CN1527531A - Method of realizing data enciphering standard or double data enciphering standard - Google Patents

Abstract

The present invention is data enciphering standard (DES) or triple data enciphering standard (3DES) realizing method. Initially substituted 64 bits plain text is iteratively operated with different son cipher keys in different iterative units and inversely converted to generate 64 bits cipher text. The method also includes pre-calculating and storing at least one son cipher key for iterative operation and setting the correlation between each iterative unit and each son cipher key; completing at least one iterative operation in each clock period after determining the son cipher key, and subsequent performing iterative operation with the substituted 64 bits plain text and the determined cipher key in each iterative unit. The method has quick data enciphering speed, enough enciphering amount for data communication and raised DES or 3DES enciphering/deciphering safety.

Description

The implementation method of a kind of data encryption standard or triple DES

Technical field

The present invention relates to a kind of data encryption technology, the implementation method of particularly a kind of data encryption standard (DES) or triple DES (3DES).

Background technology

DES is data encryption standard and the cryptographic algorithm that NBS (NSA) formally publicized and implemented in 1977, and this cryptographic algorithm is mainly used in commercial secure communication, is present most widely used cryptographic algorithm.

DES is a kind of cryptographic algorithm of the symmetry of dividing into groups, and so-called block cipher is exactly one section algorithm that plaintext is encrypted to regular length; Symmetric cryptography is meant that then encryption and decryption all use same set of password.DES is a kind of algorithm that the fixed length bit stream of 64 bits (bits) of input is encrypted, and key is the bit stream of 64bits, and after expressly encrypting, output length is the ciphertext of 64bits.The 64bits that supposes input expressly is: m=m ₁m ₂... m _i... m ₆₄(1≤i≤64), each mi represents 1bit; The 64bits key is k=k ₁k ₂... k _i... k ₆₄(1≤i≤64); Wherein key has only 56bits effective, k ₈k ₁₆... k _i... k ₆₄All be parity check bit, inoperative in algorithm, whole ciphering process can be represented by formula (1):

DES(m)＝IP ^-1(m)*T ₁₆T ₁₅*...*T ₃*T ₁*IP(m) (1)

The des encryption algorithmic procedure carries out carrying out the ciphertext that inverse permutation obtains 64bits again after 16 times the unit iteration for the plaintext through displacement 64bits.

The flow chart of des encryption algorithm as shown in Figure 1, its detailed process is:

Step 100, IP carries out initial permutation to plaintext m by the initial permutation function, and initial permutation is with plaintext m with unit matrix I premultiplication;

Step 100～102, the plaintext m behind the initial permutation is divided into two parts, is respectively: L ₀And R ₀, L ₀And R ₀All be 32bits;

Step 103～106, L ₀And R ₀Carry out the unit iteration of DES respectively with the key of each unit, generate L and R through 16 times iteration, L and R are 32bits;

The inverse permutation of initial permutation function after L and R exchange, is carried out again in step 107～108, finishes the expressly des encryption of m.

The algorithm flow of each iteration unit is supposed the L that is input as of iteration unit as shown in Figure 2 in the des encryption algorithm _iAnd R _i, be output as L _I+1And R _I-1L wherein _I+1With R _iEquate that the key of input is K, its detailed process is:

Step 210～211, the effective key k of the 56bits of input tears the C into each 28bits of height open through after the function PC-1 displacement ₀And D ₀

Step 212, the C of high-order 28bits ₀D with low level 28bits ₀When iterating to the i time, carry out LS respectively at every turn _iComputing, ring shift left i position just obtains the C behind the ring shift left ₀And D ₀

Step 213 is with the C behind the ring shift left ₀And D ₀Carry out a PC-2 function displacement after merging the data flow that becomes 56bits, form the sub-key K of 48bits _iOutput, iteration just has 16 sub-key K for 16 times like this _iOutput.

The sub-key of each iteration unit uses in the des encryption computing, and its detailed process is as follows:

Step 200～203 are to the 32bitsR of input _iConversion is expanded/is replaced through E, becomes the bit stream E of 48bits _iE _iWith sub-key K _iCarry out producing after the XOR computing bit stream of 48bits;

Step 204～205, the bit stream of this 48bits is exported through the S box that becomes 32bits afterwards that substitutes/replace of S box; The bit stream of the 32bits of S box output is through generating the P displacement output of 32bits bit stream after the P displacement;

Step 206～208, P displacement output and L _iCarry out producing R after the XOR computing _I+1, L _I+1Be R _i, one time the DES interative computation is finished.

