CN110784307A

CN110784307A - Lightweight cryptographic algorithm SCENERY implementation method, device and storage medium

Info

Publication number: CN110784307A
Application number: CN201911070142.4A
Authority: CN
Inventors: 李浪; 冯景亚
Original assignee: Hengyang Normal University
Current assignee: Hengyang Normal University
Priority date: 2019-11-05
Filing date: 2019-11-05
Publication date: 2020-02-11
Anticipated expiration: 2039-11-05
Also published as: CN110784307B

Abstract

The invention discloses a method, a device and a storage medium for realizing a lightweight cryptographic algorithm SCENERY, wherein the method comprises the steps of obtaining a plaintext to be encrypted, and sequentially carrying out IP1 initial replacement, round function, key expansion and IP2 replacement, wherein the round function comprises the steps of sequentially carrying out round key addition operation, S box replacement and M matrix replacement on data, and the key expansion comprises the steps of sequentially carrying out S box replacement, circular left shift, round constant addition operation and DP dynamic replacement on a key. The round function adopts an F function with an SPN structure, and a binary matrix M is constructed with the aim of realizing high dependency when an F function linear layer is designed; the key expansion selects a round constant and a key expansion intermediate result as control signals, DP dynamic replacement is carried out on the current round key expansion intermediate result to obtain a round key, and the new key expansion mode is a new key expansion mode, so that the relevance of single key iteration to front-wheel input is reduced, the decoding difficulty is increased, the safety is improved, and differential attack, linear attack and algebraic attack can be particularly effectively resisted.

Description

Lightweight cryptographic algorithm SCENERY implementation method, device and storage medium

Technical Field

The invention relates to the field of computer encryption, in particular to a lightweight cryptographic algorithm SCENERY implementation method, a device and a storage medium.

Background

In recent years, small embedded devices (e.g., wireless sensors, smart cards, radio frequency tags) have been widely used in many fields. These devices often have significant cost limitations such as area, power, energy consumption in hardware, etc. Because traditional cryptographic algorithms such as AES are not suitable for such extremely limited devices, lightweight block cipher algorithms adapted to resource constrained environments have attracted high attention from broad scholars.

Since 2007, several papers on lightweight block cipher algorithm were proposed in the international academia. There are some lightweight block cipher algorithms, typically represented by PRESETNT, twin, Piccolo, LED, LBlock, RECTANGLE, KLEIN, etc.

The current lightweight algorithm has the following problems:

1) some lightweight block cipher algorithms have complex decryption processes, and when decryption is realized, modules in the encryption process cannot be completely reused, so that extra resources are consumed; some encryption algorithms still occupy large resources, have low encryption performance and are not convenient to realize in equipment with limited resources;

2) the lightweight block cipher algorithm has the problem of low security. In order to seek smaller implementation resource area for some light-weight block cipher algorithms at present, the encryption process of the algorithms is simple in design, and meanwhile, the key expansion mode is simplified or even not expanded, so that the algorithms designed by the method have potential safety hazards. Many recent studies have shown that some algorithms are weak against attacks, especially common differential, linear, and algebraic attacks.

Disclosure of Invention

The invention provides a method, a device and a storage medium for realizing a lightweight block cipher algorithm SCENERY, which aim to solve the problems that the lightweight block cipher algorithm in the prior art is low in encryption performance, relatively simple in key expansion operation, low in flexibility and easy to attack.

The invention provides a lightweight cryptographic algorithm SCENERY implementation method, which comprises the following steps:

step A1: acquiring 64-bit plaintext as data P to be encrypted, and performing encryption operation;

the data P to be encrypted is sequentially ordered from high to low bits by 16 bits to form a4 × 16 data matrix, which is denoted as P ₀P ₁P ₂P ₃；

Step A2: carrying out IP1 initial replacement on the data P in the step A1, and determining a round number Nr according to the number of key bits, wherein the initial value of a round number control signal is 1; when the number of key bits is 64 bits, the number of rounds is 28;

step A3: the operation result of the step A2 is divided into two parts, namely a 4X 8 matrix data block L _r、R _r；

Where r represents the current round number, data block L _rThe data block R is obtained by arranging the first 8 bits of each line of the operation result of the step A2 from high bit to low bit _rThe last 8 bits of each row of the operation result of the step A2 are sequentially arranged from high bit to low bit;

step A4: the 32-bit data block L in the step A3 _rAnd R _rF round function operation is carried out according to a Feistel structure, and each round of F round function operation comprises the following steps:

a) to R _rPerforming round key addition operation;

b) performing S-box replacement on the operation result obtained in the step a);

c) performing M matrix permutation on the operation result obtained in the step b);

d) combining the result obtained in c) with L _rPerforming XOR operation and taking the XOR result as the R participating in F round function operation in the next round _r(ii) a Input data block R for simultaneously participating current round in F round function operation _rL participating in F-round function operations as the next round _r；

Step A5: and performing next round of key expansion operation according to the current round of keys and the round number control signal, wherein the operation comprises the following steps:

e) performing S box replacement on the current round key, wherein the S box used in the S box replacement is the same as the S box in F round function operation;

f) circularly shifting the operation result obtained by the step e) by x bits left;

g) performing round constant addition operation on the operation result obtained in the step f);

h) performing DP dynamic replacement on the result in the step g), and taking the obtained result as a round key of the next round;

in the F round function operation process, the round key used in the first round of operation is the first 32 bits of data of the initial key, and the first 32 bits of data of the round key obtained in the previous round of key expansion operation are sequentially obtained from the second round; the DP dynamic replacement is to dynamically replace the result of the step g) by taking the current round number r and the result of the step g) as control signals;

step A6: judging whether the current round number signal r is smaller than the round number Nr, if so, making r equal to r +1, taking the results of the steps A4 and A5 as input data of a new round of operation, and returning to the step A4; otherwise, for the next round L obtained in step A4 d) _r、R _rIP2 substitution is performed and then the encryption result is output.

