CN101938351A - Key expanding method for encrypting block cipher - Google Patents

Abstract

The invention provides a key expanding method for a block cipher algorithm, which is used for generating each round of subkeys in the block cipher algorithm. The method provided by the invention mainly comprises the following step of calculating an iteration function for generating a subkey, wherein the iteration function is formed by a nonlinear operation, a constant operation and a cycle shift operation. The method provided by the invention can effectively and conveniently generate the subkeys, effectively reduce storage space, has higher realizing speed compared with a common commercial block cipher algorithm, can meet the requirements on real-time encryption and decryption, and simultaneously has higher safety.

Description

A kind of realization block cipher encrypted secret key extended method

Technical field

The present invention relates to the method for a kind of data encryption and deciphering, be specifically related to a kind of cipher key spreading method of block cipher, what be used to generate block cipher respectively takes turns sub-key.

Background technology

Information age computer technology fast development, block cipher because have speed fast, be easy to standardization and be convenient to characteristics such as software and hardware realization, become the core cryptographic algorithm of realizing data encryption, message discriminating, authentication and key management in the information security field, in field extensive uses such as computer, communications.

Block cipher is that the original data sequence (promptly expressly) that will need data protection divides into groups, and each is grouped in carries out cryptographic operation under the key effect, will expressly be converted to the irregular data (being ciphertext) that can not discern.Ciphertext is transmitted to guarantee data security, and data receiving uses same group key decrypt ciphertext can be plaintext.The block cipher cryptographic operation is usually through too much round function effect, and each is taken turns all needs one group of corresponding sub-key.In the implementation process of encryption and decryption, communicating pair is only shared one group of initial seed key, by key schedule the seed key expansion is generated the sub-key that needs, and reduces memory space, the traffic, improves systematic function.

The key schedule of exemplary packet cryptographic algorithm is applicable to that usually key length is the cipher key spreading of 128 bits, 192 bits or 256 bits at present.256 bit keys length are a kind of typical key lengths during block cipher is used, under the pressure of data security, 256 bit clear packets are subjected to password designer's favor day by day, the key frequency of utilization of corresponding 256 bit lengths progressively promotes, therefore, the block cipher that designs 256 bit keys length will have very strong practicality.

Key schedule at first will guarantee fail safe, promptly requires the design of key schedule to have sub-key statistical independence and sensitivity.Statistical independence promptly requires not exist between the sub-key simple relation, and sensitivity promptly requires the change of the several bits of seed key can change corresponding sub-key largely.In addition, the speed of key schedule should not influence the progress of work of encrypting or deciphering, and the parts that algorithm is realized under the software and hardware condition should have applicability and save resource as much as possible.

Block cipher key layout design for scheme should be observed design criterions such as above fail safe, speed, applicability.Mutual restriction between each design criterion, the key schedule of at present typical block cipher has characteristics and deficiency separately.The key schedule of a lot of typical cryptographic algorithms, key schedule as cryptographic algorithms such as AES, IDEA, KASUMI and SHACAL all can not be resisted specific cryptanalysis, as carrying out cryptanalytic key correlation attack at key schedule specially and ganging up against.Some algorithms such as RC6, MAPRS need take resources such as a large amount of calculating and storage when realizing, greatly reduce its practicality, and under resource-constrained situation, they can not be realized at a high speed, synchronous encryption and decryption are operated.The key schedule of taking into account performances such as fail safe and speed becomes designer's design object.

Summary of the invention

The purpose of this invention is to provide a kind of block cipher key schedule, support the length of 256 bit keys, generate the sub-key of specified quantity, be used for data encryption and deciphering.This key schedule comprises that initialization, sub-key iteration generating algorithm and sub-key choose algorithm, wherein, sub-key iteration generating algorithm is a core of the present invention, and 256 bit seed keys are imported this algorithm, can generate required several sub-keys of respectively taking turns of taking turns efficiently and safely.

For key length is that 8 of 256 bits are taken turns block cipher, needs 8 round key and 1 albefaction key, and each sub-key length is 256 bits, needs to generate the expanded keys of 2304 bits altogether.Fig. 1 is the implementing procedure figure of iteration type password expansion algorithm, comprises that (1) initialization, (2) key iteration generating algorithm and (3) sub-key choose algorithm.

Technical scheme of the present invention is as follows:

A. initialization:

Definition length is 80 array W, and the length of element of this array is 32 bits; The seed key of 256 bits is write array W[0 successively]～W[7] as input; W[8]～W[79] be used for storing the sub-key that expansion generates;

B. calculate and generate sub-key (as shown in Figure 2), adopt following iteration function:

W[i]＝{FS(W[i-8])+FS(W[i-7])+FS(W[i-3])+FS(W[i-2])

+ F _Imod4+ t (i) }＜＜＜(7i+3) mod32 (formula 1)

Wherein:

-i is an array index, carries out iteration, i≤79 since 8 each increases by 1;

-FS is a non-linear transform function;

The value of-Φ is 4 constants, finds the solution by 5 rank roots of 32 rank primitive polynomials in the finite field, determines that the value of 4 constants is:;

■Φ ₀＝3C2D240E

■Φ ₁＝E4BB73F6

■Φ ₂＝B40B34CD

■Φ ₃＝6C9D6334

-t is a function, is used for its parameter is converted into binary representation;

-"＜＜＜" the expression ring shift left; As a＜＜＜b represents the position a ring shift left b.

