JP2013182148A - Information processing apparatus, information processing method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To accelerate cipher processing by software (program).SOLUTION: According to a program defining a cipher processing sequence, data conversion processing S121 generates bit slice expression data based on two or more pieces of plaintext data, key conversion processing S111 generates a bit slice expression key based on a cipher key of each plaintext, key schedule processing S112 generates a round key based on the bit slice expression key, cipher processing S122 executes cipher processing including computation of a block unit of the bit slice expression data, movement, round key application computation, etc., and data inverse conversion processing S123 generates two or more pieces of ciphered data corresponding to the two or more pieces of plaintext data by data inverse conversion to cipher processing results. In the key schedule processing S112 of generating the round key, the round key is generated by the processing of the computation and movement or the like of a bit slice expression key block unit composed of the data of the same order of the bit of the respective cipher keys configuring the bit slice expression key.

Description

  The present disclosure relates to an information processing device, an information processing method, and a program. More specifically, the present invention relates to an information processing apparatus, an information processing method, and a program that realize high-speed encryption processing of a large amount of data.

  With the development of the information society, the importance of information security technology for safeguarding the information handled is increasing. One of the components of information security technology is encryption technology, which is currently used in various products and systems.

  For example, communication via a network such as the Internet is actively performed, and various devices such as a PC, a portable terminal, an RFID, and various sensors are connected to the network for communication. In such an environment, information security technology for realizing a network society that enhances convenience while protecting personal privacy is indispensable, and encryption technology that is safe and capable of high-speed processing is required. Yes.

For example, a server collects information transmitted from a terminal owned by an individual or information acquired through a sensor installed at home, and the server uses a system that performs various data processing and analysis on the collected information Has been.
Specifically, for example, a system that installs sensors in homes and offices to manage power consumption, a service that is used for health and safety management by placing sensors in single-person nursing homes, and sensors on roads and vehicles. Traffic systems used to detect and relieve traffic jams.

  Data collected in such a system often includes personal privacy information, and it is desirable to encrypt the data for privacy protection. However, hardware mounted with a conventional cryptographic algorithm that is not a lightweight cryptographic algorithm designed for mounting on a small hardware has a large module scale and is difficult to mount on a small device such as an RFID or a sensor. In addition, there are many problems in terms of operability, such as difficulty in realization at low cost, and high power consumption and high frequency of battery replacement.

Under such circumstances, there is a growing need for lightweight encryption technology suitable for mounting on devices with limited resources such as hardware scale and memory, and devices that require power saving.
In response to these needs, research and development of lightweight encryption technology is progressing, and in recent years, several new lightweight block ciphers that are excellent in terms of small hardware implementation have been proposed. Representative examples include PRESENT, CLEFIA, KATAN, and Piccolo.

  Along with this, international standardization of lightweight encryption technology has been promoted, and international standardization of information security technology under the joint technical committee of International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC). The ISO / IEC JTC 1 / SC 27 committee is currently working on standardization of the international standard ISO / IEC 29192 for lightweight cryptography.

Many of the lightweight block ciphers, which are one of the lightweight cryptographic techniques, are optimized for small hardware implementation.
That is, many are designed with a structure in which a “light” round function using a large number of small S-boxes such as 4 bits and bit operations is repeated many times so that the size can be reduced when the hardware is mounted.
This lightweight cryptographic structure cannot take full advantage of the evolving general-purpose processor, and there is a problem that the software implementation on a PC or server is generally slow.

  As an example of processing by software implementation on a PC or a server, the use of cloud computing using a device connected to a network can be considered, but a cross channel (Cross VM) side channel attack is also a threat on the cloud. [Non-Patent Document 1]. In the cloud, there is a case where a multi-tenant method in which a plurality of users share a single server and a virtual machine VM occupied by the user is separated, but physical devices such as a memory and a cache are shared. An inter-virtual machine side-channel attack is a detection of a “malicious VM” sharing a set associative cache hitting the cache continuously and accessing other VMs due to a delay in the cache response. It is an attack that derives a key. Thus, when performing cryptographic processing on the cloud by software implementation, resistance to such side channel attacks is also an issue.

Thomas Ristenpart, Eran Tromer, Hovav Shacham, Stefan Savage, “Hey, You, Get Off of My Clau. Eli Biham, “A Fast New DES Implementation in Software”, FSE '97, 1997.

The present disclosure has been made in view of, for example, the above-described situation, and an object thereof is to provide an information processing apparatus, an information processing method, and a program that realize high-speed encryption processing of a large amount of data.
Further, in an embodiment of the present disclosure, an information processing apparatus, an information processing method, and an information processing method capable of performing high-speed processing when cryptographic processing is executed by applying software (program) operable on a general-purpose processor; The purpose is to provide a program.

The first aspect of the present disclosure is:
A data processing unit that executes data processing according to a program that defines an encryption processing sequence;
The data processing unit, according to the program,
Data conversion processing for generating bit slice expression data by bit slice processing for a plurality of plaintext data to be encrypted;
A key conversion process for generating a bit slice expression key by a bit slice process for each of the plurality of plaintext data encryption keys;
Key schedule processing for inputting the bit slice expression key and generating a round key for each round in cryptographic processing;
An encryption process applying the round key to the bit slice representation data;
A data reverse conversion process for generating a plurality of encrypted data corresponding to the plurality of plaintext data by performing an inverse conversion of the bit slice process with respect to a result of the encryption process,
In the key schedule process,
The same bit or every nth bit of each encryption key constituting the bit slice representation key, where n is a power of 2.
In the information processing apparatus for generating the round key by applying arithmetic processing and movement processing in units of bit slice expression key blocks configured by:

  Furthermore, in an embodiment of the information processing apparatus according to the present disclosure, the data processing unit is configured to use the same bit or every n-th bit of each plaintext data constituting the bit slice expression data in the data conversion process, where n Executes a process of storing a bit slice representation data block constituted by a power of 2 in the register as a processing unit, and storing the bit slice representation key block in the register as a processing unit in the key conversion process And executing cryptographic processing applying block-wise arithmetic processing and moving processing using the bit slice representation data block stored in the register and the bit slice representation key block as a unit. .

  Furthermore, in an embodiment of the information processing apparatus according to the present disclosure, the data processing unit performs a process of distributing and storing in a plurality of registers using the bit slice expression key block as a processing unit in the key conversion process. In the key schedule processing, a round operation is performed on the bit slice representation key block stored in the plurality of registers by performing arithmetic processing between the plurality of registers and shifting and shuffling of each register storage block. Generate a key.

  Furthermore, in an embodiment of the information processing apparatus according to the present disclosure, the data processing unit performs an unpacking process in which the block selected from the storage blocks of the plurality of registers is re-stored in one register in the key schedule process. To do.

  Furthermore, in an embodiment of the information processing apparatus according to the present disclosure, the data processing unit is configured to perform a plurality of bit slice expression key blocks of a plurality of registers storing the bit slice expression key blocks in the key schedule process. A round key is generated by executing an exclusive OR operation with a round counter indicating the round number of each round in the cryptographic process.

  Furthermore, in an embodiment of the information processing apparatus according to the present disclosure, the data processing unit uses a predetermined logical instruction sequence for the bit slice expression key block stored in the plurality of registers in the key schedule processing. By executing the calculation according to the above, a non-linear transformation process (Sbox) is executed to generate a round key.

  Furthermore, in an embodiment of the information processing apparatus according to the present disclosure, the data processing unit is configured to perform non-linear conversion processing in units of registers on the bit slice expression key blocks stored in the plurality of registers in the key schedule processing. (Sbox) is executed to generate a plurality of round key generations together.