The algorithm structure is highly symmetrical, the encryption module can be reused in algorithm decryption, decryption can be carried out by exchanging the use sequence of the encryption round keys, the operation is simple and convenient, additional resources are not consumed in decryption, and the encryption algorithm module has similar symmetrical components, so that the encryption algorithm module can be mutually multiplexed in the implementation process, and the purpose of reducing the implementation resources is achieved. The round operation adopts an F function with an SPN structure, and the transformation process is round key addition → S box replacement → M matrix replacement; and the S box permutation and the M matrix permutation are realized by using a bit-slice technology so as to improve the encryption efficiency of the algorithm. Meanwhile, a new key expansion mode is provided for the algorithm, a round constant r and a key expansion intermediate result are selected as control signals, DP dynamic replacement is carried out on the current round key expansion intermediate result to obtain a round key, the relevance of single key iteration to front wheel input is reduced, the decoding difficulty is increased, and the safety of the algorithm is improved. Therefore, the method has the advantages of low resource, high performance and high safety.

Further, the IP1 initial replacement process in the step a2 is as follows:

a4 × 16 data matrix P is formed into a4 × 4 matrix with 4 bits per row as a small unit, and the 4 × 4 matrix is expressed as { P ₀₀,P ₀₁,P ₀₂,P ₀₃,P ₁₀,P ₁₁,P ₁₂,P ₁₃,P ₂₀,P ₂₁,P ₂₂,P ₂₃,P ₃₀,P ₃₁,P ₃₂,P ₃₃}；

The 4 × 4 matrix is expressed by { P ₀₀,P ₁₂,P ₃₃,P ₂₁,P ₁₁,P ₀₃,P ₂₂,P ₃₀,P ₂₃,P ₃₁,P ₁₀,P ₀₂,P ₃₂,P ₂₀,P ₀₁,P ₁₃And sequentially outputting to obtain data P' after initial replacement by IP 1.

Specifically, let 4 × 4 matrix N be { P ═ P ₀₀,P ₀₁,P ₀₂,P ₀₃,P ₁₀,P ₁₁,P ₁₂,P ₁₃,P ₂₀,P ₂₁,P ₂₂,P ₂₃,P ₃₀,P ₃₁,P ₃₂,P ₃₃}; dividing the matrix N into 4 matrices N of 2 × 2 in sequence ₀、N ₁、N ₂、N ₃；N ₀＝{P ₀₀,P ₀₁,P ₁₀,P ₁₁}，N ₁＝{P ₀₂,P ₀₃,P ₁₂,P ₁₃}，N ₂＝{P ₂₀,P ₂₁,P ₃₀,P ₃₁}，N ₃＝{P ₂₂,P ₂₃,P ₃₂,P ₃₃}；

Respectively taking N ₀、N ₃Diagonal line (P) of ₀₀,P ₁₁) And (P) ₂₃,P ₃₂) The first column of data constituting the IP1 permutation, i.e. (P) ₀₀,P ₁₁,P ₂₃,P ₃₂) ^T；

Respectively taking N ₁、N ₂Diagonal line (P) of ₁₂,P ₀₃) And (P) ₃₁,P ₂₀) Second column data constituting a permutation of IP1, i.e. (P) ₁₂,P ₀₃,P ₃₁,P ₂₀) ^T；

Respectively taking N ₃、N ₀Diagonal line (P) of ₃₃,P ₂₂) And (P) ₁₀,P ₀₁) The third column of data constituting the IP1 permutation, i.e. (P) ₃₃,P ₂₂,P ₁₀,P ₀₁) ^T；

Respectively taking N ₂、N ₁Diagonal line (P) of ₂₁,P ₃₀) And (P) ₀₂,P ₁₃) The fourth column of data constituting the IP1 permutation, i.e. (P) ₂₁,P ₃₀,P ₀₂,P ₁₃) ^T。

From the above, it can be seen that each column of data after the initial replacement of IP1 is: (P) ₀₀,P ₁₁,P ₂₃,P ₃₂) ^T、(P ₁₂,P ₀₃,P ₃₁,P ₂₀) ^T、(P ₃₃,P ₂₂,P ₁₀,P ₀₁) ^T、(P ₂₁,P ₃₀,P ₀₂,P ₁₃) ^T；

The IP1 initial replacement structure is novel in design, so that algorithm data replacement has a good effect, and only hardware connection is needed for implementation, and resources do not need to be consumed.

Further, the operation result of step A2 is divided into 4 × 8 matrix data blocks L in the step A3 _r、R _rThe division process is as follows:

dividing the first 8 bits of the 4 × 16 matrix, which is the operation result of step A2, into L _rThe first row of the data block, the last 8 bits are divided into R _rThe first row, the second, the third and the fourth rows of the data block are analogized in turn to obtain a4 multiplied by 8 matrix L _r、R _rAs follows:

further, the keys are sequentially ordered from the upper bit to the lower bit by 16 bits to form a4 × 16 matrix, which is denoted as K ═ K ₀K ₁K ₂K ₃；

To R _rPerforming round key addition operation, specifically, adding the data block R _rThe 32 bits from high bit to low bit and the front 32 bits of the round key, namely K ₀、K ₁Exclusive OR operation is carried out to obtain R' _r。

Performing S-box replacement on the operation result obtained in the step a), specifically: S-Box referenced to the algorithm-encrypted S-box of RECTANGLE, {6,5, C, A,1, E,7,9, B,0,3, D,8, F,4,2}, with the substitution of S-boxes applied to R' _rEach column of the matrix is given R ″ _r。

Performing M matrix permutation on the operation result obtained in the step b), specifically: the resulting R ″) _rPerforming M matrix permutation according to the following formula to obtain R ″) _r：

R′″ _r＝R″ _rM；

The M matrix permutation is implemented by using a 32 × 32 binary matrix M with a branch number of 4, where the matrix M is expressed as:

wherein M is ₀And M ₁Is a 16 × 16 binary matrix, and M ₀And M ₁The number of branches being 4, i.e. M ₀And M ₁The number of 1 in each row and each column is 3;

matrix M ₀A matrix M of the first 16 bits for permuting the result of the operation obtained in b) ₁For replacing the last 16 bits of the result of the operation obtained in b).

