-1 to 13-4. In addition, one row in the first column and the second column indicates a period of one clock.

  First, during rounds “0” and “1”, as shown in the 13th to 16th columns, the input data Din is supplied to the s-boxes 13-1 to 13-4. At this time, as shown in the first column in the period T1, the data S0 of the first row of the input data Din is input to the s-boxes 13-1 to 13-4. In the period T2, the conversion data of the data S0 of the first row is output from the s-boxes 13-1 to 13-4 as shown in the second column, and the data S1 of the second row is output as shown in the first column. It is input to s-box 13-1 to 13-4.

  In the period T3, the conversion data of the data S1 in the second row is output from the s-boxes 13-1 to 13-4 as shown in the second column, and the data S2 in the third row is output as shown in the first column. It is input to s-box 13-1 to 13-4. In the period T4, the conversion data of the data S2 in the third row is output from the s-boxes 13-1 to 13-4 as shown in the second column, and the data S3 in the fourth row is output as shown in the first column. It is input to s-box 13-1 to 13-4.

  In the period T5, as shown in the second column, the converted data of the data S3 in the fourth row is output from the s-boxes 13-1 to 13-4.

  This completes the sub-byte processing of the input data Din. The sub-byte processed data is subjected to shift row processing and mix column processing by the shift row / mix column processing unit 14, and round key addition processing is performed by the round key addition unit 11. In the next round “1”, the output data of the round key adding unit 11 is sub-byte processed again at the ground. For this reason, there is no data to be supplied to the s-boxes 13-1 to 13-4 in the period T5. Therefore, in the next period T11, there is no output of conversion data from the s-boxes 13-1 to 13-4.

  Therefore, in this embodiment, the key expansion process incorporated in the key schedule is executed using the periods T5 and T11. First, in the period T5, the encryption key k stored in the round key register 15 is input to the s-boxes 13-1 to 13-4 as shown in the first column, and as shown in the second column in the period T11. The conversion key data obtained by converting the data k included in the encryption key is output from the s-boxes 13-1 to 13-4. The conversion key data converted by the s-boxes 13-1 to 13-4 is supplied to the round key register 15 in the period T11 as shown in the sixth column.

  The key data supplied to the next round key register 15 is included in the round key register 15 in the period T12 as shown in the fifth column, and is output from the round key register 15 as a round key.

  Periods T15, T21, T22 in which the above operation extends over rounds “1” and “2”, periods T25, T31, T32 over rounds “2” and “3”, periods T35 over rounds “3” and “4”, It is performed in periods spanning rounds such as periods T95, T101, and T102 spanning T41, T42, and rounds “9” and “10”.

  As described above, the key expansion process is performed for each round by performing the key expansion process on the s-boxes 13-1 to 13-4 by using the empty time that occurs in the period spanning the rounds. Therefore, it is possible to perform processing at high speed. In addition, since it is not necessary to provide an s-box dedicated to the key expansion process for speeding up, it can be configured with a simple configuration at low cost.

It is a block block diagram of one Example of this invention. It is a processing flowchart of the arithmetic processing by the controller 16 of one Example of this invention. It is a process flowchart of the key schedule process by the controller 16 of one Example of this invention. It is a timing chart at the time of the round start of one Example of this invention. It is a timing chart at the time of completion | finish of a round of one Example of this invention. It is a schematic explanatory drawing of a linedale block encryption system. It is operation | movement explanatory drawing of subbyte process S1. It is operation | movement explanatory drawing of the shift row process S2. It is operation | movement explanatory drawing of mix column addition process S3. It is operation | movement explanatory drawing of round key addition process S4.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Encryption / decryption apparatus 11 Round key addition part, 12 input selection part, 13-1 to 13-4 s-box
14 shift row / mix column processing unit, 15 round key register 16 controller, 17 round counter

Claims (5)

Data conversion means for converting data by a data conversion table, processing means for calculating the converted data and key, and a key register for storing the key, data conversion by the data conversion means and the processing means An encryption / decryption device that encrypts / decrypts the data by repeating the arithmetic processing by a plurality of rounds,
Encryption means comprising: a control means for updating a key stored in the key register by using the data conversion means during an empty time generated in the data conversion means during data processing by the processing means / Decoding device device. The data conversion means converts the block data constituting the data for each row for each predetermined period,
The control means inputs the key data constituting the key to the data conversion means at the final clock for each round, and the key register converts the key data from the data conversion means at the first clock for each round The encryption / decryption device according to claim 1, wherein:   2. The encryption apparatus according to claim 1, wherein the data conversion means is composed of a nonvolatile memory in which the data conversion table is stored. The data is composed of block data in a predetermined column,
4. The encryption / decryption device according to claim 1, wherein the data conversion unit has the data conversion table for each column. A data conversion procedure for converting data by the data conversion table; and a processing procedure for calculating the converted data and a key stored in the key register. Data conversion by the data conversion procedure and arithmetic processing by the processing procedure Is a method of encrypting the data by repeating a plurality of rounds,
An encryption / decryption method comprising: a control procedure for updating a key stored in the key register by the data conversion procedure in an empty time generated in the data conversion procedure during data processing by the processing procedure .

Images