  Furthermore, in an embodiment of the information processing apparatus according to the present disclosure, the data processing unit executes cryptographic processing according to a cryptographic algorithm PRESENT according to a program in the cryptographic processing.

Furthermore, the second aspect of the present disclosure is:
A data processing unit that executes data processing according to a program that defines a decoding processing sequence;
The data processing unit, according to the program,
Data conversion processing for generating bit slice expression data by bit slice processing for a plurality of encrypted data to be decrypted;
A key conversion process for generating a bit slice expression key by a bit slice process for each encryption key of the plurality of encrypted data;
A key schedule process for inputting the bit slice expression key and generating a round key for each round in the decryption process;
Decryption processing applying the round key to the bit slice representation data;
By performing an inverse transform of the bit slice process on the result of the decryption process, a data inverse transform process for generating a plurality of plaintext data corresponding to the plurality of encrypted data is performed,
In the key schedule process,
The same bit or every nth bit of each encryption key constituting the bit slice representation key, where n is a power of 2.
In the information processing apparatus for generating the round key by applying arithmetic processing and movement processing in units of bit slice expression key blocks configured by:

Furthermore, in an embodiment of the information processing apparatus according to the present disclosure, the data processing unit, in the data conversion process, the same bit or every n-th bit of each encrypted data constituting the bit slice expression data, n is a power of 2,
Execute the process of storing in the register in units of the bit slice representation data block configured by
In the key conversion process, a process of storing in a register in units of the bit slice expression key block is performed,
In the decryption process,
The block slice calculation data block stored in the register and the block slice calculation process and the shift process using the bit slice expression key block as a unit are executed.

  Furthermore, in an embodiment of the information processing apparatus according to the present disclosure, the data processing unit performs a process of distributing and storing in a plurality of registers using the bit slice expression key block as a processing unit in the key conversion process. In the key schedule processing, a round operation is performed on the bit slice representation key block stored in the plurality of registers by performing arithmetic processing between the plurality of registers and shifting and shuffling of each register storage block. Generate a key.

  Furthermore, in an embodiment of the information processing apparatus according to the present disclosure, the data processing unit performs an unpacking process in which the block selected from the storage blocks of the plurality of registers is re-stored in one register in the key schedule process. To do.

Furthermore, the third aspect of the present disclosure is:
An information processing method executed in an information processing apparatus,
In the data processing unit of the information processing apparatus, according to a program that defines an encryption processing sequence,
Data conversion processing for generating bit slice expression data by bit slice processing for a plurality of plaintext data to be encrypted;
A key conversion process for generating a bit slice expression key by a bit slice process for each of the plurality of plaintext data encryption keys;
Key schedule processing for inputting the bit slice expression key and generating a round key for each round in cryptographic processing;
An encryption process applying the round key to the bit slice representation data;
A data reverse conversion process for generating a plurality of encrypted data corresponding to the plurality of plaintext data by performing an inverse conversion of the bit slice process with respect to a result of the encryption process,
In the key schedule process,
The same bit or every nth bit of each encryption key constituting the bit slice representation key, where n is a power of 2.
There is an information processing method for generating the round key by applying arithmetic processing and movement processing in units of a bit slice expression key block configured by:

Furthermore, the fourth aspect of the present disclosure is:
An information processing method executed in an information processing apparatus,
In the data processing unit of the information processing apparatus, according to a program that defines a decoding processing sequence,
Data conversion processing for generating bit slice expression data by bit slice processing for a plurality of encrypted data to be decrypted;
A key conversion process for generating a bit slice expression key by a bit slice process for each encryption key of the plurality of encrypted data;
A key schedule process for inputting the bit slice expression key and generating a round key for each round in the decryption process;
Decryption processing applying the round key to the bit slice representation data;
By performing an inverse transform of the bit slice process on the result of the decryption process, a data inverse transform process for generating a plurality of plaintext data corresponding to the plurality of encrypted data is performed,
In the key schedule process,
The same bit or every nth bit of each encryption key constituting the bit slice representation key, where n is a power of 2.
There is an information processing method for generating the round key by applying arithmetic processing and movement processing in units of a bit slice expression key block configured by:

Furthermore, the fifth aspect of the present disclosure is:
A program for executing cryptographic processing in an information processing device,
In the data processing unit of the information processing apparatus,
Data conversion processing for generating bit slice expression data by bit slice processing for a plurality of plaintext data to be encrypted;
A key conversion process for generating a bit slice expression key by a bit slice process for each of the plurality of plaintext data encryption keys;
Key schedule processing for inputting the bit slice expression key and generating a round key for each round in cryptographic processing;
An encryption process applying the round key to the bit slice representation data;
By performing an inverse conversion of the bit slice process on the result of the encryption process, a data inverse conversion process for generating a plurality of encrypted data corresponding to the plurality of plaintext data is executed,
In the key schedule process,
The same bit or every nth bit of each encryption key constituting the bit slice representation key, where n is a power of 2.
There is a program for executing a process of generating the round key by applying a calculation process and a transfer process in units of a bit slice expression key block constituted by:

Furthermore, the sixth aspect of the present disclosure is:
A program for executing a decryption process in an information processing device,
In the data processing unit of the information processing apparatus,
Data conversion processing for generating bit slice expression data by bit slice processing for a plurality of encrypted data to be decrypted;
A key conversion process for generating a bit slice expression key by a bit slice process for each encryption key of the plurality of encrypted data;
A key schedule process for inputting the bit slice expression key and generating a round key for each round in the decryption process;
Decryption processing applying the round key to the bit slice representation data;
By performing an inverse transformation of the bit slice process on the result of the decryption process, a data inverse transformation process for generating a plurality of plaintext data corresponding to the plurality of encrypted data is executed,
In the key schedule process,
The same bit or every nth bit of each encryption key constituting the bit slice representation key, where n is a power of 2.
There is a program for executing a process of generating the round key by applying a calculation process and a transfer process in units of a bit slice expression key block constituted by:

  Note that the program of the present disclosure is a program provided by, for example, a storage medium to an information processing apparatus or a computer system that can execute various program codes. By executing such a program by the program execution unit on the information processing apparatus or the computer system, processing according to the program is realized.

  Other objects, features, and advantages of the present disclosure will become apparent from a more detailed description based on embodiments of the present invention described later and the accompanying drawings. In this specification, the system is a logical set configuration of a plurality of devices, and is not limited to one in which the devices of each configuration are in the same casing.

According to an embodiment of the present disclosure, high-speed software (program) encryption processing is realized.
Specifically, a data processing unit that executes data processing according to a program that defines a cryptographic processing sequence generates bit slice representation data based on a plurality of plaintext data and a bit slice representation key based on each plaintext encryption key. , Execute cryptographic processing including round key generation based on the bit slice expression key, block unit calculation of the bit slice expression data, movement, round key application calculation, etc. A plurality of corresponding encrypted data is generated. In the key schedule process for generating a round key, a round key is generated by processing such as calculation and movement in units of bit slice expression key blocks composed of the same bit data of each encryption key constituting the bit slice expression key.
Thus, in round key generation and encryption processing, processing is performed by calculation and movement processing in units of bit slice representation blocks stored in a register, and generation of multiple encrypted data and decryption processing for multiple encrypted data Can be executed collectively, and a large amount of data can be processed at high speed.