DES deciphering and ciphering process are very similar, just the sub-key difference.As shown in Figure 3, Fig. 3 is the flow chart of DES decipherment algorithm, and implementation step is:

Step 300～302, the ciphertext c behind the initial permutation is divided into two parts, is respectively: L and R, L and R are 32bits;

Step 303～306, L and R carry out the unit iteration of DES respectively, generate L through 16 times iteration ₀And R ₀, L and R are 32bits, when iteration each time, and should be with the sub-key K of 16 iteration ₁, K ₂, K ₃... K ₁₆Reversed order come to use, promptly use K during iteration in the first time ₁₆, last iteration K ₁Get final product;

The inverse permutation of initial permutation function after L and R exchange, is carried out again in step 307～308, finishes the DES deciphering of ciphertext.

It is the safer distortion of DES that triple des is encrypted, the triple des ciphering process is realized by software, the triple des of three keys has than the triple des of DES and two keys encrypts better fail safe, and the triple des of three keys is encrypted, and uses increasingly extensive at Internet.

Triple des with three keys is an example, and the 3DES algorithm can be described below: suppose e _k(m) and d _k(m) the expression encryption and decryption of DES algorithm to the fixed length bit stream m of 64bits, key is K; Then the ciphertext c of 64bits obtains by carrying out formula (2):

$c=e_{K_3}\left(d_{k_2}\left(e_{K_1}\left(m\right)\right)\right)---\left(2\right)$

K wherein ₁, K ₂And K ₃It is the DES key of 56bits.

The 3DES ciphering process obtains the 64bits ciphertext for the des encryption that input 64bits expressly carries out importing for three times different DES keys continuously.

As shown in Figure 4, Fig. 4 is the flow chart of 3DES cryptographic algorithm, and its detailed process is:

Step 401, expressly m passes through key K ₁Carry out the ciphering process of DES;

Step 402 is passed through key K through the plaintext m that the first time, des encryption was crossed ₂Carry out the decrypting process of DES;

Step 403 is passed through key K through the plaintext m that the second time, DES deciphered ₃Carry out the ciphering process of DES again, output ciphertext c.

The decrypting process of deriving the triple des of plaintext m from ciphertext c is the inverse process of ciphering process, describes as shown in Equation (3):

$m=d_{K_1}\left(e_{k_2}\left(d_{K_3}\left(c\right)\right)\right)---\left(3\right)$

The DES deciphering that the 3DES decrypting process carries out importing for three times different DES keys continuously for input 64bits ciphertext obtains 64bits expressly.

As shown in Figure 5, Fig. 5 is the flow chart of 3DES decipherment algorithm:

Step 501, ciphertext c passes through key K ₃Carry out the decrypting process of DES;

Step 502 is passed through key K through the ciphertext c that the first time, DES deciphered ₂Carry out the ciphering process of DES;

Step 503 is passed through key K through the ciphertext c that the second time, des encryption was crossed ₁Carry out the decrypting process of DES again, output is m expressly.

Present many application all are to adopt software programming to realize the 3DES cryptographic algorithm, realize that data enciphering/deciphering speed is very slow owing to adopt software, if realize the DES algorithm with software, need 35 clock cycle to finish the plain text encryption of a 64bits or the decrypt ciphertext of 64bits, limited the throughput of whole communication system, but for the coded communication technology, need enough encryption throughputs and satisfy the requirement of data communication flow, and adopt software to realize 3DES enciphering/deciphering data flow, then can not satisfy the requirement of big throughput, become the bottleneck in the coded communication.

Summary of the invention

In view of this, the invention provides the implementation method of a kind of DES or 3DES, this method not only makes data enciphering/deciphering speed improve greatly, provides enough encryption throughputs to be used for satisfying the requirement of data communication to flow.And the fail safe that has improved DES or 3DES encryption/decryption algorithm.

According to above-mentioned purpose, the invention provides the implementation method of a kind of data encryption standard (DES) or triple DES (3DES), through 64 bits (bits) of initial permutation expressly in each iteration unit with after different sub-keys carry out interative computation, generate the ciphertext of 64bits again through the inverse transformation of initial permutation, it is characterized in that this method also comprises:

A. calculate in advance and store the required sub-key of each interative computation, and set the corresponding relation between each iteration unit and each sub-key;

B. in a clock cycle, finish the interative computation of an above iteration unit, and before each interative computation, determine the current sub-key that will use according to the corresponding relation that step a sets, in each iteration unit, the 64bits behind the initial permutation is expressly carried out interative computation with determined sub-key then.