The design of the M matrix in the algorithm can be realized by using a bit-slice technology, and the specific realization formula is as follows:

further, the key expansion operation in step a5 specifically includes the following steps:

an initial key having a length of 64 bits is arranged in order from the upper to the lower bits to form a4 × 16 key matrix, which is denoted as K ═ K ₀K ₁K ₂K ₃，

K ₀＝{k ₆₃,k ₆₂,……,k ₄₉,k ₄₈}，K ₁＝{k ₄₇,k ₄₆,……,k ₃₃,k ₃₂}，

K ₂＝{k ₃₁,k ₃₀,……,k ₁₇,k ₁₆}，K ₃＝{k ₁₅,k ₁₄,……,k ₁,k ₀}；

e) To K ₀Low 4 bits (k) ₅₁,k ₅₀,k ₄₉,k ₄₈) And K ₁Low 4 bits (k) ₃₅,k ₃₄,k ₃₃,k ₃₂) Alternately forming two 4-bit data (k) ₅₁,k ₃₅,k ₅₀,k ₃₄) And (k) ₄₉,k ₃₃,k ₄₈,k ₃₂) And performing S-box replacement respectively, wherein the S-box used in the S-box replacement is the same as the S-box in F-round function operation;

f) circularly left shifting the operation result of e) by 11 bits;

g) performing round constant addition operation on the first 16 bits from the high bit to the low bit of the f) operation result, specifically, performing exclusive or operation on the round constant by taking the current round number r and the low 5 bits from the high bit to the low bit of the first 16 bits from the high bit to the low bit of the f) operation result bit by bit;

h) and performing DP dynamic replacement on the operation result of the g), and using the obtained result as a round key of the next round.

Further, the performing DP dynamic replacement on the result in g) specifically includes:

dividing the current wheel number r by 4 to obtain m 'of the row data K' of the operation result matrix K 'of g) by taking m as a remainder, wherein m is more than or equal to 0 and less than or equal to 3' _mCorresponding { k' _61-m*16,k′ _60-m*16},{k′ _57-m*16,k′ _56-m*16},{k′ _53-m*16,k′ _52-m*16},{k′ _49-m*16,k′ _48-m*16And its corresponding value is defined as v in turn ₀，v ₁，v ₂，v ₃，0≤v ₀，v ₁，v ₂，v ₃3 or less, namely:

v ₀＝{k′ _61-m*16,k′ _60-m*16}；

v ₁＝{k′ _57-m*16,k′ _56-m*16}；

v ₂＝{k′ _53-m*16,k′ _52-m*16}；

v ₃＝{k′ _49-m*16,k′ _48-m*16}；

prepared from K' ₀、K′ ₁、K′ ₂、K′ ₃The division is performed with 4 bits as a unit to form a4 × 4 matrix as follows:

v0, v1, v2 and v3 values are sequentially expressed as a matrix K 'of 4 multiplied by 4' ₀、K′ ₁、K′ ₂、K′ ₃For example, v0 ═ 1, represents the first element in line 0, i.e., K' ₀₁(ii) a Therefore, the values corresponding to the v0, v1, v2 and v3 positions are K 'in sequence' _0v0、K′ _1v1、K′ _2v2、K′ _3v3；

By one sequential permutation, { K' _0v0、K′ _1v1、K′ _2v2、K′ _3v3Replacement by { K' _2v2、K′ _3v3、K′ _0v0、K′ _1v1And fourthly, obtaining a result which is the expanded round key.

Further, the IP2 replacement in the step a6 includes:

using the next round L obtained in step A4 d) _r、R _rConstructing a4 × 16 matrix of L _rAssigns R to the eight upper bits of the corresponding row of the matrix _rAssigning each row of data to the lower 8 bits of the corresponding row of the matrix;

then interchanging the high 8 bits and the low 8 bits of each row of the 4 x 16 matrix;

finally, the 4 × 16 matrix after interchange is subjected to IP1 inverse initial permutation.

The design of the IP2 permutation can ensure the high symmetry of the algorithm, specifically, the IP2 permutation is exchanged according to 4 bits as a unit, and the input is expressed as { P ₀₀,P ₀₁,P ₀₂,P ₀₃,P ₁₀,P ₁₁,P ₁₂,P ₁₃,P ₂₀,P ₂₁,P ₂₂,P ₂₃,P ₃₀,P ₃₁,P ₃₂,P ₃₃Via IP2 permutation exchange, data exchange with{P ₀₂,P ₃₀,P ₂₁,P ₁₃,P ₂₀,P ₁₂,P ₀₃,P ₃₁,P ₃₃,P ₀₁,P ₁₀,P ₂₂,P ₁₁,P ₂₃,P ₃₂,P ₀₀And (5) outputting in sequence.

Further, a decryption process is included, the decryption process including the steps of:

step B1: acquiring 64-bit ciphertext as data C to be decrypted, and performing decryption operation;

the data C to be decrypted is sequentially ordered from high order to low order by 16 bits to form a4 × 16 data matrix, which is denoted as C ═ C ₀C ₁C ₂C ₃；

Step B2: carrying out IP1 initial replacement on the data C to be decrypted, which is described in the step B1, and determining the round number Nr according to the number of bits of the key, wherein the initial value of the round number control signal is 1;

step B3: the operation result of step B2 is divided into two parts, namely a 4X 8 matrix data block L _r、R _r；

Where r represents the current round number, data block L _rThe data block R is obtained by arranging the first 8 bits of each line of the operation result of the step B2 from high bit to low bit _rThe last 8 bits of each row of the operation result of the step B2 are sequentially arranged from high bit to low bit;

step B4: the 32-bit data block L in the step B3 _rAnd R _rF round function operation is carried out according to a Feistel structure, and each round of F round function operation comprises the following steps:

i) performing round key addition operation on the R;

j) carrying out S box replacement on the operation result obtained in the step i);

k) performing M matrix permutation on the operation result obtained by the j);

l) combining the result obtained in k) with L _rPerforming XOR operation and taking the XOR result as the R participating in F round function operation in the next round _r(ii) a Input data block R for simultaneously participating current round in F round function operation _rL participating in F-round function operations as the next round _r；

The round keys in each round of F-round function operation are multiplexed with the round keys in the encryption process, and the use sequence of the round keys in the decryption process is opposite to that of the round keys in the encryption process;

step B5: judging whether the current round number signal r is smaller than the round number Nr, if so, making r equal to r +1, taking the results of the steps B4 and B5 as input data of a new round of operation, and returning to the step B4; otherwise, for the next round L obtained in step B4 _r、R _rIP2 substitution is performed and then the decryption result is output.

