CN105656619A - AES (Advanced Encryption Standard) encryption method and power attack resisting method based on the same - Google Patents

Abstract

The invention discloses an AES (Advanced Encryption Standard) encryption method and a power attack resisting method based on the same; the AES encryption method comprises the following steps: grouping clear data; carrying out XOR operation on an input and an expanded secret key of a round function; carrying out data replacement with an S box having an 8-bit input and a 32-bit output; shifting 32-bit data output by the S box; carrying out the XOR operation correspondingly on the 32-bit data output by row shifting operation; carrying out the XOR operation on the expanded secret key; carrying out the data replacement with the S box having the 8-bit input and the 8-bit output; carrying out the XOR operation with the expanded secret key; and outputting encrypted data. The invention has the following advantages: the operations needed by each of the steps in the encryption method only have table look-up, shifting and XOR, so the logic implementation is relatively simple and efficient; and the power attack resisting method has mixcolumn, so the power attack resisting effect is good.

Description

A kind of AES encryption method and based on and anti-power consumption attack method

Technical field

The present invention relates to field of information security technology, be specifically related to a kind of AES encryption method and based on and anti-power consumption attack method.

Background technology

Along with informationalized development, information security issue is also more and more important, people propose various different cryptographic algorithm in this process, in the cryptographic algorithm that this is various, AES (AdvancedEncryptionStandard, Advanced Encryption Standard) widely the whole world used and become an international symmetric encipherment algorithm, the advantages such as the time is short, highly sensitive, request memory is low are set up with its key, it is widely used in information security field, such as ecommerce and communication encryption etc.

Along with aes algorithm is carried out the analysis of various different levels by people, occur in that a lot of attack to aes algorithm cracks mode, in numerous attack patterns, power consumption attack performs the relation between power consumption by analyzing cryptographic algorithm, to use this algorithm crypto chip within key carry out mathematical analysis analysis, such as simple power consumption analysis (SPA) and differential power consumption analysis (DPA) etc., and finally obtain key, thus the safety of crypto chip is caused very big threat.

In the realization of tradition AES encryption algorithm, main arithmetic operation can be divided into " conversion of S box, line translation, row are obscured and the XOR of expanded keys " these four steps, and a lot of scholars propose the defence policies of the anti-power consumption attack of various difference on this basis. The present invention is directed to the AES implementation of a kind of improvement, this implementation simplifies AES and realizes row operation of confusion complicated in process, and in conjunction with a kind of method that this implementation proposes anti-power consumption attack, this method is based on the Hamming weight model theory of power consumption, balance power consumption is carried out by the complementary operation in algorithm level, make the power consumption information of computing on chip be hidden, and reach the purpose of anti-power consumption attack.

Existing for AES-128, what Fig. 1 illustrated AES-128 algorithm realizes process, realize in process at this, using byte as basic operation unit, it is necessary to " conversion of S box, line translation, row are obscured and the XOR of expanded keys " is operated 10 times as a round function circulation.Wherein, all of mathematical operation is both for the computing on G (2^8) territory.

Realize for this AES encryption, there has been proposed various anti-power consumption attack method, common are and intermediate data is carried out mask (masking) operation, the intermediate data that this method produces with cryptographic calculation by using random mask carries out certain associative operation, makes intermediate data randomization; Or use power-consumption balance circuit so that computing power consumption keeps balance and unrelated with the data processed; Also there is the method by inserting random delay, make the time point that cryptographic operation performs uncertain.

A kind of implementation of improving of AES encryption can pass through to simplify the FOUR EASY STEPS of round function so that does not have the row of complexity to obscure operation in ciphering process. This implementation only needs four look-up tables, often takes turns four XORs of each column, and stores the additional storage space of these data.

But the method for anti-power consumption attack is primarily directed to what traditional AES implementation designed on existing AES, lacks of and this obscure without row, and more efficient encryption realizes the anti-power consumption attack strategy of process.

Summary of the invention

It is contemplated that at least solve one of above-mentioned technical problem.

For this, first purpose of the present invention is in that to propose a kind of AES encryption method.

Second purpose of the present invention is in that to propose a kind of anti-power consumption attack method based on AES encryption method.