Precalculated sub-key number described in the step a equals the interative computation number of times in the enciphering/deciphering computing one time.

Iteration unit described in the step a is that the iteration unit sequence number is corresponding one by one with the sub-key sequence number with corresponding relation between sub-key.

The calculating of sub-key described in the step a further comprises:

A1, key pass through after the displacement of PC-1 function, tear open to be high-order C ₀With low level D ₀

A2, high-order C ₀With low level D ₀Ring shift left i position when at every turn iterating to the i time respectively obtains the high-order C behind the ring shift left ₀With low level D ₀

A3, with the high-order C behind the ring shift left ₀With low level D ₀Merging is carried out the displacement of PC-2 function after becoming data flow, forms sub-key K _iOutput and storage.

Finish the interative computation of four iteration unit among the described step b in clock cycle.

When carrying out the 3DES enciphering/deciphering, this method also comprises: finish vacant one-period behind the enciphering/deciphering of DES.

A described clock cycle finishes four interative computations and further comprises:

In four iteration unit, carry out the computing of parallel iteration unit respectively through the data flow behind the initial permutation, finish the computing of four DES iteration unit of one-period with the sub-key that precomputes.

By such scheme as can be seen, the present invention adopts the method for logic to realize the encryption/decryption algorithm of DES or 3DES.In the same clock cycle, can finish four iteration unit operations, and can generate in advance by the sub-key that each interative computation is used, thereby the speed that deal with data is encrypted improves greatly, provide enough big encryption throughput to be used for satisfying the requirement of data communication, made DES or 3DES encryption/decryption algorithm become a kind of safer, high-efficient algorithm flow.

Description of drawings

Fig. 1 is the flow chart of des encryption algorithm.

Fig. 2 is the algorithm flow chart of each iteration unit in the des encryption algorithm.

Fig. 3 is the flow chart of DES decipherment algorithm.

Fig. 4 is the flow chart of 3DES cryptographic algorithm.

Fig. 5 is the flow chart of 3DES decipherment algorithm.

Fig. 6 is the structure chart of the 3DES enciphering/deciphering interface of the embodiment of the invention.

Fig. 7 is the flow chart of 3DES cryptographic algorithm under the CBC pattern of the embodiment of the invention.

Fig. 8 is the flow chart of 3DES decipherment algorithm under the CBC pattern of the embodiment of the invention.

Fig. 9 is 4 interative computation flow charts finishing the des encryption algorithm clock cycle.

Figure 10 is the processing procedure schematic diagram of 3DES encryption/decryption algorithm.

Embodiment

In order to make the purpose, technical solutions and advantages of the present invention clearer, by the following examples and with reference to accompanying drawing, the present invention is described in more detail.

Core concept of the present invention is exactly: the enciphering/deciphering that adopts the method realization DES/3DES algorithm of logic, a clock cycle is set finishes once above interative computation, 4 DES enciphering/deciphering computing iterative process that clock cycle carries out are called one-level flowing water, vacant again one-period after the DES enciphering/deciphering finishes each time is used for guaranteeing to set up between each grade flowing water the retention time that logical combination connects.The present invention has also adopted the method for calculating the required sub-key of each iteration unit computing in advance, and the enciphering rate of data is improved greatly.

Below be example just with the 3DES algorithm of realizing logic cipher block chaining (CBC) pattern, to the detailed description of the invention.

As shown in Figure 6, Fig. 6 is the structure chart of the 3DES enciphering/deciphering interface of the embodiment of the invention, this interface is made up of input interface and output interface, and input interface comprises: master clock interface (Clk) 601, reset signal input interface (Rst) 600, enciphering/deciphering request signal input interface (Req) 607, enciphering/deciphering 64bits Data Input Interface (Text_in[63:0]) 602,64bits initial vector Iv (Iv[63:0]) 603,56bits key key1 input interface (Key1[55:0]) 604,56bits key key2 input interface (Key2[55:0]) 605 and 56bits key key3 input interface (Key3[55:0]) 606; Output interface comprises: enciphering/deciphering 64bits data output interface (Text_out[63:0]) 608 and enciphering/deciphering end mark (Finish) 609.