In a second aspect of the present invention, an apparatus for implementing a lightweight cryptographic algorithm SCENERY is provided, including:

an initialization unit: the encryption device is used for acquiring 64-bit plaintext as data P to be encrypted and carrying out encryption operation;

IP1 substitution unit: the encryption device is used for carrying out IP1 replacement on data P to be encrypted, determining a round number Nr according to the number of bits of a key, and setting an initial value of a round number control signal to be 1;

f round function processing unit: for dividing the data after IP1 permutation into left and right two parts, namely 4X 8 matrix data block L _r、R _r；

Where r represents the current round number, data block L _rThe data block R is obtained by arranging the first 8 bits of each line of the operation result of the IP1 permutation unit from high order to low order _rThe last 8 bits of each row of the operation result of the IP1 replacement unit are sequentially arranged from high order to low order;

then the data block L _rAnd R _rF round function operation is carried out according to a Feistel structure, and each round of F round function operation comprises the following steps:

a) to R _rPerforming round key addition operation;

d) combining the result obtained in c) with L _rPerforming XOR operation and taking the XOR result as the R participating in F round function operation in the next round _r(ii) a Input data block R for simultaneously participating current round in F round function operation _rParticipating F-round functions as the next roundCalculated L _r；

Round key expansion unit: the method is used for performing next round of key expansion operation according to the current round of keys and the round number control signal, and comprises the following steps:

e) performing S box replacement on the current round key, wherein the S box used in the S box replacement is the same as the S box used by the F round function processing unit;

a ciphertext generation unit: the round key expansion unit is used for judging whether the current round number signal r is less than the round number Nr or not, if so, making r equal to r +1, taking results of the F round function processing unit and the round key expansion unit as input data of a new round of operation, and returning to an F round function process of the F round function processing unit and a round key expansion process of the round key expansion unit; otherwise, the last result of the round function processing unit is subjected to IP2 substitution, and then an encryption result is output.

In a third aspect of the present invention, a computer-readable storage medium is provided, which includes a stored program, and the program is adapted to be loaded by a processor and execute the above-mentioned lightweight cryptographic algorithm SCENERY implementation method.

Advantageous effects

The invention provides a method, a device and a storage medium for realizing a lightweight cryptographic algorithm SCENERY, the algorithm has highly symmetrical structure, the algorithm decrypts and multiplexes an encryption module, and exchanges the use sequence of encryption round keys, so that decryption can be carried out, the operation is simple and convenient, no extra resource is consumed for realizing decryption, and the cryptographic algorithm modules have similar symmetrical components, so that the cryptographic algorithm modules can be mutually multiplexed during realization, and the purpose of reducing the realization resources is achieved. The initial replacement structure of the algorithm is novel in design, so that the algorithm data replacement has a good effect, only hardware connection is needed for realization, and resources do not need to be consumed. The round operation adopts an F function with an SPN structure, and the transformation process is round key addition → S box replacement → M matrix replacement; and the S box permutation and the M matrix permutation are realized by using a bit-slice technology so as to improve the encryption efficiency of the algorithm. Meanwhile, a new key expansion mode is provided for the algorithm, a round constant r and a key expansion intermediate result are selected as control signals, DP dynamic replacement is carried out on the current round key expansion intermediate result to obtain a round key, the relevance of single key iteration to front wheel input is reduced, the decoding difficulty is increased, and the safety of the algorithm is improved. Therefore, the method has the advantages of low resource, high performance and high safety.

The novel safe and efficient lightweight SCENERY block cipher realization method, the device and the storage medium reflect good attack resistance in security verification, and are particularly effective in resisting differential and linear attacks and algebraic attacks compared with the prior art.

Drawings

Fig. 1 is an encryption structure diagram of a lightweight cryptographic algorithm SCENERY implementation method provided in an embodiment of the present invention;

fig. 2 is a decryption structure diagram of a lightweight cryptographic algorithm SCENERY implementation method provided in the embodiment of the present invention;

FIG. 3 is a block diagram of a round function transformation provided by an embodiment of the present invention;

FIG. 4 is a diagram of an F function structure provided by an embodiment of the present invention;

FIG. 5 is a diagram of a round key expansion structure provided by an embodiment of the present invention;

fig. 6 is a diagram of IP1 replacement process provided by an embodiment of the present invention.

Detailed Description

The present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

As shown in fig. 1, an embodiment of the present invention provides a lightweight cryptographic algorithm SCENERY implementation method, including the following steps:

step A1: acquiring 64-bit plaintext as data P to be encrypted, loading the data P to a register, and performing encryption operation;

P ₀＝{p ₆₃,p ₆₂,……,p ₄₉,p ₄₈}，P ₁＝{p ₄₇,p ₄₆,……,p ₃₃,p ₃₂}，

P ₂＝{p ₃₁,p ₃₀,……,p ₁₇,p ₁₆}，P ₃＝{p ₁₅,p ₁₄,……,p ₁,p ₀}；

Step A2: carrying out IP1 initial replacement on the data P to be encrypted, which is obtained in the step A1, to obtain P', and determining the round number Nr according to the number of bits of the key, wherein the initial value of the round number control signal is 1; in this embodiment, the key length is 64 bits, and the round number Nr is 28;

the IP1 initial replacement procedure is as follows:

In detail, the construction process is as follows:

let 4 × 4 matrix N ═ P ₀₀,P ₀₁,P ₀₂,P ₀₃,P ₁₀,P ₁₁,P ₁₂,P ₁₃,P ₂₀,P ₂₁,P ₂₂,P ₂₃,P ₃₀,P ₃₁,P ₃₂,P ₃₃}; dividing the matrix N into 4 matrices N of 2 × 2 in sequence ₀、N ₁、N ₂、N ₃；N ₀＝{P ₀₀,P ₀₁,P ₁₀,P ₁₁}，N ₁＝{P ₀₂,P ₀₃,P ₁₂,P ₁₃}，N ₂＝{P ₂₀,P ₂₁,P ₃₀,P ₃₁}，N ₃＝{P ₂₂,P ₂₃,P ₃₂,P ₃₃}; for convenience of explanation, { P } ₀₀,P ₀₁,P ₀₂,P ₀₃,P ₁₀,P ₁₁,P ₁₂,P ₁₃,P ₂₀,P ₂₁,P ₂₂,P ₂₃,P ₃₀,P ₃₁,P ₃₂,P ₃₃The expression is replaced by {0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15} as shown in fig. 6 (1).