C. export sub-key: with array W[i] (i=8,9 ..., 79) in order of elements output be sub-key.

In formula 1, the implementation of described non-linear transform function FS is as follows: for described function F S (x), x represents the variable of long 32 bits, is write x as the form of 48 bit number parallel connections, i.e. x=x ₁x ₂x ₃x ₄, then

FS (x)=M (S ₀(x ₁), S ₁(x ₂), S ₂(x ₃), S ₃(s ₄)) (formula 2)

Wherein,

$M(y_1,y_2,y_3,y_4)=\left(\begin{array}{cccc}01& 02& 03& 01\\ 01& 01& 03& 02\\ 02& 01& 01& 03\\ 03& 02& 01& 01\end{array}\right)\·\left(\begin{array}{c}{y}_1\\ y_2\\ y_3\\ y_4\end{array}\right),$

y ₁, y ₂, y ₃, y ₄Be GF (2 ⁸) in element;

Element in the matrix is GF (2 ⁸) in the hexadecimal representation of element;

S ₀, S ₁, S ₂, S ₃Be four different functions, the S box of expression 8 * 8; S ₀Adopt the S box of the block cipher of encryption and decryption computing; S ₁, S ₂, S ₃By S ₀Generate, the generation method is as follows:

S described in the formula 2 ₀Select the S box of the supporting block cipher of key schedule for use, to reduce memory space, to improve operation efficiency.Most block ciphers all have satisfactory S box, as the S box of AES, 4 different S boxes of Camellia, 2 S boxes of SEED.Value is a self-defined S box (as table 1) when the form of block cipher S box is incompatible, can change the S box as required.Carrying out nonlinear operation with the S box is to guarantee good diffusion and non-linearity, the effective means of promoting fail safe.

	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
																	0	E4	80	65	7A	C8	4B	FB	A8	93	E7	54	3A	D7	0C	B4	5B
1	89	61	B7	69	67	F1	74	7C	A0	72	2E	4	D4	22	EB	EC
																	2	A4	20	6E	97	87	8	17	DC	23	13	45	8F	CF	B8	B6	E6
3	CD	FA	82	55	6D	91	57	92	F3	76	B2	2A	68	C7	9D	3
																	4	6B	F6	59	CE	E2	36	2F	5D	90	9E	88	21	BB	18	8A	86
5	0A	12	1D	27	60	98	E9	E3	66	D3	0B	A1	3F	85	0F	33
																	6	8D	6C	6F	4F	8E	0E	DF	10	B1	43	62	56	34	44	31	D2
7	AE	77	24	ED	99	7F	CB	DD	AF	BC	1F	CC	BD	F0	A2	E0
																	8	FC	4A	B0	7	0	94	DE	70	A9	F4	AB	73	D5	79	A6	1E
9	DA	16	EE	52	1C	53	E1	D0	58	30	37	19	F7	1A	28	96
																	A	63	46	A5	4C	29	F5	AC	39	D6	2C	A3	B3	83	7E	11	EF
B	9B	BA	6	3B	DB	81	75	D1	6A	3E	7B	9F	7D	78	B5	8B

C

2

0D

9

4D

5A

EA

F2

C1

51

5C

C5

2B

D9

64

4E

48

D

CA

47

2D

38

3D

71

8C

E8

40

5

D8

B9

5E

3C

BE

C4

E

F9

95

9C

C3

FF

14

25

A7

1B

9A

E5

C9

C0

50

32

5F

F

41

F8

AD

BF

C2

1

35

49

15

AA

FD

FE

26

C6

42

84

The S box that this algorithm of table 1 provides

In the formula 1 calculating by multinomial X ^-8+ X ^-7+ X ^-3+ X ^-2=1 determines, the array element of back is calculated as parameter by the 8th, 7,3,2 array element before it.Because this multinomial is a primitive polynomial, so guaranteed not repeating of the new array element that generates; Generate 1 new element by 4 element iteration, guaranteed the one-way of iteration function, it is invalid to make the key correlation attack analyze this key.

Take turns several block ciphers for wheel number other in [4,20] scope, only need to use the present invention according to data volume change array length.For example 10 take turns cryptographic algorithm, need 10 iteration keys and 1 albefaction key, then byte arrays changes W[8 into], W[9] ..., W[95].The rest may be inferred.

