KR0159385B1 - Encryption apparatus by using data encryption stand algorithm - Google Patents

Abstract

The present invention relates to an encryption apparatus using a death algorithm that enables the cycle for encryption even in odd times. The present invention provides a data separation module (100) for separating information data for encryption into first and second same bit data; A first buffer 140 for temporarily storing the separated first data and outputting the stored first data; A second buffer 150 for temporarily storing the separated second data and outputting the stored second data as new first data; The second data provided from the data separation module 100 is generated by performing a function operation with the key data to generate second data, and the first data output from the first buffer 140 is encrypted. An encryption module 200 for generating an encrypted data by performing a logical operation with the second data; A number-of-times determination module (300) for causing the new second data to be repeatedly encrypted in the encryption module (200) or output as encrypted data according to the number of times encryption is performed in the encryption module (200); And a synthesis and output module 400 for synthesizing and outputting the encrypted data output from the number of times determination module 300 and the second data output from the second buffer 150.

Description

Encryption device using the DES algorithm

1 is a block diagram of an encryption apparatus using a conventional DES algorithm.

2 is a diagram illustrating a configuration of a table for explaining the operation of the death algorithm of FIG.

Figure 3 is a block diagram of the encryption and the device using the Death algorithm according to the present invention.

* Explanation of symbols for the main parts of the drawings

100: data separation module 200: encryption module

300: progress count determination module 400: synthesis and output module

The present invention relates to an encryption device using the Death (DES) algorithm, and more particularly, to an encryption device using the Death (DES) algorithm to enable a cyclic cycle for encryption even in odd times.

The encryption algorithm is designed to prevent the acquisition of information data by a third party with an illegal intention, among which a DES (Data encryption Standard) algorithm is widely used.

FIG. 1 is a block diagram schematically illustrating an encryption apparatus using a conventional DES algorithm, in which 64-bit digital information data to be encrypted is input to the bit unit separator 10.

The bit unit separating unit 10 divides the 64-bit information data into first and second right and left 32-bit units having the same bit length to the first and second bit unit holding units 12 and 14. Provide each. The right 32-bit data separated by the bitwise division 10 is provided to the expansion unit 16 again, and is expanded to 48-bits with reference to the expansion table 18 in the expansion unit 16.

For example, referring to the extension table 18 shown in FIG. 2A, the first bit of the right 32-bit data is replaced by the second and 48th bits, and the second and third bits are respectively the third and fourth bits. The fourth bit is expanded by being replaced by the fifth and seventh bits. The 48-bit extension in the first extension 16 is provided to the exclusive OR circuit 20 with 64-bit key data for encryption.

At this time, the 64-bit key data for encryption has 8 parity bits (7, 15, 23, 31, 39, 47, 55, 63) among the 64-bits as shown in FIG. ) Is removed and generated as 56-bit key data, and then reduced to 48-bit key data again by the table shown in FIG.

More specifically, referring to the table shown in FIG. 2C, in the 56-bit key data, the 1st, 2nd, 3rd, 4th, 5th, 6th, 7th bits are 5th, 24th, 7th, respectively. The entire 56-bits are reduced to 48-bits of key data in such a way that the 16th, 6th, 10th, 20th and 18th bits are replaced and the 9th bits are removed.

The 48-bit extended data to be encrypted of the reduced 48-bit key data is computed by the exclusive OR circuit 20, and the resulting 48-bit data is each a 6-bit data block B1 to And divided into B (subsitution) table processing unit 22. The S-table processor 22 converts the 48-bit data input using the S-table 24 into 32-bit data. In more detail with reference to FIG. 2E, the S-table processing unit 22 includes S-boxes S1 to S8 corresponding to block data B1 to B8 in 6-bit units, respectively. The S-boxes S1 to S8 convert the 6-bit input data into 4-bit data using the S-table 24 illustrated in FIG.

The conversion process performed by the S-table processor 22 using the S-table 24 is described as follows. In FIG. 2 (e), first, the value of the 1st, 6th bit is set to (r) among the 6-bit data input to each S-box, and the value of the 2nd, 3rd, 4th, 5th bit. Is set to (c). Further, in the S-table 24 shown in FIG. 2 (d), S-boxes of S1 to S8 of the S-table processing unit 22 are listed on the vertical axis, and values of 0 to 15 are listed on the horizontal axis. have.

For example, assuming that 6-bit data input to S1 is 100001, the value (r) 11 of the 1st and 6th bits corresponds to the decimal number 3, and the value (c) 0 of the 2nd, 3, 4, and 5th bits is Corresponds to decimal zero. When these values (r) and (c), i.e., 3 and 0, are respectively contrasted with the vertical and horizontal axes of the S-table 24 shown in FIG. 2 (d), 15 is retrieved. At this time, the binary value for 15 is 1111 and is output through the output terminals (1) (2) (3) (4) of the S1 box. Therefore, the block data B1 to B8 in 6-bit units are output as 4-bit data through corresponding S-boxes, so that the S-table processor 22 converts 48-bit data into 32-bit data. Will print.