As shown in FIG. 6(2), at N ₀And N ₃The diagonal lines a and b with directions are marked in the middle, and the diagonal direction of a is from left to right and from top to bottom, namely (0 and 5); b, the diagonal direction is from right to left, and from top to bottom, namely (11, 14); the first column of data, i.e., (0, 5, 11, 14), permuted by IP1 is formed by the diagonal lines a, b ^T；

N in FIG. 6(2) ₀Is rotated by 90 degrees in a counterclockwise direction around the center point to obtain a matrix N ₁The diagonal line c of (6, 3); n is a radical of ₃Is rotated clockwise by 90 DEG around the center point to obtain N ₂The upper diagonal d is (13, 8); the second column of data, i.e. (6, 3, 13, 8) replaced by IP1 is formed by the diagonal lines c, d ^TAs shown in fig. 6 (3);

n in FIG. 6(3) ₁Is rotated by 90 degrees counterclockwise around the center point to obtain N ₃The upper diagonal e is (15, 10); n is a radical of ₂Is rotated clockwise by 90 DEG around the center point to obtain N ₀The upper diagonal f is (4, 1); the third column of data, i.e., (15, 10, 4, 1), permuted by IP1 is formed by the diagonals e, f ^TAs shown in fig. 6 (4);

n in FIG. 6(4) ₃Is rotated by 90 DEG counterclockwise around the center point to obtain N ₂The upper diagonal g is (9, 12); n is a radical of ₀Is rotated clockwise by 90 DEG around the center point to obtain N ₁The upper diagonal line h is (2, 7); the fourth column of data, i.e., (9, 12, 2, 7), permuted by IP1 is formed by the diagonals g, h ^TAs shown in fig. 6 (5);

from the above, the data of each column initially replaced by IP1 are: (0, 5, 11, 14) ^T、(6、3、13、8) ^T、(15、10、4、1) ^T、(9、12、2、7) ^T(ii) a The IP1 initial substitution table is as follows:

0	6	15	9
				5	3	10	12
11	13	4	2
				14	8	1	7

the IP1 initial replacement structure is novel in design, a new replacement mode is provided by utilizing the characteristic of a central symmetry graph, the algorithm data replacement has a good effect, and only hardware connection is needed for realizing the replacement without consuming resources.

Step A3: the operation result of the step A2 is divided into two parts, namely a 4X 8 matrix data block L _r、R _rRespectively denoted as L _r＝L _r0L _r1L _r2L _r3R is recorded as _r＝R _r0R _r1R _r2R _r3；

Where r represents the current round number, data block L _rThe data block R is obtained by arranging the first 8 bits of each line of the operation result of the step A2 from high bit to low bit _rThe last 8 bits of each row of the operation result of the step A2 are sequentially arranged from high bit to low bit; namely:

L _r＝{P′ ₀₀,P′ ₀₁,P′ ₁₀,P′ ₁₁,P′ ₂₀,P′ ₂₁,P′ ₃₀,P′ ₃₁,}；R _r＝{P′ ₀₂,P′ ₀₃,P′ ₁₂,P′ ₁₃,P′ ₂₂,P′ ₂₃,P′ ₃₂,P′ ₃₃,}；

the dividing process is as follows:

step A4: the 32-bit data block L in the step A3 _rAnd R _rPerforming F-round function operations according to a Feistel structure, as shown in fig. 3 and 4, each F-round function operation includes:

a) to R _rRunning round keyAdding to obtain R' _r；

The keys are sequentially ordered from high to low bits by 16 bits to form a4 × 16 matrix, which is denoted as K ═ K ₀K ₁K ₂K ₃；

To R _rPerforming round key addition operation, specifically, adding the data block R _rThe 32 bits of the key are gradually changed from high bit to low bit and the first 32 bits of the round key from high bit to low bit, namely K ₀、K ₁Exclusive OR operation is carried out to obtain R' _r。

b) Carrying out S box replacement on the operation result obtained in the step a) to obtain R ″ _r；

The S-box permutation is the only nonlinear component of SCENERY algorithm, and the S-box of SCENERY algorithm refers to RECTANGLE algorithm 4-bit input and 4-bit output encryption S-box, as shown in the following table; the S-box permutation transform in the F function applies the S-box permutation to each column of the 4 x 8 data matrix. The S-box permutation transform is implemented by simple logic gate operations, i.e. a 32-bit 4 x 8 data matrix is divided into 8 4 bits, denoted as a, by column standard ₀、a ₁、a ₂、a ₃、a ₄、a ₅、a ₆、a ₇B is obtained by replacement of 8S boxes ₀、b ₁、b ₂、b ₃、b ₄、b ₅、b ₆、b ₇The S-box permutation formula is expressed as:

a finite field S:

a _i→b _i＝S(a _i) Wherein i is more than or equal to 0 and less than or equal to 7;

X	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
																	S[x]	6	5	C	A	1	E	7	9	B	0	3	D	8	F	4	2

c) performing M matrix permutation on the operation result obtained in the step b) to obtain R' ″ _r；

The resulting R ″) _rPerforming M matrix permutation according to the following formula to obtain R' ″ _r：