Beneficial effect of the present invention: algorithm provided by the invention has reduced the work internal memory, can efficiently generate sub-key expediently, have the higher realization speed of more general commercial block cipher, can satisfy requirement real-time encrypted and deciphering, simultaneously, this algorithm has than higher fail safe.

Description of drawings

Fig. 1 is the implementing procedure figure of iteration type password expansion algorithm;

Fig. 2 is that sub-key generates the iterative algorithm schematic diagram.

Embodiment

The ins and outs such as step, scheme that generate sub-key that 8 key lengths of taking turns block cipher are 256 bits and albefaction sub-key by 256 bit seed keys are described below, so that thorough understanding of the present invention to be provided.

Implementing procedure figure according to Fig. 1.The present invention implements initialization, key iteration generating algorithm and sub-key successively and chooses steps such as algorithm.

In initialization, 256 bit seed keys are write array: W[0 successively], W[1], W[2] and, W[3], W[4] and, W[5], W[6] and, W[7], as input.W[8], W[9] ..., W[79] and be used for storing the sub-key that expansion generates.

Expanded keys is generated by sub-key iterative algorithm iteration, and the principle of expansion structure design, iteration function design and constant design and method are as described in the summary of the invention, and iterative process is shown in figure two.Initialized byte arrays input follow procedure is calculated:

for?i←8to 79

do

W[i]＝{FS(W[i-8])+FS(W[i-7])+FS(W[i-3])+FS(W[i-2])

+F _imod?4+t(i)}＜＜＜(7i+3)mod32

end

The expanded keys byte arrays that generates is chosen algorithm by key and is generated 8 sub-keys and 1 albefaction key, and principle is shown in summary of the invention, and program is as follows:

for?i←0to 8

output(W[8i+8]，W[8i+9]，…，W[8i+15])

end

It should be noted that, the purpose of publicizing and implementing example is to help further to understand the present invention, but it will be appreciated by those skilled in the art that: according to key schedule provided by the invention, generate the sub-key that other take turns number and key length, the performance at aspects such as fail safe, speed is of equal value.Therefore, the present invention should not be limited to the disclosed content of embodiment, and the scope of protection of present invention is as the criterion with the scope that claims define.

Claims (6)

1. a cipher key spreading method that is applied to block cipher encrypting and decrypting algorithm is characterized in that, the step that generates the wheel number and be 8 sub-key is as follows:

A. initialization:

Definition length is 80 array W, and the length of element of this array is 32 bits; The seed key of 256 bits is write array W[0 successively]～W[7] as input; W[8]～W[79] be used for storing the sub-key that expansion generates;

B. calculate and generate sub-key, adopt following iteration function:

W[i]＝{FS(W[i-8])+FS(W[i-7])+FS(W[i-3])+FS(W[i-2])

+F _imod?4+t(i)}＜＜＜(7i+3)mod32

Wherein:

-i is an array index, carries out iteration, i≤79 since 8 each increases by 1;

-FS is a non-linear transform function;

The value of-Φ is 4 constants;

-t is a function, is used for its parameter is converted into binary representation;

-"＜＜＜" the expression ring shift left;

C. export sub-key: with array W[i] (i=8,9 ..., 79) in order of elements output be sub-key.

2. the method for claim 1 is characterized in that, the implementation of described non-linear transform function FS is as follows:

For described function F S (x), x represents the variable of long 32 bits, is write x the form of 48 bit number parallel connections as, promptly

X=x ₁x ₂x ₃x ₄, FS (x)=M (S then ₀(x ₁), S ₁(x ₂), S ₂(x ₃), S ₃(x ₄)), wherein,

$M(y_1,y_2,y_3,y_4)=\left(\begin{array}{cccc}01& 02& 03& 01\\ 01& 01& 03& 02\\ 02& 01& 01& 03\\ 03& 02& 01& 01\end{array}\right)\·\left(\begin{array}{c}{y}_1\\ y_2\\ y_3\\ y_4\end{array}\right),$

y ₁, y ₂, y ₃, y ₄Be GF (2 ⁸) in element;

Element in the matrix is GF (2 ⁸) in the hexadecimal representation of element;

S ₀, S ₁, S ₂, S ₃Be four different functions, the S box of expression 8 * 8; S ₀Adopt the S box of the block cipher of supporting encryption and decryption computing; S ₁, S ₂, S ₃By S ₀Generate, the generation method is as follows:

3. method as claimed in claim 2 is characterized in that, described S ₀Value be the S box of supporting block cipher.

4. method as claimed in claim 2 is characterized in that, described S ₀Value be self-defined S box.

5. the method for claim 1 is characterized in that, the value of Φ is following 4 constants:

Φ ₀＝3C2D240E

Φ ₁＝E4BB73F6

Φ ₂＝B40B34CD

Φ ₃＝6C9D6334。

6. require 1 described method as claim, it is characterized in that, described to take turns several spans be 4～20.