Data converted in 32-bit units by the S-table 22 is provided to the permutation (P) -table processing unit 26. The P-table processing section 26 converts each bit of the 32-bit data into encrypted 32-bit data by using the P-table 28 illustrated in FIG. 2 (f). The right 32-bit data converted by the P-table processor 26 is provided to the next exclusive OR circuit 30.

On the other hand, the second left 32-bit data separated by the bit unit separating unit 10 and provided to the second bit unit holding unit 14 is the 32-bit data output from the above-described P-table processing unit 26. And the exclusive OR in the exclusive OR circuit 30 to generate new right 32-bit data.

Further, the right 32-bit data provided from the first bit unit holding unit 12 is generated as new left 32-bit data, and described together with the new right 32-bit data generated in the exclusive OR circuit 30 described above. The process is repeated 16 + 4t times (t is 0, 1, 2, 3, ...). Through this repetitive step, 64-bit data obtained by synthesizing the 32-bit data of the right and left finally obtained is finally output as encrypted data.

However, as described above, in order to obtain new left and right bit units, the DES algorithm has a problem that an ongoing process must be repeated evenly.

Accordingly, it is an object of the present invention to provide an encryption apparatus using the Death (DES) algorithm that extends the application range of the Death (DES) algorithm so that a cyclic cycle for encryption is possible even in an odd number of times.

According to the present invention for achieving the above object, data separation means for separating the information data into first and second data of the same bit unit; A first buffer for temporarily storing the first bit unit data separated by said data separating means and outputting the stored first bit unit data in response to an output request signal; A second buffer for temporarily storing the second bit unit data separated by said data separating means and outputting the stored second bit unit data in response to a progress signal (add); Generating second bit data obtained by functioning the second bit data separated by the data separating means by a function operation with the key data, and generating the output request signal each time the function operation proceeds. Encryption means for generating an encrypted data by performing a logical operation on the first bit unit data output from the first buffer with the function-operated second bit unit data according to the first buffer; Each time the encrypted data is generated by the encryption means, a progress status signal add indicating a state in which encryption is in progress is generated, and the encrypted data is generated as new second bit unit data according to the number of times the encryption is performed. Means for determining the number of times of advancing the second buffer and providing the second bit data output from the second buffer to the first buffer as new first bit data; And synthesizing and outputting means for synthesizing and outputting new first and second bit unit data outputted from the advancing number determining means.

Hereinafter, the present invention will be described in detail with reference to the illustrated drawings.

3 is a block diagram of an encryption apparatus using a Death (DES) algorithm according to the present invention, wherein the data separation module 100, the first and second buffers 140 and 150, the encryption module 200, and the number of times of determination are determined. Module 300, synthesis and output module 400.

The data separation module 100 includes an initial displacement unit 110 and a left / right separation unit 120.

The initial displacement unit 110 is configured to transform the information data of the 64-bit unit to be encrypted into other data based on the patterning table and provide it to the left / right separation unit 120. The left / right separating unit 120 separates the 64-bit information data provided from the initial displacement unit 110 into first and second left and right data having the same 32-bit length to separate left 32-bit data. The first buffer 140 is provided, and the right 32-bit data is provided to the expansion processor 210 and the second buffer 150.

The first buffer 140 temporarily stores the left 32-bit data provided from the left / right separating unit 120, and outputs an output request signal provided from the P-table processing unit 250 which describes the stored left 32-bit data. The new left 32-bit data provided by the exclusive OR circuit 260 and provided by the second number of times determination unit 340 are stored.

The second buffer 150 temporarily stores the right 32-bit data provided from the left / right separator 120 and stores the stored data according to the progress signal add provided from the progress signal generator 320. The new left 32-bit data is provided to the first buffer 140 through the second progress count determining unit 340.

The encryption module 200 is a means for generating encrypted data by performing a function operation on the information data and the key data to be encrypted. The encryption module 200, the expansion table 215, the key processing unit 220, and the exclusive logical OR circuit 230 ), An S-table 245, a P-table processing unit 250, a P-table 255, and an exclusive-OR circuit 260, described in the prior art described with reference to FIGS. 1 to 2. Performs substantially the same function as the above.

The expansion processor 210 expands the right 32-bit data provided from the left / right separator 160 into 48-bit data using the expansion table 215 and provides the exclusive logical sum circuit 230.