Utilize the described 3DES enciphering/deciphering of Fig. 6 interface just can realize 3DES encryption/decryption algorithm under the CBC pattern, as shown in Figure 7, Fig. 7 is the flow chart of 3DES cryptographic algorithm under the CBC pattern of the embodiment of the invention, and its implementation procedure is:

Step 700 is divided into the data flow of several 64bits with the plaintext of needs deciphering, supposes that this expressly is divided into to be m1, and m2 ..., mN, each mI are 64bits;

Step 701,702,703 is provided with an initial vector IV, carries out the encryption of DES/3DES behind this IV and the plaintext m1 XOR again, the ciphertext c1 of output 64bits;

Step 704,705,706 is expressly carried out the encryption of DES/3DES again behind m2 and the output ciphertext c1 XOR, the ciphertext c2 of output 64bits by that analogy, finally exports the ciphertext cN of 64bits.

As shown in Figure 8, Fig. 8 is the flow chart of 3DES decipherment algorithm under the CBC pattern of the embodiment of the invention, and its implementation procedure is:

Step 800, ciphertext at first is grouped, and the plaintext in every group is the data flow of 64bits, is assumed to be ciphertext c1, c2 ..., cN;

Step 801,802,803 is provided with an initial vector IV, and c1 carries out after the deciphering of DES/3DES and this IV ciphertext XOR, the plaintext m1 of output 64bits;

Step 804,805,806, ciphertext c2 carries out after the deciphering of DES/3DES and ciphertext c1 XOR, the plaintext m2 of output 64bits, by that analogy, the plaintext mN of output 64bits.

Owing to adopt the DES/3DES encryption/decryption algorithm of logic CBC pattern, each clock cycle can be supported repeatedly the combinational logic of iterative operation and be realized, therefore each clock cycle is set finish interative computation four times, so only needs four clock cycle to finish.As shown in Figure 9, Fig. 9 is four interative computation flow charts finishing the des encryption algorithm clock cycle, and its detailed process is:

Step 901 is by enciphering/deciphering 64bits Data Input Interface (Text_in[63:0]) input m expressly;

Step 902,903, the key of 56bits key key input interface (Key[55:0]) input goes out the sub-key of 16 48bits by a series of displacement and combination results;

Step 904,905, expressly m carries out the computing of DES iteration unit A through data flow and first sub-key behind the initial permutation, the data flow that generates 64bits is carried out the computing of DES iteration unit B with second sub-key again, by that analogy, finish the computing of four DES iteration unit of one-period, when second period, select the 5th respectively, the 6th, the 7th and the 8th key are finished the computing of four DES iteration unit of second period, when the 3rd cycle, select the 9th respectively, the 10th, the 11st and the 12nd key are finished the computing of four DES iteration unit in the 3rd cycle, when the 4th cycle, select the 13rd respectively, the 14th, the 15th and the 16th key are finished the computing of four DES iteration unit in the 4th cycle, at last by the plaintext m of enciphering/deciphering 64bits data output interface (Text_out[63:0]) after output is encrypted.

In order to reduce the data operation in the DES encryption/decryption algorithm, the simplification process, accelerate the arithmetic speed of each iteration, 16 sub-keys can be calculated in advance, before carrying out the computing of DES enciphering/deciphering, 16 sub-keys are calculated, the method of calculating sub-key adopts prior art, calculate before the computing of DES enciphering/deciphering carrying out according to the method for the described generation sub-key of Fig. 2, the sub-key that different iteration unit is corresponding different, wheel number according to iteration unit is selected corresponding sub-key, as iteration unit 1 chooser key K 1, iteration unit 2 chooser key K 2 etc.Also can preestablish the corresponding relation of an iteration unit and selected sub-key, get final product according to iteration unit number definite current selected sub-key at every turn, such as: iteration unit 4 has corresponding relation with sub-key K4, when carrying out the 4th iteration unit computing of DES, utilization sub-key K4.