R′″ _r＝R″ _rM；

In order to better meet the implementation of the Sbox layer bit slicing, improve the diffusion speed of the algorithm and realize high dependency of the implementation method, the linear layer constructs a 32 x 32 binary matrix M matrix to realize the linear layer with high dependency. Meanwhile, in order to reduce the search range, the M matrix is realized by using the blocking idea of the matrix in the following form:

wherein M is ₀And M ₁Is a 16 × 16 binary matrix, binary M ₀The matrix is used for replacing the first 16 bits, M of the operation result obtained in b) ₁The matrix is used for replacing the last 16 bits of the operation result obtained in the step b), so that the searching task is reduced to find two 16 × 16 matrixes to form a 32 × 32 matrix in the form so as to replace the whole operation result obtained in the step b);

M ₀and M ₁The number of branches being 4, i.e. M is required ₀And M ₁The number of 1 in each row and each column is 3;

specifically, 32-bit data R' participating in matrix permutation of F function M _rA4 x 8 data matrix, the first 16 bits of the operation result obtained by the permutation b) are R ″ _r0、R″ _r1The last 16 bits of the result of the substitution b) are R ″ _r2、R″ _r3(ii) a Namely M ₀The first 8 columns are R ″) _r0、R″ _r1Diffuse to R' ″ _r0The last 8 columns are R ″) _r0、R″ _r1Diffuse to R' ″ _r1；M ₁The first 8 columns are R ″) _r2、R″ _r3Diffuse to R' ″ _r2The last 8 columns are R ″) _r2、R″ _r3Diffuse to R' ″ _r3(ii) a To better achieve fast diffusion using fewer resources, for M ₀And M ₁The 3 1s per row/column cannot fully concentrate the front/top 8 bits or the back/bottom 8 bits;

according to the above requirements, two vectors a, b of 8-bit binary data are first defined, wherein one of the two vectors has a hamming weight of 1 and one of the two vectors has a hamming weight of 2; assuming that the hamming weight of the a vector is 1 and the hamming weight of the b vector is 2, the possible values of the a vector and the b vector can be derived.

Then pairing the a and b vectors meeting the condition that b ═ a ^ c (wherein the Hamming weight of the vector c is 1); such as: when the vector a is (0,0,0,0,0,0,0,1), the pair (a, b) satisfying the condition includes: 7 pairs of { (0,0,0,0,0,0,0,1), (0,0,0,0,0,1, 1) }, { (0,0,0,0, 1), (0,0,0,0,0,0,0,1, 0,1) } … { (0,0,0,0,0,0,0,1), (1,0,0,0,0, 1) }; from the possible values of vector a, it can be deduced that a total of 56 pairs of vectors (a, b) satisfy the condition.

Constructing 8 multiplied by 16 binary matrix sample N according to the pairing of (a, b), wherein the 0 th row of data is a, b; the 1 st line of data is a circularly shifted by 1 bit in the left direction, and b circularly shifted by 1 bit in the left direction; the 2 nd row data is a, left circularly shifted by 2 bits, and b, left circularly shifted by 2 bits; in the same way, obtaining a data array B of 8 multiplied by 16; for example, a, B pairs { (0,0,0,0,0,0,0,1), (0,0,0,0,0,1, 1) }, corresponding to an 8 × 16 data array B:

similarly, an 8 × 16 binary matrix sample N is constructed according to the (b, a) pairing ₁；

From partial samples N and N ₁Respectively selecting two different 8 x 16 data matrixes to construct M ₀And M ₁Applying it to a matrix permutation module and testing the performance of the algorithm; the following matrixes are obtained through testing, so that the realization resources are relatively less, and the diffusion speed is relatively high:

d) mixing the result R' "obtained in c) _rAnd L _rPerforming XOR operation and taking the XOR result as the R participating in F round function operation in the next round _r(ii) a Input data block R for simultaneously participating current round in F round function operation _rL participating in F-round function operations as the next round _r；

e) Performing S-box replacement on the current round key, specifically performing S-box replacement on data of an 8-bit fixed position in the current round key by adopting an S box in F-round function operation;

to K ₀Low 4 bits (k) ₅₁,k ₅₀,k ₄₉,k ₄₈) And K ₁Low 4 bits (k) ₃₅,k ₃₄,k ₃₃,k ₃₂) Alternately forming two 4-bit data (k) ₅₁,k ₃₅,k ₅₀,k ₃₄) And (k) ₄₉,k ₃₃,k ₄₈,k ₃₂) And performing S box replacement respectively, namely:

k ₅₁k ₃₅k ₅₀k ₃₄＝S(k ₅₁k ₃₅k ₅₀k ₃₄)，

k ₄₉k ₃₃k ₄₈k ₃₂＝S(k ₄₉k ₃₃k ₄₈k ₃₂)；

in specific implementation, the value of x is set as required, and in this embodiment, the loop left shift is selected to be 11 bits, that is:

K′(k′ ₆₃,k′ ₆₂,……,k′ ₁,k′ ₀)＝K(k ₅₂,k ₅₁,……,k ₅₄,k ₅₃)；

specifically, the wheel constant is the first 16K 'from the high order to the low order of the calculation result obtained by taking the current wheel number r and f)' ₀The low 5 bits of the bit sequence are subjected to exclusive OR operation bit by bit;

h) performing DP dynamic replacement on the operation result of g), and taking the obtained result as a round key of the next round;

specifically, as shown in fig. 5, the m-th row data K ' of the operation result matrix K ' of g) is obtained by dividing the current wheel number r by 4 to obtain a remainder m, where m is 0 or more and m is less than or equal to 3 ' _mCorresponding { k' _61-m*16,k′ _60-m*16}，{k′ _57-m*16,k′ _56-m*16}，{k′ _53-m*16,k′ _52-m*16}，{k′ _49-m*16,k′ _48-m*16And its corresponding value is defined as v in turn ₀，v ₁，v ₂，v ₃，0≤v ₀，v ₁，v ₂，v ₃3 or less, namely:

v ₀＝{k′ _61-m*16,k′ _60-m*16}；

v ₁＝{k′ _57-m*16,k′ _56-m*16}；

v ₂＝{k′ _53-m*16,k′ _52-m*16}；

v ₃＝{k′ _49-m*16,k′ _48-m*16}；

By a sequential permutation, i.e. { K' _0v0、K′ _1v1、K′ _2v2、K′ _3v3Replacement by { K' _2v2、K′ _3v3、K′ _0v0、K′ _1v1And fourthly, obtaining a result which is the expanded round key.