The key processor 220 reduces the 64-bit encryption key data to 48-bit key data and provides the exclusive logical sum circuit 230.

The exclusive OR circuit 230 performs an exclusive OR on the 48-bit data provided from the expansion processor 210 and the 48-bit key data provided from the key processor 220, and provides the same to the S-table processor 240.

The S-table processor 240 reduces the 48-bit data provided from the exclusive OR circuit 230 to 32-bit data using the S-table 245 and provides the P-table processor 250.

The P-table processing unit 250 converts 32-bit data provided from the S-table processing unit 240 into 32-bit data using the P-table 255 and provides the exclusive logical sum circuit 260 to output the same. The request signal is generated and provided to the first buffer 140. This output request signal is used as a signal for causing the left 32-bit data stored in the first buffer 140 to be output to the exclusive OR circuit 260.

The exclusive OR circuit 260 is a 32-bit data generated by performing an exclusive OR operation on a bit basis of 32-bit data provided from the P-table processor 250 and the left 32-bit data stored in the first buffer 140. The bit data is provided to the number of times determination module 300.

On the other hand, the number of times determination module 300 is composed of a progress state signal generation unit 320, the first and second number of times determination unit 330 and 340.

The progress signal generator 320 generates a progress signal add indicating that the exclusive OR operation is performed by the exclusive OR circuit 260, and generates the generated progress signal add. Provided to the second number of times determination unit 330, 340 and the second buffer 150. The progress signal add added to the second buffer 150 serves as an output request signal for the right 32-bit data stored in the second buffer 150.

The first number of times determination unit 330 counts the progress signal (add) provided by the progress signal generator 320 and compares the counted number of times with a preset number of times, for example, 16 times, and compares the result with the result. Accordingly, the 32-bit data output from the exclusive OR circuit 260 is output to the synthesis unit 350 as new right 32-bit data or provided to the encryption module 200 and the second buffer 150.

The second progress count determination unit 340 counts the progress signal (add) provided by the progress signal generator 320 and compares the counted progress count with a preset progress count, for example, 16 times, and compares the result with the result. Accordingly, the right 32-bit data stored in the second buffer 150 is output to the synthesis unit 350 as new left 32-bit data or provided to the encryption module 200 and the first buffer 140.

When the encryption operation according to 16 repetitions is completed, the combining unit 350 combines the left and right 32-bit data provided from the first and second advancing frequency determination units 330 and 340, respectively. Provided by 360.

The initial inverse displacement unit 360 transforms 64-bit data provided from the synthesis unit 350 in the reverse order of the initial displacement unit 130 and outputs the transformed data.

Referring to the present invention configured as described in detail as follows.

As shown in FIG. 3, 64-bit information data to be encrypted is input to the initial displacement unit 110. FIG.

The 64-bit information data to be encrypted in the initial displacement unit 110 is transformed using a pattern table (not shown) and then provided to the left / right separator 120. In this case, an inverse pattern table capable of performing a reverse process of the pattern table is also embedded in the initial inverse displacement unit 360.

In the left / right separator 120, 64-bit data provided from the initial displacement unit 110 is separated into left 32-bit data and right 32-bit data. The separated left 32-bit data is output to the first buffer 140, and the right 32-bit data is output to the expansion processor 210 and the second buffer 150. At this time, the expansion processing unit 210 of the encryption means 200 expands the right 32-bit data input with reference to the expansion table 215 into 48-bit data and then provides the exclusive logical sum 230.

Meanwhile, 64-bit key data for encryption is converted into 48-bit key data by the key processing unit 220 and then provided to the exclusive OR circuit 230. In the exclusive OR circuit 230, the extended right 48-bit data is subjected to an exclusive-OR operation on a bit basis with the converted 48-bit key data. The 48-bit data calculated by the exclusive OR circuit 230 is converted into 32-bit data based on the S-table processor 240 and the S-table 245 and provided to the P-table processor 250.

In the P-table processing unit 250, 32-bit data is provided to the exclusive OR circuit 260 as 32-bit data modified based on the P-table 255. At the same time, an output request signal is generated by the P-table processor 250 and provided to the first buffer 140. The first buffer 140 is stored according to the output request signal provided by the P-table processor 250. Provide the bit data to exclusive OR circuit 260.

Accordingly, the exclusive OR circuit 260 processes the 32-bit data generated by performing an exclusive OR on the left 32-bit data provided from the first buffer 140 and the 32-bit data provided from the P-table 255. Output to the generator 320.

The progress signal generator 320 generates a progress signal add every time 32-bit data is provided from the exclusive OR circuit 260 to determine the first and second progress frequency determination units 330 and 340 and the second. To the buffer 150. At this time, the second buffer 150 provides the right 32-bit data stored in response to the progress state signal add to the second progress determination unit 340.

