DE4305067C2 - Method and device for synchronizing a decoder - Google Patents

Description

Fig. 2 shows the main elements of a known device for stream encryption or decryption. It has a cryptological core C, which is basically structured as follows:

It has a first input 1 , via which a (secret) key of length n ₁ bit can be loaded, which is statically stored in a shift register 3 , and a second input 2 , into which a sequence of bits that are not shown Clock are clocked, can be fed.

These bits at the second input 2 reach another shift register 4 of length n ₂ . According to a predetermined algorithm, a processor 5 forms a sequence of bits at a core output 6 from the static bits in the shift register 3 and the dynamically changing bits in the shift register 4 . A cipher bit can thus be extracted from this for each bit supplied via the second input 2 , which can be linked in a known manner in an adder 7 by modulo-2 addition with a clear or ciphertext bit from an input line 8 , which or decrypted. The encrypted or decrypted bits appear at an output A.

The bits occurring at the core output 6 are a complex, non-linear function of the n ₁ key bits and the last n ₂ bits supplied to the second input 2 .

As is also already known, such a cryptological core basically in two modes, in the "cipher feedback mode" and in the "output feedback mode" operate.

These two modes of operation are known per se and z. B. in DIN ISO 8372 "Information Processing - Operating Modes for a 64-bit block key algorithm "or in ISO / IEC 10116 "Information processing modes for an N-bit block cipher algorithm ".

The transmission side S and the reception side E of an arrangement operated in the "cipher feedback mode" is shown in FIG. 3. The respective first inputs for the key are omitted from here, since they are no longer required for further explanation.

The cipher bit taken from the core output 6 s of the cryptological core Cs is added in a modulo-2 adder 7 s to the respective plain text bit Ks modulo-2 to be encrypted. The encrypted bit V arises at the output As of the modulo-2 adder 7 s. This is supplied on the transmission side S on the one hand to the transmission link 9 and on the other hand to the second input 2 s of the cryptological core Cs.

On the receiving side E, the bits V coming from the transmission path 9 are supplied on the one hand for decryption to a modulo-2 adder 7 e and on the other hand to the second input 2 e of a cryptological core Ce, the core output 6 e of which in turn is connected to the second input 2 e of the receiving end Modulo-2 adder 7 e is connected. Plain text bits Ke appear at its output Ae.

If both cryptological cores Cs and Ce of the transmitting and receiving sides are identical and if both have been loaded with the same key, then at the latest after n ₂ bits transmitted error-free via the transmission link 9 occur at the core output 6s of the cryptological core Cs transmitting side and the core output 6 e of the cryptographic core Ce the receiving side at the same time on the same bits and the received bits are correctly decoded from now on.

Once distorted on the transmission path, a bit, e appears at the output 6 of the cryptographic core Ce the receiving side n ₂ times with a probability of about 50% of another bit than at the output 6 s of the cryptographic core Cs the transmitting side, and about half of the next n ₂ bits are decrypted incorrectly. This disadvantageous effect is called "error multiplication".

The "output feedback mode" is shown in FIG. 4. He avoids this disadvantage. It has the same circuit for the transmitting and receiving sides S and E: the bit sequence to be encrypted or the bit sequence coming from the transmission path 9 is located at the first inputs of the modulo-2 adders 7 s and 7 e. The second input of these modulo-2 adders is supplied with the bit sequence supplied by the core outputs of the cryptological cores Cs and Ce. However, this is also fed directly to the second inputs 2 s and 2 e of the two cryptological cores. If, in turn, both cryptological cores of the transmitting and receiving sides are identical, if both have been loaded with the same key and both have the same initial state, ie in particular the two cryptological cores via their second inputs 2 s and 2 e before the start n ₂ identical bits have been supplied to the transmission, both cryptological cores Cs and Ce henceforth supply the same bit sequences (i.e. a pair), and the transmitted data bits are correctly decrypted as long as the transmission and reception sides S and E are clocked synchronously with one another . The state when both cores deliver the same bit sequences is called synchronism.

For cryptological reasons, different pairs of bit sequences from the core output 6 s or 6 e of the cryptological cores Cs or Ce should be used to encrypt or decrypt different data bit streams. This can be achieved in the "output feedback mode" in that the second inputs 2 s and 2 e of the two cryptological cores Cs and Ce have the same sequence of each other before each recording of an encrypted data transmission, but differ from transmission to transmission ₂ bits. This can be achieved by starting a transmission in "cipher feedback mode" and switching to "output feedback mode" on both sides after synchronism has been achieved.

Fig. 5 shows such a known arrangement. Switches 27 and 28 switch from the "cipher feedback mode" (position "CF") to the "output feedback mode" (position "OF"). In practice, they are actuated when a "sufficient" time for achieving synchronism has passed, but before the useful bits to be transmitted reach the adder 7 s.

The disadvantage is that it is unexpectedly disturbed Transmission path can occur that despite the elapse one usually "sufficient" for synchronization Time the synchronism is not reached, so the Switching to the output feedback mode is not permitted early he follows.

The object of the invention is an automatic Achieve synchronization with increased reliability.

The solution (s) is (are) one or more independent Find patent claims. Further training is in the Subclaims specified.  

The following considerations were used: If you start in "cipher feedback mode" on the send side Encrypted sequence of binary zeros, you can see that It is particularly easy to achieve synchronization at the receiving end at the occurrence of decrypted binary zeros; d. H. the Occurrence of a sufficient number of zeros in continuous sequence is a sure criterion for that Achieving synchronism and then switching allowed to the output feedback mode.