The 3DES encryption/decryption algorithm of employing CBC pattern is equivalent to the DES encryption/decryption algorithm of three employing CBC patterns, in order to guarantee the setting up the retention time of combinational logic between the DES encryption/decryption algorithm each time, vacate a time cycle finishing the DES encryption/decryption algorithm each time, then once adopt the computing of the 3DES encryption/decryption algorithm of CBC pattern to need 15 clock cycle, as shown in figure 10, Figure 10 is the processing procedure schematic diagram of 3DES encryption/decryption algorithm, and its detailed process is:

Step 1000, plaintext m by enciphering/deciphering 64bits Data Input Interface (Text_in[63:0]) input and the key K by 56bits key key1 input interface (Key1[55:0]) input ₁Carry out the ciphering process of DES;

Step 1001, plaintext m that crosses through des encryption for the first time and the key K by 56bits key key2 input interface (Key2[55:0]) input ₂Carry out the decrypting process of DES;

Step 1002, the plaintext m that decipher through DES for the second time passes through the key K that 56bits key key3 input interface (Key3[55:0]) is imported ₃Carry out the ciphering process of DES again, output ciphertext c.

Because the 3DES encryption/decryption algorithm can compatible DES encryption/decryption algorithm, when the key of three DES encryption/decryption algorithm equated, algorithm just was equal to the DES encryption/decryption algorithm.

The sub-key that prior art is used in the iteration unit computing of 3DES/DES encryption/decryption algorithm all is to be generated by a series of displacement and combination by the master key of importing, this method speed is slow, complexity is high, therefore the present invention calculates sub-key in advance, select the epicycle iteration unit to select which sub-key for use according to iteration wheel number or corresponding relation, can realize generating fast the process of sub-key.

The employing CBC pattern that the embodiment of the invention provides realizes the encryption/decryption algorithm of DES/3DES, can carry out encryption/decryption algorithm to several groupings expressly simultaneously, improved the processing speed of the enciphering and deciphering algorithm of DES/3DES greatly, make the speed of encryption and decryption be reduced to 64bits data flow of 15 clock cycle processing by 64bits data flow of original 30 time cycles processing, therefore, improved the throughput of whole communication system, providing enough encryption throughputs to be used for satisfying the requirement of data communication to flow, is a kind of safer, the implementation method of DES/3DES encryption/decryption algorithm efficiently.

The above only is preferred embodiment of the present invention, not in order to restriction the present invention, all any modifications of being made within the spirit and principles in the present invention, is equal to and replaces and improvement etc., all should be included within protection scope of the present invention.

Claims (7)

1, the implementation method of a kind of data encryption standard (DES) or triple DES (3DES), through 64 bits (bits) of initial permutation expressly in each iteration unit with after different sub-keys carry out interative computation, generate the ciphertext of 64bits again through the inverse transformation of initial permutation, it is characterized in that this method also comprises:

A. calculate in advance and store the required sub-key of each interative computation, and set the corresponding relation between each iteration unit and each sub-key;

B. in a clock cycle, finish the interative computation of an above iteration unit, and before each interative computation, determine the current sub-key that will use according to the corresponding relation that step a sets, in each iteration unit, the 64bits behind the initial permutation is expressly carried out interative computation with determined sub-key then.

2, method according to claim 1 is characterized in that, precalculated sub-key number described in the step a equals the interative computation number of times in the enciphering/deciphering computing one time.

3, method according to claim 2 is characterized in that, iteration unit described in the step a is that the iteration unit sequence number is corresponding one by one with the sub-key sequence number with corresponding relation between sub-key.

4, method according to claim 1 is characterized in that, the calculating of sub-key described in the step a further comprises:

A1, key pass through after the displacement of PC-1 function, tear open to be high-order C ₀With low level D ₀

A2, high-order C ₀With low level D ₀Ring shift left i position when at every turn iterating to the i time respectively obtains the high-order C behind the ring shift left ₀With low level D ₀

A3, with the high-order C behind the ring shift left ₀With low level D ₀Merging is carried out the displacement of PC-2 function after becoming data flow, forms sub-key K ₁Output and storage.

5, method according to claim 1 is characterized in that, finishes the interative computation of four iteration unit among the described step b in clock cycle.

6, method according to claim 5 is characterized in that, when carrying out the 3DES enciphering/deciphering, this method also comprises: finish vacant one-period behind the enciphering/deciphering of DES.

7, method according to claim 5 is characterized in that, a described clock cycle finishes four interative computations and further comprises:

In four iteration unit, carry out the computing of parallel iteration unit respectively through the data flow behind the initial permutation, finish the computing of four DES iteration unit of one-period with the sub-key that precomputes.

Images