In the F round function operation process, the round key used in the first round of operation is the first 32 bits of data from the high order to the low order of the initial key, and the first 32 bits of data of the round key obtained in the previous round of key expansion operation are sequentially obtained from the second round; the DP dynamic replacement is to dynamically replace the result of the step g) by taking the current round number r and the result of the step g) as control signals;

Wherein the IP2 permutation comprises:

The Feistel structure is in the round function operation process, and the last round of L _r、R _rThe method does not carry out interchange, but the algorithm carries out interchange in the last round, and in order to ensure the high symmetry of the algorithm, L needs to be carried out after the last round _r、R _rThe interchange and IP1 inverse initial permutation operations are performed, so the IP2 permutation is made by combining the two permutation operations. The IP2 permutation is switched in units of 4 bits, with the input denoted as P ₀₀,P ₀₁,P ₀₂,P ₀₃,P ₁₀,P ₁₁,P ₁₂,P ₁₃,P ₂₀,P ₂₁,P ₂₂,P ₂₃,P ₃₀,P ₃₁,P ₃₂,P ₃₃Permute the data with { P over IP2 ₀₂,P ₃₀,P ₂₁,P ₁₃,P ₂₀,P ₁₂,P ₀₃,P ₃₁,P ₃₃,P ₀₁,P ₁₀,P ₂₂,P ₁₁,P ₂₃,P ₃₂,P ₀₀And (5) outputting in sequence. The IP2 substitution positions are shown in the table below.

2	12	9	7
				8	6	3	13
15	1	4	10
				5	11	14	0

In this embodiment, a decryption process is further included, as shown in fig. 2, the decryption process includes the following steps:

i) to R _rPerforming round key addition operation;

k) performing M matrix permutation on the operation result obtained by the j);

Wherein, in each round of F round function operationThe round key is used for multiplexing the round keys in the encryption process, and the use sequence of the round keys in the decryption process is opposite to that of the round keys in the encryption process; in this embodiment, the encryption round key K _rUse is changed to K _27-rThe decryption process of the algorithm can be completed;

step B5: judging whether the current round number signal r is smaller than the round number Nr, if so, making r equal to r +1, taking the results of the steps B4 and B5 as input data of a new round of operation, and returning to the step B4; otherwise, for the next round L obtained in step B4 _r、R _rIP2 substitution is performed and then the decryption result is output. The specific details of the decryption process can be found in the encryption process.

SCENERY block cipher algorithm pseudo code description:

algorithm 1: SCENERY cipher encryption process

Inputting: plain text (P), key (K);

and (3) outputting: a ciphertext (C);

and 2, algorithm: SCENERY cipher decryption process

Inputting: c, K;

and (3) outputting: p;

the embodiment of the present invention further provides a device for implementing lightweight cryptographic algorithm SCENERY, including:

Where r represents the current round number, data block L _rThe data block R is obtained by arranging the first 8 bits of each line of the operation result of the IP1 permutation unit from high order to low order _rPut by IP1The last 8 bits of each row of the operation result of the conversion unit are sequentially arranged from high bit to low bit;

a) to R _rPerforming round key addition operation;

e) performing S box replacement on the current round key, wherein the S box used in the S box replacement is the same as the S box used in the F round function processing unit;

in the F round function operation process, round keys used in the first round of operation are the first 32 bit data of the initial key from high order to low order, and the first 32 bit data of the round keys obtained in the previous round of key expansion operation are sequentially obtained from the second round; the DP dynamic replacement is to dynamically replace the result of the step g) by taking the current round number r and the result of the step g) as control signals;

The specific technology for implementing the functions of each module in the lightweight cryptographic algorithm sceery implementing device may refer to the lightweight cryptographic algorithm sceery implementing method, and is not described herein again.

The embodiment of the invention also provides a computer readable storage medium, which comprises a stored program, wherein the program is suitable for a processor to load and execute the lightweight cryptographic algorithm SCENERY implementation method.

As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

The method provided by the embodiment of the invention is tested, wherein SCENERY-64 algorithm data provided by the invention is shown in table 1:

TABLE 1SCENERY-64 Algorithm Experimental test data

Plaintext	Key	Ciphertext
			0000-0000-0000-0000	0000-0000-0000-0000	28BC-2A7A-4782-E797
0000-0000-0000-0000	FFFF-FFFF-FFFF-FFFF	D759-FF83-9E1F-29E8
			FFFF-FFFF-FFFF-FFFF	0000-0000-0000-0000	CD28-5DC5-CB1B-297D
FFFF-FFFF-FFFF-FFFF	FFFF-FFFF-FFFF-FFFF	D02B-7F5B-04A7-99F7
			68B1-0045-F4BC-1775	7FE7-AB97-9608-717F	224C-81E9-13AF-1EF2

The SCENERY cryptographic algorithm provided by the invention is realized in Xilinx Virtex-4 ML405 FPGA hardware, the clock cycle of the SCENERY-64 algorithm is 8.508ns, the clock frequency is 117.536MHz, and the throughput rate is 268.654 Mbps;

the SCENERY cryptographic algorithm provided by the invention is realized in ASIC hardware, and the comprehensive process library is 0.18mm of SMIC. The resource area occupied by the algorithm SCENERY-64 is 1190 GE.

Table 2 shows typical lightweight cryptographic algorithm FPGA hardware implementation with minimum key length, and table 3 shows typical lightweight cryptographic algorithm ASIC hardware implementation with minimum key length, and data comparison between table 2 and table 3 shows that scheery occupies small area resources compared to current lightweight cryptographic algorithms, and the frequency and throughput have high performance.