To achieve these goals, embodiment of the invention discloses that a kind of AES encryption method, comprise the steps: S1: clear data is grouped; S200: loop initialization number of times is 0; S201: the key of the input of round function with extension is carried out xor operation; S202: use the input of N position, the S box of M position output carries out data replacement, and wherein, N and M is natural number, M > N and M is evenly divisible by N; S203: shifted by the M-bit data of described S box output, obtains the data that packet rectangular array obscures row of operation; S204: the M-bit data of row shifting function output being carried out xor operation accordingly, obtains the output valve of a round function, cycle-index adds 1; S205: judge whether current cycle time reaches preset times, reaches preset times without current cycle time and then enters step S3, otherwise returns step S201; S3: expanded keys is carried out XOR; S4: use N position input, P position output S box carry out data replacement, wherein, P be natural number and P evenly divisible by N; S5: carry out XOR with expanded keys; S6: output ciphertext data.

AES encryption method according to embodiments of the present invention, the main required operation of each operation is only tabled look-up, is shifted and XOR, and this is relatively simple and efficient in logic realization.

It addition, AES encryption method according to the above embodiment of the present invention, it is also possible to there is following additional technical characteristic:

Further, N to be 8, M be 32 and P be 8.

To achieve these goals, embodiment of the invention discloses that a kind of anti-power consumption attack method based on AES encryption method, comprise the following steps: SA: obtain clear data; SB: described clear data is encrypted by the AES encryption method described in claim 1 or 2, the process that described clear data is encrypted introduces a complementary operation so that the power consumption that produces of the power consumption that produces of cryptographic operation and described complementary operation and for an approximate constant, described complementary operation includes carrying out XOR with expanded keys counter, anti-S box data are replaced, the line displacement of anti-data and with or computing;SC: output ciphertext.

The additional aspect of the present invention and advantage will part provide in the following description, and part will become apparent from the description below, or is recognized by the practice of the present invention.

Accompanying drawing explanation

Above-mentioned and/or the additional aspect of the present invention and advantage are from conjunction with will be apparent from easy to understand the accompanying drawings below description to embodiment, wherein:

Fig. 1 is the AES-128 of the correlation technique flow chart realizing process;

Fig. 2 is the flow chart of the AES encryption method of one embodiment of the invention;

Fig. 3 be one embodiment of the invention AES encryption method in the data Transformation Graphs of part operation;

The anti-power consumption attack based on the anti-power consumption attack method of AES encryption method that Fig. 4 is one embodiment of the invention realizes block diagram.

Detailed description of the invention

Being described below in detail embodiments of the invention, the example of described embodiment is shown in the drawings, and wherein same or similar label represents same or similar element or has the element of same or like function from start to finish. The embodiment described below with reference to accompanying drawing is illustrative of, and is only used for explaining the present invention, and is not considered as limiting the invention.

In describing the invention, it will be appreciated that, term " " center ", " longitudinal direction ", " transverse direction ", " on ", D score, " front ", " afterwards ", " left side ", " right side ", " vertically ", " level ", " top ", " end ", " interior ", orientation or the position relationship of the instruction such as " outward " are based on orientation shown in the drawings or position relationship, it is for only for ease of the description present invention and simplifies description, rather than the device of instruction or hint indication or element must have specific orientation, with specific azimuth configuration and operation, therefore it is not considered as limiting the invention. additionally, term " first ", " second " are only for descriptive purposes, and it is not intended that indicate or hint relative importance.

In describing the invention, it is necessary to explanation, unless otherwise clearly defined and limited, term " installation ", " being connected ", " connection " should be interpreted broadly, for instance, it is possible to it is fixing connection, it is also possible to be removably connect, or connect integratedly; Can be mechanically connected, it is also possible to be electrical connection; Can be joined directly together, it is also possible to be indirectly connected to by intermediary, it is possible to be the connection of two element internals. For the ordinary skill in the art, it is possible to concrete condition understands above-mentioned term concrete meaning in the present invention.

With reference to as explained below and accompanying drawing, it will be clear that these and other aspects of embodiments of the invention. Describe at these and in accompanying drawing, specifically disclose some particular implementation in embodiments of the invention, representing some modes of the principle implementing embodiments of the invention, but it is to be understood that the scope of embodiments of the invention is not limited. On the contrary, all changes within the scope of embodiments of the invention include falling into attached claims spirit and intension, amendment and equivalent.

Below in conjunction with accompanying drawing, AES encryption method according to embodiments of the present invention is described.

Fig. 1 is the flow chart of the AES encryption method of one embodiment of the invention. Refer to Fig. 1, a kind of AES encryption method, comprise the following steps:

S1: clear data is grouped.

S200: loop initialization number of times is 0.