Note that in the decoding processing according to an embodiment of the present disclosure, processing is performed by calculation or movement processing in units of bit slice expression blocks stored in a register, and a large amount of data can be processed at high speed. Specifically, when the cryptographic algorithm [PRESENT (key length 80 bits)] is executed on the Intel Core i7 870 processor, 11.06 cycles / bytes and the cryptographic algorithm [Piccolo (key length 80 bits)] are executed. In this case, a high speed of 5.59 cycles / byte is achieved. In particular, the speed of Piccolo exceeds the speed record of 6.92 cycles / byte of the US government standard cipher AES on the same platform (Intel Core i7 920) which has been conventionally known.
Furthermore, in the bit slice implementation according to an embodiment of the present disclosure, the S-box is calculated by a logical operation instead of a table reference, so that it is possible to increase resistance to side channel attacks such as a cache attack and an attack between virtual machines. . Furthermore, the speedup of cryptographic processing by software in cloud computing processing can complete cryptographic processing in a smaller number of cycles, leading to lower power consumption of the cloud and data center.

Furthermore, in the system according to an embodiment of the present disclosure, it is not necessary to introduce dedicated hardware for cryptographic processing in the cloud or data center, and scalability is improved.
Furthermore, since it is possible to utilize in the cloud, which has been difficult for lightweight cryptography, implementation of lightweight cryptography in sensors is promoted, and a sensor network with low cost and low power consumption can be realized.

It is a figure explaining an example of the system which can apply the processing of this indication. It is a figure explaining the operation example of the system which can apply the process of this indication. FIG. 3 is a diagram for describing an example of processing executed in a server configuring a system to which the processing of the present disclosure illustrated in FIGS. 1 and 2 can be applied. FIG. 3 is a diagram illustrating a sequence example of processing executed in a server that configures a system to which the processing of the present disclosure illustrated in FIGS. 1 and 2 can be applied. FIG. 3 is a diagram illustrating a sequence example of processing executed in a server that configures a system to which the processing of the present disclosure illustrated in FIGS. 1 and 2 can be applied. It is a figure explaining the processing sequence of the encryption processing algorithm PRESENT. It is a figure explaining the process sequence of the encryption process of this indication. It is a figure explaining the example of a production | generation process of the bit slice expression key data by the key conversion process of key data. It is a figure explaining the example of a production | generation process of the bit slice expression data by the data conversion process. It is a figure which shows an example of the register storage data in a key schedule process. It is a figure which shows an example of the register storage data in a key schedule process. It is a figure which shows the flowchart explaining the sequence of a key schedule process. It is a figure which shows the flowchart explaining the detailed process sequence of the round key production | generation update process performed in a key schedule process. It is a figure which shows the register storing data in a key schedule process, and a processing example. It is a figure which shows the register storing data in a key schedule process, and a processing example. It is a figure which shows the register storing data in a key schedule process, and a processing example. It is a figure explaining the logic command sequence of the nonlinear transformation process (Sbox) in a key schedule process. It is a figure which shows the register storing data in a key schedule process, and a processing example. It is a figure which shows the register storing data in a key schedule process, and a processing example. It is a figure which shows the register storing data in a key schedule process, and a processing example. It is a figure which shows the register storing data in a key schedule process, and a processing example. It is a figure which shows the register storing data in a key schedule process, and a processing example. It is a figure which shows the register storing data in a key schedule process, and a processing example. It is a figure which shows the register storing data in a key schedule process, and a processing example. It is a figure which shows the register storing data in a key schedule process, and a processing example. It is a figure which shows the register storing data in a key schedule process, and a processing example. It is a figure which shows the flowchart explaining the sequence of a key schedule process. It is a figure which shows the flowchart explaining the detailed sequence of the prior calculation process of the nonlinear transformation process (Sbox) performed in a key schedule process. It is a figure which shows the flowchart explaining the detailed sequence of the prior calculation process of the nonlinear transformation process (Sbox) performed in a key schedule process. It is a figure which shows the register storage data and the example of a process in the prior calculation process of a nonlinear transformation process (Sbox). It is a figure which shows the register storage data and the example of a process in the prior calculation process of a nonlinear transformation process (Sbox). It is a figure which shows the register storage data and the example of a process in the prior calculation process of a nonlinear transformation process (Sbox). It is a figure which shows the register storage data and the example of a process in the prior calculation process of a nonlinear transformation process (Sbox). It is a figure which shows the register storage data and the example of a process in the prior calculation process of a nonlinear transformation process (Sbox). It is a figure which shows the register storage data and the example of a process in the prior calculation process of a nonlinear transformation process (Sbox). It is a figure which shows the register storage data and the example of a process in the prior calculation process of a nonlinear transformation process (Sbox). It is a figure which shows the register storage data and the example of a process in the prior calculation process of a nonlinear transformation process (Sbox). It is a figure which shows the register storage data and the example of a process in the prior calculation process of a nonlinear transformation process (Sbox). It is a figure which shows the register storage data and the example of a process in the prior calculation process of a nonlinear transformation process (Sbox). It is a figure which shows the register storage data and the example of a process in the prior calculation process of a nonlinear transformation process (Sbox). It is a figure which shows the register storage data and the example of a process in the prior calculation process of a nonlinear transformation process (Sbox). It is a figure which shows the register storage data and the example of a process in the prior calculation process of a nonlinear transformation process (Sbox). It is a figure which shows the register storage data and the example of a process in the prior calculation process of a nonlinear transformation process (Sbox). It is a figure which shows the register storage data and the example of a process in the prior calculation process of a nonlinear transformation process (Sbox). It is a figure which shows the register storage data and the example of a process in the prior calculation process of a nonlinear transformation process (Sbox). It is a figure which shows the flowchart explaining the sequence of a round key production | generation update process. It is a figure which shows the register storage data in a round key generation update process, and a processing example. It is a figure which shows the register storage data in a round key generation update process, and a processing example. It is a figure which shows the register storage data in a round key generation update process, and a processing example. It is a figure which shows the register storage data in a round key generation update process, and a processing example. It is a figure which shows the register storage data in a round key generation update process, and a processing example. It is a figure which shows the register storage data in a round key generation update process, and a processing example. It is a figure which shows the register storage data in a round key generation update process, and a processing example. It is a figure which shows the register storage data in a round key generation update process, and a processing example. It is a figure which shows the register storage data in a round key generation update process, and a processing example. It is a figure which shows the register storage data in a round key generation update process, and a processing example. It is a figure which shows the flowchart explaining the detailed sequence of an encryption process. It is a figure which shows the hardware structural example which performs the encryption process which an encryption process part performs. It is a figure explaining the register storage data at the time of execution of encryption processing, and a data processing example. It is a figure explaining the example of data processing at the time of execution of encryption processing. It is a figure which shows the flowchart explaining the detailed sequence of the linear transformation process performed in the case of an encryption process. It is a figure explaining the register storage data at the time of the linear transformation process performed in the case of an encryption process, and a processing example. It is a figure explaining the register storage data at the time of the linear transformation process performed in the case of an encryption process, and a processing example. It is a figure explaining the register storage data at the time of the linear transformation process performed in the case of an encryption process, and a processing example. It is a figure explaining the register storage data at the time of the linear transformation process performed in the case of an encryption process, and a processing example. It is a figure explaining the register storage data at the time of the linear transformation process performed in the case of an encryption process, and a processing example. It is a figure explaining the register storage data at the time of the linear transformation process performed in the case of an encryption process, and a processing example. It is a figure explaining the register storage data at the time of the linear transformation process performed in the case of an encryption process, and a processing example. It is a figure explaining the register storage data at the time of the linear transformation process performed in the case of an encryption process, and a processing example. It is a figure explaining the register storage data at the time of the linear transformation process performed in the case of an encryption process, and a processing example. It is a figure which shows the example of an apparatus structure which performs an encryption process.