The first progress count determining unit 330 counters that the current encryption has been executed once in response to the progress status signal add, and compares the counted number of encryption progresses with the preset progress count. As a result of the comparison, if the current number of advances is less than the predetermined number of advances, the first number of advances determination unit 330 encrypts the 32-bit data provided from the exclusive logical sum circuit 260 as new right 32-bit data as the new means 32. ) And to the second buffer 150. However, as a result of the comparison, when the current number of advances is greater than or equal to the predetermined number of advances, the first number of advance determination unit 330 outputs the 32-bit data provided from the exclusive OR circuit 260 to the synthesis unit 350. .

In addition, similar to the first progress count determining unit 330, the second progress count determining unit 340 counters that the current encryption has been executed once in response to the progress status signal add, and counts the number of counts of the encryption progress counts. Compare the preset number of advances. If the comparison result is that the number of progresses currently counted is less than the predetermined number of advances, the second progress number determining unit 340 uses the right 32-bit data output from the second buffer 150 as the new left 32-bit data. The number of times is output to the first buffer 140 through the determination unit 340. Therefore, the new left 32-bit data provided from the second number of times determination unit 340 to the first buffer 140 is used as data to be advanced for the next encryption.

However, as a result of the comparison, if the current number of times is greater than or equal to the preset number of times, the second number of times determination unit 340 uses the right 32-bit data output from the second buffer 150 as the left 32-bit data. Output to the synthesis unit 350.

Accordingly, the synthesis unit 350 synthesizes the input left and right 32-bit data as 64-bit data when the current counted number of advances is greater than or equal to the preset number of advances to the initial reverse displacement unit 360. Will be provided.

The initial reverse displacement unit 360 transforms 64-bit data provided from the synthesis unit 350 in the reverse order of the initial displacement unit 130 and outputs the transformed data.

Therefore, since the left and right 32-bit data are stored in the first and second buffers 140 and 150, the first and second advancing frequency determination units 330 and 340 are odd numbers of encryption advancing times. Encryption can be done regardless of the number of times or even.

As described above, the present invention can simultaneously obtain the left and the right data, thereby reducing the inconvenience of encrypting only the existing even number of times and the encryption time, and also encrypting the process at least once (odd number). By using it, there is an advantage that it can be simply used to prevent forgery of various IC cards.

Claims (3)

An apparatus for encrypting information data to be encrypted using key data, comprising: data separation means (100) for separating the information data into first and second equal bit data; A first buffer (140) for temporarily storing the first bit unit data separated by the data separating means (100) and outputting the stored first bit unit data in response to an output request signal; A second buffer 150 for temporarily storing the second bit unit data separated by the data separating unit 100 and outputting the stored second bit unit data in response to a progress signal (add); The second bit unit data separated by the data separating means 100 is generated to generate second bit unit data functioned by a function operation with the key data, and each time the function operation proceeds, the output request signal. Generates and provides an encrypted data by performing a logical operation on the first bit unit data output from the first buffer 140 with the function-operated second bit unit data, as generated and provided to the first buffer 140. Encryption means 200; Each time the encrypted data is generated by the encryption means 200, a progress status signal add indicating a state in which encryption is in progress is generated, and the encrypted data is converted into a new second bit unit according to the number of times the encryption is performed. Determination of the number of times that the data is provided to the second buffer 150 and the second bit data output from the second buffer 150 is provided to the first buffer 140 as new first bit data. Means 300; And synthesizing and outputting means (400) for synthesizing and outputting new first and second bit unit data outputted from said number of times determining means (300). The method of claim 1, wherein the number of times determining means (300); A progress signal generator 320 generating the progress signal add indicating that encryption is performed each time the encrypted data is output from the encryption means 200; Counting the progress signal (add) generated by the progress signal generating unit 320, when the counted number of progress is less than the predetermined number of times the encrypted data generated by the encryption means 200 to the new The encryption generated by the encryption means 200 when the number of progresses is greater than or equal to a predetermined number of times, provided to the encryption means 200 and the second buffer 150 as second bit unit data. A first number of times determination section (330) for outputting the data to the synthesis and output means (400) as the new second bit unit data; Counting the progress signal (add) generated by the progress signal generator 320, the second bit unit data output from the second buffer 150 when the counted progress is less than the predetermined number Is supplied to the first buffer 140 as the new first bit unit data, and the second bit unit data output from the second buffer 150 is stored when the counted number of advances is greater than or equal to a preset number. And a second advancing number determining unit (340) for outputting to the synthesizing and outputting means (400) as new first bit unit data. 3. An encryption apparatus using a death (DES) algorithm according to claim 2, wherein the number of encryption proceedings performed by said encryption means (200) is one or more times.