S201: the key of the input of round function with extension is carried out xor operation. Realizing of this step and original AES is just the same, the key of the input of round function with extension is performed mould 2 add operation, shows as xor operation in logic.

S202: use the input of N position, the S box of M position output carries out data replacement, and wherein, N and M is natural number, M > N and M is evenly divisible by N. In an example of the present invention, N is 8, M is 32, and namely by using one 8 inputs, the improvement S boxes of 32 outputs perform byte replacement. These 32 outputs are on 8 output data bases of S box conversion in original AES encryption process, pre-set and obtain.

S203: the M-bit data exported by S box is shifted, obtains being grouped in original aes algorithm the data of the row that rectangular array obscures operation.

S204: the M-bit data of row shifting function output being carried out xor operation accordingly, obtains the output valve of a round function, cycle-index adds 1. Specifically, 32 bit data that row shifting function is exported carry out mould 2 accordingly and add (XOR), finally give the output valve of a round function.

S205: judge whether current cycle time reaches preset times, reaches preset times without current cycle time and then enters step S3, otherwise returns step S201.

S3: expanded keys is carried out XOR.

S4: use N position input, P position output S box carry out data replacement, wherein, P be natural number and P evenly divisible by N. Wherein, P is 8.

S5: carry out XOR with expanded keys.

S6: output ciphertext data.

AES encryption method according to embodiments of the present invention, the main required operation of each operation is only tabled look-up, is shifted and XOR, this is relatively simple and efficient in logic realization, is a difference in that " conversion of the S box of improvement, row displacement, 32 bit data XORs " these three operation with traditional algorithm realizes.

Fig. 3 be one embodiment of the invention AES encryption method in the data Transformation Graphs of part operation, in an example of the present invention, in Fig. 3, each Sxx all represents a byte data, coefficient before byte data represents the multiplying (being multiplied by this coefficient) on G (2^8) finite field, "+" is addition (the being XOR in logic) computing on G (2^8) finite field, { a, b, c, d} represents a, 32 bit data that these four byte datas of b, c, d are spliced into.

Below with reference to accompanying drawing, a kind of anti-power consumption attack method based on AES encryption method according to embodiments of the present invention is described.

Refer to Fig. 4, a kind of anti-power consumption attack method based on AES encryption method, comprise the following steps:

SA: obtain clear data.

SB: described clear data is encrypted by above-mentioned AES encryption method, the process that described clear data is encrypted introduces a complementary operation so that the power consumption that produces of the power consumption that produces of cryptographic operation and described complementary operation and be a constant, described complementary operation includes carrying out XOR with expanded keys counter, anti-S box data are replaced, the line displacement of anti-data and with or computing.

Specifically, in the AES encryption method of above-described embodiment, along with the difference of input data, calculating process produces the Hamming weight of intermediate data and has very big difference, by Hamming weight model it can be seen that corresponding computing power consumption difference also can be clearly. Typical power consumption attack method (such as DPA), the power consumption profile produced when being by catching different conjecture key, utilize the difference producing power consumption in the process of computing difference intermediate data to be achieved. For the realization of this improvement aes algorithm proposed above, by being simultaneously introduced a complementary operation in cryptographic calculation execution process.

Supposing in ciphering process that certain operation can be considered function F (x), the Hamming weight of generation is HW (F (x)), and corresponding power consumption is:

P��kHW(F(x))+d

Meanwhile, complementary operation carries out F ' (x) computing, the Hamming weight of generation be HW (F ' (x)) and F ' approximate with the mode of operation that F does (namely following formula k is identical), corresponding power consumption is:

P���kHW(F��(x))+d

The whole hardware power consumption of this process is L=L1+L ', as long as so ensureing:

HW (F (x))+HW (F ' (x))=C

Allow for complementary operation and normal cryptographic operation, the power consumption sum approximately constant of the generation of both, and unrelated with the intermediate data numerical value that cryptographic calculation produces, this just conceals the power consumption in calculating process and data message and realizes the purpose of anti-power consumption attack.

In the complementary operation of balance power consumption, the concrete computing that needs to introduce is: carry out XOR with expanded keys counter, anti-S box byte is replaced, the row displacement of anti-data and with or computing.

Complementary operation one: counter with expanded keys carries out XOR. Expanded keys xor operation simultaneously, performs complementary operation " counter with expanded keys carries out XOR ", and the output of the two is anti-data each other, then the Hamming weight sum of the two by constant be a constant, be achieved in power consumption approximate equilibrium.