Hereinafter, the details of the information processing apparatus, the information processing method, and the program according to the present disclosure will be described with reference to the drawings. The description will be made according to the following items.
1. 1. An example of a system to which the configuration of the present disclosure can be applied 2. Lightweight block cipher algorithm “PRESENT” 3. Outline of configuration and processing sequence of information processing apparatus (encryption processing apparatus) 4. Key conversion process and data conversion process Key schedule processing (Key schedule processing example 1)
6). Key schedule processing (Key schedule processing example 2)
6-1. Non-linear transformation (Sbox) pre-calculation process 6-2. 6. Round key generation and update processing About cryptographic processing ８． 8. Configuration examples of information processing apparatus and cryptographic processing apparatus Summary of composition of this disclosure

[1. An example of a system to which the configuration of the present disclosure can be applied]
For example, a configuration is assumed in which information is collected from a communication terminal such as a mobile phone or a smartphone owned by each individual, an RFID attached to various articles, or a sensor disposed in each house and processed in the server.
A large number of devices on the information transmission side can be equipped with small hardware that executes an encryption processing algorithm to generate and transmit encrypted data at high speed.

However, on the other hand, the server needs to receive a large amount of encrypted data transmitted by these many terminals and sensors and perform decryption processing. It is also assumed that the server must generate a large number of encrypted data to be transmitted to a large number of terminals.
In the future, it is expected that the needs for collecting, analyzing and utilizing such vast and diverse big data will increase.

  It is considered that the use of cloud computing is effective for processing such an enormous amount of data. For example, cloud computing is used to analyze a large amount of encrypted data collected from a large number of terminals and sensors, etc., and cryptographic processing (encryption and encryption) is applied using software that can run on a general-purpose processor of a server on the network. (Including both decoding processes).

  For RFID and sensors, it is most important to be able to implement at low cost and low power consumption. Encryption with lightweight encryption is the best option, but as mentioned above, lightweight encryption is a general-purpose processor for servers in the cloud. The usual software implementations that operate above typically have the problem of being slow.

Cloud computing has the advantage of using many information processing devices connected via a network for processing, but all devices connected to the network are equipped with hardware that executes specific cryptographic processing algorithms. Therefore, increasing the speed is a cost disadvantage.
In cases where a large amount of encrypted data is collected, uploaded to a cloud configuration server, and analyzed in the cloud, the scale-out is performed using software (programs) that can be executed on many inexpensive servers. This method is considered desirable.

  As described above, for example, when performing encryption processing using a technique such as cloud computing, it is required to perform encryption processing (encryption processing and decryption processing) using software (program). However, as described above, there is a problem that the processing speed of the cryptographic processing according to the software is reduced in the lightweight encryption, and there is a demand for a method for realizing an increase in the processing speed.

  There are various cryptographic algorithms, but one of basic techniques is called a block cipher. Since the normal software implementation of the block cipher implements Sbox that performs non-linear transformation processing with a table reference, a cache attack may be a threat. A cache attack is a side-channel attack, which is a timing attack for deriving an encryption key using the fact that the memory access time varies depending on the presence or absence of a cache hit.

The configuration of the present disclosure solves such a problem, for example. An example of a system to which the configuration of the present disclosure can be applied will be described with reference to FIG.
As a system to which the configuration of the present disclosure can be applied, for example, there is a network system as shown in FIG.
FIG. 1 shows a cloud 10 including a sensor network 20 to which a plurality of end nodes are connected, and a network connection server group that collects transmission data of the end nodes and performs data processing.

For example, the terminal node is a personal terminal owned by the user, a mobile terminal such as a mobile phone, a smart phone, or a tablet terminal, or a power consumption detection sensor disposed in a home or office, or a nursing home for safety and health management information. Sensors and health care devices that collect data, terminals and sensors that are used to detect and relieve traffic congestion on roads and vehicles, and various other devices.
Hereinafter, these various terminal node components will be collectively described as sensors. The sensor includes the various devices described above.

The sensor which comprises a terminal node transmits various information to the cloud 10 comprised by the network connection server group which performs a data process.
In many cases, the transmission data is provided to a network connection server configuring the cloud 10 via, for example, a relay node.

Data collected by such a system often includes, for example, personal privacy and confidential information, and is encrypted and transmitted to prevent data leakage.
The sensor performs encryption of the transmission data and transmits the encrypted data. For example, the sensor is mounted with dedicated hardware that executes a lightweight encryption algorithm, and encryption is performed using the dedicated hardware. As the encryption key for encryption, an individual encryption key held in the memory of each sensor, or a key that can be derived from the sensor ID by a predetermined calculation, for example, is used.

The number of sensors is enormous, and as shown in FIG. 2, each sensor assigns a sensor ID to the encrypted data and transmits it to the cloud.
In the example shown in FIG. 2, the end nodes A, B, and C are shown as representative examples of the data transmission node. Each node performs encryption of transmission data by applying an encryption key that is a node unique key to generate a block (for example, 64 bits) composed of the encrypted data, and each sensor ( A sensor ID, which is an identifier of the terminal node, is assigned and transmitted.
A large amount of encrypted data is also transmitted from a large number of sensors other than the sensors A to C shown as representative examples to a server on the cloud, for example, the server S30 shown in FIG.

  In the embodiment described below, the data length of the encrypted data generated by each sensor is described as one block length of the lightweight block cipher algorithm used for the encryption process. One block is data of fixed bits such as 64 bits. Each sensor generates and transmits a 64-bit encrypted block by an encryption process using a sensor unique key (for example, 80 bits).

  The data of the encrypted data generated by each sensor is not limited to one block, and may be a plurality of blocks. Each sensor transmits data in which the correspondence between each encrypted data block and the sensor ID is clarified. For example, when data order information of each block is necessary, the serial number and time stamp indicating the data order are included in the data, and these are given as block attribute information and transmitted.

  If the sensor network is managed in a tree structure, for example, the transmission data from the sensor that is the terminal node is transmitted from the sensor (terminal node) to the root node that is set as a relay node and a higher node of the relay node. , Sent from the root node to the server on the cloud.

(Outline of processing on cloud server)
Next, in the network system described with reference to FIGS. 1 and 2, an outline of processing executed by a server on the cloud that performs processing by collecting transmission data of sensors (terminal nodes) will be described.

  A server on the cloud collects a large number of encrypted data blocks transmitted from a large number of sensors (terminal nodes), and executes a cryptographic process to which software (program) operable on a general-purpose processor is applied. For example, a process for decrypting a large number of encrypted data is executed. Alternatively, a process for generating a large number of encrypted data to be transmitted to each terminal node is performed.

The server executes bit slice encryption processing as encryption processing (including encryption and decryption processing) to which software (program) is applied.
In the following description, “encryption processing” includes both data encryption processing and decryption processing.
Bit-slice encryption (including encryption and decryption) is a process proposed by Biham in 1997, showing that a class of cryptographic algorithms can be implemented faster than traditional software implementations with bit-slice implementations. It was.

  Regarding bit slice encryption processing, see Non-Patent Document 2 [Eli Biham, “A Fast New DES Implementation in Software”, FSE '97, 1997. ] For details. In the most basic bit slice implementation, data is cut out in bit units from the beginning of a plurality of data blocks to be encrypted, and the same bit or every nth bit cut out from each data block, where n is 2 , 4, 8, 16, 64, 128, etc., and a new block (bit slice expression data block) composed of a set of data of these bits is set and processed.