TABLE 2 implementation of the lightweight cryptographic algorithms FPGA

TABLE 3 lightweight cryptographic algorithm ASIC implementation

Algorithm	Structure of the product	Packet length (bits)	Key length (bits)	Area of resources (GE)
					Piccolo-80	GFN	64	80	1136
PRESNET-80	SPN	64	80	1570
					KLEIN-64	SPN	64	64	1220
LBlock	Feistel	64	80	1320
					Twine-80	Feistel	64	80	1503
LED-64	SPN	64	80	1040
					MIBS-64	Feistel	64	64	1396
SCENERY-64	Feistel	64	64	1190

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A lightweight cryptographic algorithm SCENERY implementation method is characterized by comprising the following steps:

Step A2: carrying out IP1 initial replacement on the data P in the step A1, and determining a round number Nr according to the number of key bits, wherein the initial value of a round number control signal is 1;

a) to R _rPerforming round key addition operation;

e) performing S box replacement on the current round key;

2. The method for implementing the lightweight cryptographic algorithm SCENERY of claim 1, wherein the IP1 initial replacement procedure in step A2 is as follows:

a4 × 16 data matrix P is formed into a4 × 4 matrix with 4 bits per row as a small unit, and the 4 × 4 matrix is expressed as N ═ P ₀₀,P ₀₁,P ₀₂,P ₀₃,P ₁₀,P ₁₁,P ₁₂,P ₁₃,P ₂₀,P ₂₁,P ₂₂,P ₂₃,P ₃₀,P ₃₁,P ₃₂,P ₃₃}；

Dividing the matrix N into 4 matrices N of 2 × 2 in sequence ₀、N ₁、N ₂、N ₃；N ₀＝{P ₀₀,P ₀₁,P ₁₀,P ₁₁}，N ₁＝{P ₀₂,P ₀₃,P ₁₂,P ₁₃}，N ₂＝{P ₂₀,P ₂₁,P ₃₀,P ₃₁}，N ₃＝{P ₂₂,P ₂₃,P ₃₂,P ₃₃}；

Respectively taking N ₃、N ₀Pair ofAngular line (P) ₃₃,P ₂₂) And (P) ₁₀,P ₀₁) The third column of data constituting the IP1 permutation, i.e. (P) ₃₃,P ₂₂,P ₁₀,P ₀₁) ^T；

Respectively taking N ₂、N ₁Diagonal line (P) of ₂₁,P ₃₀) And (P) ₀₂,P ₁₃) The fourth column of data constituting the IP1 permutation, i.e. (P) ₂₁,P ₃₀,P ₀₂,P ₁₃) ^T；

The 4 x 4 matrix N is initially permuted by IP1 to form P ₀₀,P ₁₂,P ₃₃,P ₂₁,P ₁₁,P ₀₃,P ₂₂,P ₃₀,P ₂₃,P ₃₁,P ₁₀,P ₀₂,P ₃₂,P ₂₀,P ₀₁,P ₁₃Sequentially outputting to obtain data P after initial replacement by IP1 ^′。

3. The method for implementing the lightweight cryptographic algorithm SCENERY of claim 1, wherein said step A3 is to divide the operation result of step A2 into 4 x 8 matrix data blocks L _r、R _rThe division process is as follows:

4. the method for implementing the lightweight cryptographic algorithm SCENERY according to claim 1, wherein the M matrix permutation of the F round function operation in the step A4 is implemented by a 32 x 32 binary matrix M with a branch number of 4, where the matrix M is represented as:

5. The method for implementing the lightweight cryptographic algorithm SCENERY according to claim 1, wherein the key expansion operation in the step A5 specifically includes the following steps:

e) To K ₀Low 4 bits (k) ₅₁,k ₅₀,k ₄₉,k ₄₈) And K ₁Low 4 bits (k) ₃₅,k ₃₄,k ₃₃,k ₃₂) Alternately forming two 4-bit data (k) ₅₁,k ₃₅,k ₅₀,k ₃₄) And (k) ₄₉,k ₃₃,k ₄₈,k ₃₂) And performing S box replacement respectively;

f) circularly left shifting the operation result of e) by 11 bits;

g) performing round constant addition operation on the first 16 bits from the high bit to the low bit of the operation result of f);

6. The method for implementing the lightweight cryptographic algorithm SCENERY according to claim 5, wherein the performing DP dynamic permutation on the result in g) specifically comprises:

v ₀＝{k′ _61-m*16,k′ _60-m*16}；

v ₁＝{k′ _57-m*16,k′ _56-m*16}；

v ₂＝{k′ _53-m*16,k′ _52-m*16}；

v ₃＝{k′ _49-m*16,k′ _48-m*16}；

v0, v1, v2 and v3 values are sequentially expressed as a matrix K 'of 4 multiplied by 4' ₀、K′ ₁、K′ ₂、K′ ₃The corresponding positions in the sequence of v0, v1, v2 and v3 are K' _0v0、K′ _1v1、K′ _2v2、K′ _3v3；

By one sequential permutation, { K' _0v0、K′ _1v1、K′ _2v2、K′ _3v3Replacement by { K' _2v2、K′ _3v3、K′ _0v0、K′ _1v1Get the result finallyI.e. the expanded round key.

7. The method for implementing the lightweight cryptographic algorithm SCENERY of claim 1, wherein the IP2 permutation in the step A6 comprises:

8. The method for implementing the lightweight cryptographic algorithm SCENERY according to any one of claims 1 to 7, further comprising a decryption process, said decryption process comprising the steps of:

i) to R _rPerforming round key addition operation;

k) performing M matrix permutation on the operation result obtained by the j);

9. A lightweight cryptographic algorithm SCENERY implementation device is characterized by comprising:

then the data block L _rAnd R _rAccording to FThe eisel structure performs F-round function operations, each round of F-round function operation comprising:

a) to R _rPerforming round key addition operation;

e) performing S box replacement on the current round key;

a ciphertext generation unit: the round key expansion unit is used for judging whether the current round number signal r is less than the round number Nr or not, if so, making r equal to r +1, taking results of the F round function processing unit and the round key expansion unit as input data of a new round of operation, and returning to an F round function process of the F round function processing unit and a round key expansion process of the round key expansion unit; otherwise, the last result of the F round function processing unit is subjected to IP2 replacement, and then an encryption result is output.

10. A computer-readable storage medium, characterized in that it comprises a stored program adapted to be loaded and executed by a processor to implement the lightweight cryptographic algorithm SCENERY implementation of any of claims 1 to 8.