Data x and key carry out XOR:

F1 (x)=x k1

Complementary operation:

$F{1}^{,}\left(x\right)=x\⊕\stackrel{\‾}{k1}$

Can ensure

HW (F1 (x)) HW (F1 ' (x))=C1

Wherein, k1 is expanded keys, and C1 is constant.

Complementary operation two: anti-S box byte is replaced. In the AES encryption method of above-described embodiment, it is 32 outputs of 8 inputs that the S box of improvement is replaced, and this process realizes often through a matrix look-up table, and transforming function transformation function is designated as F2 (x), then:

F2 (x)={ x ', x ', 3x ', 2x ' }

Take complementary operation to make it export to be the anti-of normal encryption output:

$F{2}^{\′}\left(x\right)=\{\stackrel{\‾}{x^{\′}},\stackrel{\‾}{x^{\′}},\stackrel{\‾}{3x^{\′}},\stackrel{\‾}{2x^{\′}}\}$

Wherein, x ' represents the byte output that traditional byte input obtains through the conversion of S box. " { } " splicing of representative data, so can guarantee that equally:

HW (F2 (x))+HW (F2 ' (x))=C2

Achieve Hamming weight thus equally constant, corresponding total power consumption approximately constant, and unrelated with the intermediate value adding ciphertext data.

Complementary operation three: the row displacement of anti-data. In the process performing row displacement, due in the output of upper level operation, except a normal output, also has the output of anti-data, thus, being simultaneously introduced operation bidirectional what data row was shifted, namely its anti-data perform identical row displacement, the power consumption sum of the two also achieves balance under the model of Hamming weight.

Complementary operation four: same or computing. In the AES encryption method of above-described embodiment, 32 bit data XORs are to carry out xor operation for 4 data, needs order performs three XORs, while performing first time XOR, complementary operation performs same or computing, it is identical that the input data of operation input data with normal cryptographic operation, and while rear twice encryption xor operation, complementary operation is also XOR, then the intermediate data and the useful encryption intermediate data that introduce operation gained are constantly in complementary relationship. Constant Hamming weight can be realized equally, still have approximate computing power consumption constant, and unrelated with intermediate data.

It addition, a kind of AES encryption method of the embodiment of the present invention and based on and anti-power consumption attack method other constitute and effect be all known for a person skilled in the art, in order to reduce redundancy, do not repeat.

In the description of this specification, specific features, structure, material or feature that the description of reference term " embodiment ", " some embodiments ", " example ", " concrete example " or " some examples " etc. means in conjunction with this embodiment or example describe are contained at least one embodiment or the example of the present invention. In this manual, the schematic representation of above-mentioned term is not necessarily referring to identical embodiment or example. And, the specific features of description, structure, material or feature can combine in an appropriate manner in any one or more embodiments or example.

Although an embodiment of the present invention has been shown and described, it will be understood by those skilled in the art that: these embodiments can being carried out multiple change, amendment, replacement and modification when without departing from principles of the invention and objective, the scope of the present invention is by claim and equivalency thereof.

Claims (3)

1. an AES encryption method, it is characterised in that comprise the steps:

S1: clear data is grouped;

S200: loop initialization number of times is 0;

S201: the key of the input of round function with extension is carried out xor operation;

S202: use the input of N position, the S box of M position output carries out data replacement, and wherein, N and M is natural number, M > N and M is evenly divisible by N;

S203: shifted by the M-bit data of described S box output, obtains the data that packet rectangular array obscures row of operation;

S204: the M-bit data of row shifting function output being carried out xor operation accordingly, obtains the output valve of a round function, cycle-index adds 1;

S205: judge whether current cycle time reaches preset times, reaches preset times without current cycle time and then enters step S3, otherwise returns step S201;

S3: expanded keys is carried out XOR;

S4: use N position input, P position output S box carry out data replacement, wherein, P be natural number and P evenly divisible by N;

S5: carry out XOR with expanded keys;

S6: output ciphertext data.

2. AES encryption method according to claim 1, it is characterised in that N is 8, M be 32 and P be 8.

3. the anti-power consumption attack method based on AES encryption method, it is characterised in that comprise the following steps:

SA: obtain clear data;

SB: described clear data is encrypted by the AES encryption method described in claim 1 or 2, the process that described clear data is encrypted introduces a complementary operation so that the power consumption that produces of the power consumption that produces of cryptographic operation and described complementary operation and be approximately a constant, described complementary operation includes carrying out XOR with expanded keys counter, anti-S box data are replaced, the line displacement of anti-data and with or computing;

SC: output ciphertext.