For example, an example of bit slice decryption processing in a case where individual encrypted data transmitted by each sensor is decrypted will be described with reference to FIG.
FIG. 3 shows the server S30 shown in FIG.
(A) Retained data (B) Cryptographic processing sequence (decryption)
The figure explaining these is shown.

In the data held by the server shown in FIG.
The encryption key 31 is data that the server S30 holds in advance as a key unique to each sensor (terminal node).
Each of the sensor ID 32 and the encrypted data 33 is data received from each sensor via a network.
Based on the sensor ID, the encryption key applied to the encryption processing of each encrypted data can be selected.

FIG. 3B is a diagram illustrating processing executed in the cryptographic processing unit 50 of the server S30. The cryptographic processing unit 50 shown in the figure is a data processing unit configured by a CPU or the like having a program execution function, and performs cryptographic processing (encryption processing) by data processing according to a program that defines a predetermined cryptographic algorithm sequence. Or decryption processing). That is, cryptographic processing to which software (program) is applied is executed.
FIG. 3B shows a processing example when decrypting encrypted data received from each sensor via the network.

  First, the server applies the sensor ID 32 added to the encrypted data 33 to select the encryption key 31 used for each decryption. The server on the cloud holds the encryption key used by each sensor as management data associated with the sensor ID. Or it is good also as a structure which derive | leads out the encryption key peculiar to each sensor from each sensor ID by predetermined | prescribed calculation.

As shown in FIG. 3B, the server arranges the encryption keys 31 of the sensors in the order corresponding to the blocks of the encrypted data 33 generated by the sensors.
When the encrypted data 33 and the encryption key 31 having a predetermined number of blocks defined in advance as the processing unit of the bit slice encryption process are prepared, the data decryption process according to the bit slice encryption process is performed.

As described above, in the bit slice encryption process, data is cut out in bit units from the beginning of each block to be encrypted, and the same bit or every n bits of each block, where n is 2, 4, Processing is performed by setting a power of 2 such as 8, 16, 64, 128, and a set of data of these bits (bit slice expression data block).
First, the server
From a large number of encrypted data blocks constituting the encrypted data 33 received from a large number of sensors,
A block (bit slice representation data block) in which only the 1st bit is collected,
A block (bit slice representation data block) that collects only the second bit,
A block in which only data at the same bit position is collected until the final bit (bit slice expression data block),
These multiple bit slice representation data blocks are generated.

In this way, the server generates a plurality of bit slice representation data blocks from a large number of encrypted data blocks constituting the encrypted data 33.
Further, with respect to the encryption key 31 applied to the generation of the encrypted data 33, the same processing, that is, a plurality of bit slice expression key blocks corresponding to a plurality of key data is generated.
Each of the encryption keys 31 is, for example, an encryption key block made up of 80-bit key data. For this encryption key 31, the same bit or every n bits of each encryption key block, where n is 2, 4 , 8, 16, 64, 128 and the like, and a set of data of these bits (bit slice expression key block) is set.

  This block conversion process is a process executed as the key conversion process (Key Conversion) in Step S11 and the data conversion process (Data Conversion) in Step S21 shown in the encryption processing unit 50 shown in FIG.

Processing based on the bit slice expression block generated by these bit slice processing is executed, and processing according to a predetermined encryption algorithm is executed.
In the apparatus of the present disclosure, software (program) performs operations (AND, OR, XOR, etc.) using the bit slice representation block as a processing unit, shift processing of register stored data, transposition processing of bit positions such as shuffle, etc. The process according to a predetermined encryption algorithm is executed.

  A round key is generated by key schedule processing (Key Scheduling) in Step S12 for the bit slice key data based on a large number of encryption keys 31 generated by the key conversion processing (Key Conversion) in Step S11 in the cryptographic processing unit 50 To do.

  On the other hand, in the data conversion process (Data Conversion) in step S21, a bit slice encrypted data block is generated by a bit slice process for a large number of encrypted data 33 received from the sensor. This bit slice block is set as a processing target of encryption processing (encryption processing and decryption processing) in the encryption processing (Data Processing) step of the next step S22.

  In the encryption process (Data Processing) in Step S22, an encryption process in which a round key is applied to the bit slice representation data block generated based on the encrypted data in the data conversion process (Data Conversion) in Step S21. The decryption process of the digitized data is executed.

In this encryption processing step, for example, processing according to a predetermined encryption algorithm such as addition with a round key (XOR) processing, linear conversion processing, and non-linear conversion processing is executed according to software (program).
In the key scheduling process in step S12, a round key to be applied in each round of the round calculation is generated.

In the next step S23, a data reverse conversion process (Data Conversion ^-1 ) is performed on the block group obtained as a result of the encryption process (Data Processing) in Step S22. By this processing, processing for returning the bit-sliced block to the original block is performed. By this processing, plain text data 70 corresponding to the encrypted data 33 sent from the sensor is generated.

4 and 5 show two sequence examples of processing executed in the server.
The flowchart shown in FIG. 4 shows a sequence when the step of preparing a decryption key for each block based on the sensor ID added to the encrypted data is performed after a predetermined number of blocks of encrypted data are prepared. It is a flowchart to explain.
The flowchart shown in FIG. 5 is a flowchart for explaining a sequence when the step of preparing the decryption key for each block is performed for each arrival of each ciphertext data block based on the sensor ID added to the encrypted data. It is.

First, the process of each step of the flow shown in FIG. 4 will be described.
First, in step S31, an encrypted data block sent from a node is received. This is combination data of the sensor ID 32 and the encrypted data 33 shown in FIG.

  Next, in step S32, it is determined whether or not a predetermined number of blocks of encrypted data previously defined as processing units have been received. If the predetermined number of blocks has not been reached, the process returns to step S31 and the reception process is continued.

If the predetermined number of blocks has been reached, the process proceeds to step S33, where the sensor ID added to the encrypted data is applied to select the encryption key (= decryption key) of each encrypted data.
Finally, in step S34, the correspondence set of the encrypted data and the encryption key is input to the encryption processing unit 50, and the decryption process according to the bit slice encryption process is executed.

The flow shown in FIG. 5 is a sequence for executing processing every time a ciphertext data block arrives.
First, in step S41, an encrypted data block sent from the node is received. This is combination data of the sensor ID 32 and the encrypted data 33 shown in FIG.

  Next, in step S42, the encryption key (= decryption key) of each encrypted data is selected by applying the sensor ID added to the encrypted data.

  Next, in step S43, it is determined whether or not a predetermined number of blocks of encrypted data previously defined as processing units have been received. If the predetermined number of blocks has not been reached, the process returns to step S41 to continue the reception process.

  When the predetermined number of blocks has been reached, the process proceeds to step S44, where a corresponding set of encrypted data and encryption key is input to the encryption processing unit 50, and decryption processing according to the bit slice encryption processing is executed.

  In the processing example described above, an example in which a large number of encrypted data is received from a sensor and decrypted by a server has been described. For example, the server generates encrypted data to be transmitted to a large number of user terminals and the like. In this case, a large number of encrypted data is generated by applying bit slice encryption processing to a large number of plaintext data. This encryption process is also executed by applying the configuration of the encryption processing unit 50 shown in FIG.

When encryption processing is performed, a large number of blocks composed of plaintext data and an encryption key corresponding to each plaintext data are input and the processing is executed to generate a large number of encrypted data.
For example, the encryption key corresponding to each plaintext data is selected and acquired from the storage unit based on the device ID of the transmission destination to which the encrypted data is transmitted, and the bit slice expression key is obtained by bit slice processing for the encryption key selected and acquired from the storage unit. Generate.
Furthermore, the bit slice representation data block based on the plaintext data and the bit slice representation key block based on the encryption key are applied, and the encryption processing is executed according to the processing sequence shown in the encryption processing unit 50 shown in FIG. , Generate and output encrypted data.