Fig. 1 shows a suitable circuit arrangement, which has the additional advantage that it can be switched over both for encryption on the transmission side and for decryption on the reception side. Because if you want to integrate such a circuit arrangement for encrypting or decrypting data bit streams on a silicon chip, you are interested in being able to implement all of these applications with a single version if possible.

The second input 2 of the cryptological core C is supplied with a bit sequence via a switch 31 which, in the "OF" position (as "output feedback") of this switch 31, the output of the cryptological core C, but in the "CF" position (as "cipher feedback ") of this switch 31 is taken from the output of a further switch 32 , which in turn is in the" Em "position (like" receiver "), a connection to the input 8 and in the" Se "position (like" transmitter ") to the output A. the circuit arrangement. The input 8 is also connected to the first input of the modulo-2 adder 7 , the second input of which is connected to the core output 6 of the cryptological core C and the output of which is connected to the output A of the circuit arrangement.

The changeover switches 31 and 32 can be implemented as electronic changeover switches with control inputs 36 and 37 . These are in turn controlled by correspondingly assigned bits of a control register 38 . This control register 38 can z. B. can be set via a microprocessor bus 39 . The control register 38 can be subordinate to a stack of further registers 40 (stack registers), the content of which can successively replace the content of the control register 38 by means of a pulse supplied via a sliding input 41 .

Furthermore, a counter 42 is provided which is incremented by 1 with each transmitted bit at output A, as long as an AND gate 44 and an OR gate 45 permit this. It can be reset to zero via a reset input 43 . This takes place via the AND gate 44 and the OR gate 45 if a binary "1" has been decrypted, if the AND gate 44 is released via its second input from the control register 38 or if a comparator 46 matches the counter reading with the Contents of a counter register 47 determines.

This counter register 47 can also be loaded from the outside (bus 50 ) and can be provided with a stack 48 which is switched on by the same pulse as the stack 40 of the control register 38 . This step forward pulse is supplied by the comparator 46 and also resets the counter 42 when the counter 42 has counted up to the content (limit value) stored in the counter register 47 .

If a sequence of binary zeros is now encrypted in the output or chip feedback mode on the sending side and z. B. the content of the counter register 47 is "30", the AND gate 44 is released by the content of the control register 38 , the changeover switch 32 is in the "Em" position and the changeover switch 31 is in the "CF" position, the comparator 46 give a pulse when thirty consecutive zeros have been decrypted correctly as synchronization bits, because the counter 42 continues to count to "30" with each transmitted zero, because only at this counter reading can a binary one from the comparator 46 reach the reset input 43 . The stack 40 of the control register 38 is then switched on and, if it was loaded accordingly, set the changeover switch 31 to the "OF" position. The receiver according to FIG. 1 now runs in output feedback mode, so it no longer has an error multiplication and the cryptosynchronization has been successfully completed.

If after switching to synchronism the output feedback mode is switched over, the control register 38 continues to output a "one" to the AND gate 44 via the line 49 . As a result, the binary "ones" contained in the useful bits (plain text bits), which appear irregularly at output A, can always reset the counter 42 via its reset input 43 , so that the counter only has the limit value (eg "30") in the counter register 47 can still achieve if, by chance, a bit sequence appears in plain text that corresponds to the synchronization bit pattern agreed between the transmitter and receiver (here: the sequence of zeros mentioned above). Then line 41 causes the respective contents of the next (shadow) register of the stack registers 40 to 48 to reach the control register 38 or counter register 47 . In the simplest case, these and all subsequent shadow registers have the same content as the content already reached when registering 40 or 48 , so that nothing changes if a synchronization bit sequence appears in plain text after synchronization.

If, on the other hand, it is desired that a change occur in plain text when a synchronization bit sequence occurs, the registers lying one above the other in the stacks 40 , 48 can also be given different contents. This can be useful for other possible applications that are not the subject of the invention.

Otherwise, the stacks 40 and 48 are designed such that after the last and lowest stack contents have been loaded into the control register 38 or counter register 47, their content no longer changes.

The AND gate 44 allows the operating mode to be switched over via a line 49 from the control register 38 : If a binary zero is placed on the line 49 and the AND gate 44 is thus blocked, the counter can no longer be reset by ones from the output A. . Rather, the stacks are switched on and thus the switch 31 switches from "CF" to "OF" undeterred when the counter 42 has reached the limit value in the counter register 47 .

Claims (2)

1. Circuit arrangement for encrypting or decrypting a serial data bit stream, consisting of a cryptological core (C) which can be loaded with a key via a first input and whose second input ( 2 ) can be supplied with a bit sequence via a changeover switch ( 31 ) in a position (OF) of the switch ( 31 ) is removed from the core output ( 6 ) of the cryptological core (C), the input ( 8 ) of the circuit arrangement also being connected to the first input of a modulo-2 adder ( 7 ), whose second input is connected to the core output ( 6 ) of the cryptological core (C) and whose output is connected to the output (A) of the circuit arrangement, characterized in that the second input ( 2 ) of the cryptological core (C) is in at least a second position (CF) of the changeover switch ( 31 ) can optionally be connected to the first input ( 8 ) and the output (A) of the modulo-2 adder ( 7 ), that a control register for controlling the changeover switch ( 31 ) ( 38 ) is provided that the controller performs depending on a predeterminable number of error-free bits decoded as synchronization bits at the output (A), and that the control register ( 38 ) is subordinate to a stack of further registers ( 40 ), the content of which is provided by a a pulse input ( 41 ) fed pulse can replace the content of the control register ( 38 ). 2. Circuit arrangement according to claim 1, characterized in that the control register ( 38 ) or the stack ( 40 ) from the outside, for. B. can be loaded via a microprocessor bus ( 39 ).