  The bit slice encryption process executed by the encryption processing unit 50 is executed as a process to which software (program) operable on a general-purpose processor is applied as described above. That is, in a device such as a PC that does not have a hardware configuration dedicated to a specific cryptographic algorithm, processing is performed by executing software (program) that defines an execution sequence of a cryptographic processing algorithm described below.

  As processing executed in accordance with software (program), for example, operations (AND, OR, XOR, etc.) between block data using bit slice expression block data stored in a register, and shift processing of data stored in a register Bit position movement, transposition processing, etc.

  When cryptographic processing according to software (program) is performed by, for example, a processor having a 64-bit register, it can be executed as SIMD (Single Instruction Multiple Datastream) type parallel processing that processes 64 blocks in parallel. In the basic bit slice implementation method, parallel processing is possible by the bit width of the processor. Since the transposition of the bit position frequently used in the encryption algorithm can be realized by the renaming process of the zero-cost register, the speed can be increased.

  Note that the number of blocks that can be processed in parallel in the bit slice encryption process varies depending on the encryption algorithm, the bit slice implementation algorithm, the processor architecture, the size of the register to be used, and the like. Settings such as 32, 64, and 128 are possible.

  In the bit slice cipher processing, the ciphertext blocks to be processed in parallel are independent of each other. Therefore, as long as the correspondence with the key data block is established, even if blocks received from a plurality of sensors are mixed, the reception order Regardless of the order, it does not matter. Another advantage of this system utilizing bit slice encryption processing is that decryption processing can be performed regardless of the order of encrypted sensing data received asynchronously from a large number of sensors.

One of the elements that have the greatest influence on the processing speed in the bit slice type encryption processing is nonlinear conversion processing (Sbox). An important point for realizing high speed is how many non-linear conversion processes can be expressed with a small number of logical operations (commands).
Since recent processors can issue a plurality of instructions at the same time, it is possible to reduce the constraints such as register dependency and to increase the processing speed so that it can be expressed as an instruction sequence that can be executed with as few cycles as possible.

[2. About lightweight block cipher algorithm “PRESENT”]
Next, a lightweight block encryption algorithm “PRESENT”, which is an example of an encryption processing algorithm executed by the present disclosure, will be described.
In the apparatus according to the present disclosure, “PRESENT”, which is a lightweight block cipher algorithm corresponding to a block size of 64 bits, a key length of 80 bits, and 128 bits, is executed as an encryption process to which a bit slice is applied.

An outline of a cryptographic processing sequence according to the lightweight block cipher algorithm “PRESENT” will be described with reference to FIG.
In the lightweight block cipher algorithm “PRESENT”, as shown in FIG. 6, a 64-bit plaintext block and, for example, an 80-bit encryption key are input.
First, a 64-bit round key is generated based on the 80-bit encryption key, and the following processing is performed.

(Step S71) Addition processing (exclusive OR operation: XOR) of the 64-bit plaintext block and the 64-bit round key is executed.
(Step S72) Further, a non-linear conversion process (SboxLayer) is performed on the addition result.
(Step S73) Further, a linear conversion process (pLayer) is performed on the nonlinear conversion result.

The round operation is repeatedly executed with the processing of steps S71 to S73, that is, the addition processing with the round key, the nonlinear conversion processing, and the linear conversion processing as one unit of round operation. For example, 31 rounds are repeatedly executed, and after the final round, an operation with the round key is executed again to generate and output a ciphertext.
Note that update processing (Update) based on input key data is sequentially executed to generate a round key (64 bits) to be applied to each round.

  The information processing apparatus according to the present disclosure executes, for example, encryption processing according to the lightweight block encryption algorithm “PRESENT” illustrated in FIG. 6 according to software (program) using a bit slice expression data block generated by bit slice processing as a processing unit. To do. Specifically, it realizes cryptographic processing according to software (program) that defines operations such as inter-block operations (AND, OR, XOR, etc.), register storage data shift processing, bit position transposition processing, etc. is there.

[3. Outline of configuration and processing sequence of information processing device (encryption processing device)]
The configuration and processing sequence of an information processing apparatus (encryption processing apparatus) that executes encryption processing according to “PRESENT” of the present disclosure will be described with reference to FIG.

FIG. 7 is a diagram illustrating the configuration and processing of the information processing apparatus 100.
The information processing apparatus 100 can be configured by, for example, a PC or the like, and can be configured as an apparatus that does not have dedicated hardware for executing cryptographic processing according to a specific algorithm.
Software (program) for executing encryption processing is stored in a memory, and processing according to the program is executed to perform encryption processing.

  The encryption processing unit 110 of the information processing apparatus 100 shown in FIG. 7 includes, for example, a data processing unit including a CPU having a program execution function, and a memory (RAM, ROM, register, etc.) that stores data, various parameters, and programs. The data processing unit (CPU or the like) is configured to perform cryptographic processing by executing the processing of steps S111 to S112 and steps S121 to S123 shown in the drawing according to the program.

In the following, an example of an encryption process in which plaintext data 82 and an encryption key 81 are input as input data 80 and encrypted data 91 is generated and output as output data 90 will be described.
As described above, the encryption processing unit 110 is shown in the figure both in the encryption process for encrypting plaintext data and generating encrypted data, and in the decryption process for decrypting encrypted data and generating plaintext data. Cryptographic processing is performed according to the processing of steps S111 to S112 and steps S121 to S123.
In the following, an embodiment in which encryption processing is performed will be described as one representative example of encryption processing and decryption processing.

The input data 80 is a plurality of encryption keys 81 and a plurality of plain text data 82.
These encryption keys and plaintext data are associated one-to-one. That is,
Plaintext data a encrypted with the encryption key a,
Plaintext data b encrypted with the encryption key b,
Plaintext data c encrypted with the encryption key c,
:
Plaintext data N encrypted with the encryption key N,
The cryptographic processing unit 110 inputs the set of N cryptographic keys and plaintext data as a processing unit and executes cryptographic processing.

Each of the plaintext data a, b, and c is constituted by a data block (for example, 64 bits) having a predetermined data length.
Similarly, each of the encryption keys a, b, and c is configured by a key data block (for example, 80 bits) having a predetermined data length.
Note that the bit size is an example, and various bit size data and keys can be set.

The encrypted data 91 generated as the output data 90 is the following data.
Encrypted data a encrypted with the encryption key a,
Encrypted data b encrypted with the encryption key b,
Encrypted data c encrypted with the encryption key c,
:
Encrypted data N encrypted with an encryption key N,
The encryption processing unit 110 generates and outputs these N pieces of encrypted data.

  For example, these N pieces of encrypted data are individually transmitted to N sensors (terminal nodes) via the network shown in FIGS. 1 and 2, and the decryption process is executed in each sensor. Note that a key applied to encryption and a key applied to decryption processing can be set to the same setting, and the encryption key shown as input data in FIG. 7 is constituted by, for example, a sensor unique key held by each sensor. .

The processing executed by the cryptographic processing unit 110 shown in FIG. 7 is the following processing.
Step S111: Key conversion process Step S112: Key schedule process Step S121: Data conversion process,
Step S122: cryptographic processing,
Step S123: data reverse conversion processing,
These processes.

The cryptographic processing unit 110 implements cryptographic processing according to the lightweight block cryptographic algorithm “PRESENT” by applying the bit slice cryptographic processing by executing the above steps.
First, the outline of each process and the overall process flow will be briefly described, and then the details of each process will be described.

The key conversion process in step S111 is performed by the encryption key 81, that is, the same bit or a bit every n bits of a plurality of encryption key blocks composed of, for example, 80-bit key data, where n is 2, 4, 8, 16, 64, This is a process of generating bit slice expression key data composed of a bit slice expression block which is a set of data of these bits, which is a power of 2, such as 128.
The data conversion process in step S121 is performed by the plaintext data 82, that is, the same bit of a plurality of data blocks composed of, for example, 64-bit plaintext data, or every n bits, where n is 2, 4, 8, 16, 64, 128. This is a process for generating bit slice representation plaintext data composed of bit slice representation blocks that are sets of data of these bits, such as a power of 2.

  The key scheduling process (Key Scheduling) in Step S112 is a process for generating a plurality of round keys to be applied to the encryption process by applying the bit slice expression key data generated in the key conversion process (Key Conversion) in Step S111. .

The encryption process (Data Processing) in step S122 is a step of executing an encryption process using a round key for the bit slice expression data generated based on the plain text data in the data conversion process (Data Conversion) in step S111. .
Processing according to the cryptographic algorithm, such as addition (XOR) processing with a round key (XOR) processing, linear conversion processing, and nonlinear conversion processing in units of blocks constituting the bit slice expression data generated by the bit slice processing, is executed according to software (program) To do.

In the next step S123, a data reverse conversion process (Data Conversion ^-1 ) is executed on the result of the encryption process (Data Processing) in Step S122. This processing is processing for returning the bit slice expression data to a set of encrypted data corresponding to the plain text data 82 before being bit sliced. By this processing, encrypted data 91 corresponding to the plain text data 82 is generated as the output data 90.
Hereinafter, details of the processing of each step will be sequentially described.

[4. About key conversion processing and data conversion processing]
First, the following processing of the cryptographic processing unit 110 shown in FIG.
Step S111: Key conversion process Step S121: Data conversion process,
These processes will be described.

First, the key conversion process in step S111 will be described with reference to FIG.
The key conversion process in step S111 is performed by the encryption key 81 shown as input data in FIG. 7, that is, the same bit or every nth bit of a plurality of encryption key blocks composed of, for example, 80-bit key data, where n is 2, 4 , 8, 16, 64, 128, and the like, and a process of generating a bit slice expression key block that is a set of data of these bits.

FIG. 8 shows eight 80-bit key data (a1) to (a8) as the encryption key 81 which is input data.
In step S111, a bit slice expression key block is generated from the eight 80-bit key data (a1) to (a8), and a register (XMM register (r0) or general purpose) constituting a memory in the information processing apparatus is generated. Register (g0).
(B1) to (b8) shown in FIG. 8 are register storage data that is the processing result of the key conversion processing in step S111, that is, storage data of the bit slice expression key block. Here, eight 128-bit registers are used as storage areas for bit slice expression key blocks.

For example, the encryption processing unit 110 collects 8-bit data [0, 0] obtained by collecting only the first bits of the eight 80-bit key data (a1) to (a8) which are the input data shown in FIG. As shown in b1), it is stored in the XMM register r0.
This 8-bit data [0, 0] is a set consisting of only the first bit of eight 80-bit key data, and is one bit slice expression block.

Next, 8-bit data [1, 0] obtained by collecting only the second bits of the input data (a1) to (a8) is stored in the XMM register r1, as shown in FIG. 8 (b2).
Next, 8-bit data [2, 0] obtained by collecting only the third bits of the input data (a1) to (a8) is stored in the XMM register r2, as shown in FIG. 8 (b3).
Next, 8-bit data [3, 0] obtained by collecting only the fourth bit of the input data (a1) to (a8) is stored in the XMM register r3 as shown in FIG. 8 (b4).
Next, 8-bit data [0, 1] obtained by collecting only the fifth bit of the input data (a1) to (a8) is stored in the XMM register r0 as shown in FIG. 8 (b1).
In this way, data is stored in units of 4 bits in units of 8 bits in the XMM registers r0 to r3, and data of the first 64 bits of input data (a1) to (a8) (8 × 64 = 512 bits) is stored in 4 bits. Store in the two XMM registers r0 to r3.

Furthermore, the 65-bit and subsequent data of the input data (a1) to (a8) is stored in units of 8 bits by sequentially applying the general purpose registers (g0 to g3) or the XMM registers (r4 to r7).
8-bit data [0, 16] obtained by collecting only the 65th bit of the input data (a1) to (a8) is stored in the XMM register r4 (or general-purpose register g0) as shown in FIG. 8 (b5).
Next, 8-bit data [1, 16] obtained by collecting only the 66th bit of the input data (a1) to (a8) is stored in the XMM register r5 (or general-purpose register g1) as shown in FIG. 8 (b6). To do.
Next, 8-bit data [1, 16] obtained by collecting only the 67th bit of the input data (a1) to (a8) is stored in the XMM register r6 (or general-purpose register g2) as shown in FIG. 8 (b7). To do.
Next, 8-bit data [1, 16] obtained by collecting only the 68th bit of the input data (a1) to (a8) is stored in the XMM register r7 (or general-purpose register g3) as shown in FIG. 8 (b8). To do.

  As described above, the encryption processing unit 110 bit-slices eight 80-bit keys and stores them in a plurality of registers. Specifically, for example, the information processing apparatus 100 has eight XMM registers (r0 to r7) that are registers for Intel extended SIMD instructions, or four XMM registers (r0 to r3) and four general-purpose registers (g0 to g3). ), The bit slice data is distributed and stored in units of 8 bits using these registers.

Each register stored data in the example shown in FIG. 8 is as follows.
Of the eight 80-bit key data blocks (a1) to (a8) that are input data,
1st, 5th, 9th,..., 61st bit of the XMM register r0,
2nd, 6th, 10th,..., The 62nd bit is the XMM register r1,
3rd, 7th, 11th,..., 63rd bit of the XMM register r2,
, 64th bit is stored in the XMM register r3.
Further, eight 80-bit key data blocks (a1) to (a8) which are input data are
The 65th, 69th, 73rd, and 77th bits of the XMM register r4 (or general-purpose register g0);
66th, 70th, 74th and 78th bits are XMM register r5 (or general purpose register g1),
The 67th, 71st, 75th, and 79th bits of the XMM register r6 (or general-purpose register g2);
68th, 72th, 76th, and 80th bits, XMM register r7 (or general-purpose register g3),
To store.

  In this way, up to 64 bits of input data are stored in units of 4 bits by repeatedly using four registers. Similarly, after 65 bits, new four registers are repeatedly used and stored in units of 4 bits.

Note that [i, j] of the register storage data shown in FIG. 8 is a bit slice expression block as a set of the same bits of the eight key data (a1) to (a8), and is 8-bit data.
In [i, j] shown as the identifier of the register storage data, i is 0, 1, 2 in units of 4 bits from the head of each input data of the eight 80-bit key data blocks (a1) to (a8). , 3 is a parameter repeatedly set, and indicates a variable indicating which bit is stored in a 4-bit unit.
j corresponds to a parameter indicating what number 4-bit unit data of the 4-bit unit data of the eight key data (a1) to (a8).

For example, when i = 2 in [i, j] = [2,1] is divided in units of 4 bits from the head of each input data,
1st bit in 4-bit unit data: i = 0,
Second bit in 4-bit unit data: i = 1,
Third bit in 4-bit unit data: i = 2,
4th bit in 4-bit unit data: i = 3,
Is set as
Indicates the third bit in 4-bit unit data.

Further, j = 1 of [i, j] = [2, 1] is a parameter indicating the number of 4-bit unit data of the 4-bit unit data from the head of each input data.
First 4-bit unit data: j = 0,
Second 4-bit unit data: j = 1,
Third 4-bit unit data: j = 2,
:
It is set in this way.
In [i, j] = [2, 1], since j = 1, the second 4-bit unit data is identified.

Thus, for example, [2,1] is
j = 1 is the second 4-bit unit data,
By i = 2, it is identified that it is the third data in the second 4-bit unit data.
That is, it is identified from the beginning that the data is composed of a set of data of the seventh bit.

  The encryption processing unit 110 shown in FIG. 7 generates the hit slice expression key data composed of the bit slice expression blocks [0, 0] to [3, 19] in the key conversion process in step S111 and stores them in the register. Store.

Next, the data conversion process in step S121 will be described with reference to FIG.
This data conversion process is a conversion process to bit slice expression data similar to the key conversion process described with reference to FIG. However, the difference is that the input is eight 64-bit plaintext data.

Each register storage data in the example shown in FIG. 9 is as follows.
Of the eight 64-bit data blocks (a1) to (a8) that are input data,
1st, 5th, 9th,..., The 61st bit is the XMM register r0,
2nd, 6th, 10th,..., The 62nd bit is the XMM register r1,
3rd, 7th, 11th,..., 63rd bit of the XMM register r2,
, 64th bit is stored in the XMM register r3.

In this way, 64 bits of input data are stored in units of 4 bits by repeatedly using four registers.
[I, j] of the register storage data shown in FIG. 9 is a set of the same bit of the eight plaintext data (a1) to (a8), and is 8-bit data.
i is a parameter that is repeatedly set to 0, 1, 2, 3 in 4-bit units from the beginning of each input data of eight 64-bit plaintext data blocks (a1) to (a8). , Indicates a variable indicating which bit is stored.
j is a parameter indicating what number 4-bit unit data of the 4-bit unit data of the eight plaintext data (a1) to (a8).

[5. Key schedule processing (Key schedule processing example 1)]
Next, the details of the process of step S112 executed by the cryptographic processing unit 110 shown in FIG. 7, that is, the key schedule process will be described.
The key scheduling process (Key Scheduling) in Step S112 is a process for generating a plurality of round keys to be applied to the encryption process by applying the bit slice expression key block generated in the key conversion process (Key Conversion) in Step S111. .

As described above with reference to FIG. 8, in step S111, eight 80-bit key bit slice representation key data are distributed and stored in the registers.
In step S112, round key generation processing is performed using the bit slice expression key data stored in these registers.

Details of the round key generation process will be described with reference to FIG. In FIG. 10 and subsequent figures, the data representation [i, j] of each register storage data shown in FIG. 8 is simplified and rewritten to an expression assigned numbers from 79 to 0 as follows. .
[0,0] = 79,
[1, 0] = 78,
[2,0] = 77,
[3,0] = 76,
[0, 1] to [3, 1] = 75 to 72,
[0,2] to [3,2] = 71 to 68,
・ ・
[0,14] to [3,14] = 7 to 4
[0,15] = 3
[1,15] = 2
[2,15] = 1
[3,15] = 0
And

In the initial state,
[0, 0] = 79 is 8-bit data obtained by collecting the first bits of eight 80-bit keys. In the following description, 78, 77, 76, 75... 0 corresponds to 8-bit data obtained by collecting the second, third, fourth, fifth, last (80th bit) of eight 80-bit keys.

The register storage data of the bit slice expression key data generated in step S111 is as shown in FIG.
As shown in FIG. 10, 80 bit slice blocks from 0 to 79 are distributed and stored in the registers.
Each block is a block (bit slice expression block) composed of 8-bit data composed of a set of the same bits of eight encryption keys.
As will be described below, by executing block-by-block processing using this block as a unit, processing similar to encryption processing in which eight keys are individually applied can be executed in one encryption processing.

  In step S112, a round key is generated using eight 80-bit keys expressed in bit slices stored in these registers. In the cryptographic processing algorithm “PRESENT”, 32 round keys corresponding to the number of rounds are required. In step S112, 32 round keys are generated using the bit slice expression data stored in the register.

Note that the round key generated by the processing described below is a round key applied to processing in units of blocks (bit slice expression blocks).
For example, in the normal PRESENT algorithm shown in FIG. 6, the round key of each round applied to 64-bit plaintext is 64 bits, but the encryption process in step S122 for executing the encryption process using the bit slice data shown in FIG. Is executed as processing in units of bit slice expression blocks.
That is, plaintext is subjected to cryptographic processing in units of 64 blocks, and the round key applied to this cryptographic processing is also a 64-block round key.

In this embodiment, one key block (bit slice expression key block) stores the data of the same bit of the original eight encryption keys 81, that is, 8 bits.
The round key applied to the bit slice encryption processing of the present disclosure is a 64-block round key, that is, 64 × 8 bits = 512 bits round key.

  The same applies to the plaintext to be encrypted. In the normal PRESENT algorithm shown in FIG. 6, the plain input is 64 bits. However, in the bit slice encryption processing of the present disclosure, 64 blocks of bit slice expression data, that is, 64 blocks. The process is executed by inputting 64 blocks of 8 bits = 512 bits.

In step S112, 32 round keys composed of 64 blocks to be applied to encryption processing between the bit slice expression blocks are generated.
The generated round key is written in the memory area (m0 to m3) designated by the key pointer (pt) as shown in FIG.

A detailed flow of the key schedule processing executed in step S112 is shown in FIG.
First, in step S201, input data and initial data are set.
Specifically, bit slice expression key data stored in a register is input as input data. Further, a pointer (pt) indicating a memory area in which the generated round key is written and a round number Rn of the generated round key are set. Rn = 0 is set as an initial setting, and thereafter, 32 round keys are generated in order of Rn = 1, 2, 3.

  In step S202, it is determined whether or not Rn = 31 has been reached. When Rn = less than 31, the process proceeds to step S203, and the pointer (pt) indicating the memory address to which the generated round key is written is updated. What is necessary is just to update a point (pt), ensuring the storage area of a round key.

In step S204, a round key generation / updating process is executed to increment the round number Rn by one.
This detailed processing will be described later.

  Next, returning to step S202, it is determined whether or not Rn = 31 has been reached. When it is less than Rn = 31, the process after step S203 is repeated. If it is determined in step S202 that Rn = 31 has been reached, the process proceeds to step S204, and a process of writing the generated round key to the memory is executed. Finally, the round key generated in step S205 is read out, and the process proceeds to execution of encryption processing.

FIG. 13 shows a detailed processing flow of the round key generation / updating process executed in step S203.
As shown in FIG. 11, it is assumed that the bit slice expression key block generated by the bit slice processing is stored in the registers r0, r1, r2, r3, r4, r5, r6, and r7.

First, in step S221 of the flowchart shown in FIG. 13, the registers r1, r2, r3, r4 are copied to the registers r9, r10, r11, r8.
That is, as shown in FIG. 14, the registers r1, r2, r3, r4 are copied to the registers r9, r10, r11, r8.

Next, in step S222, a shuffle instruction is executed on the register r8, and the data stored in the register 8 is replaced.
Note that the shuffle executed in the apparatus of the present disclosure is a process of replacing data stored in one register in units of blocks and storing the data in the same register. That is, it is a process of exchanging block unit data in the register in block units.

For example, when the data stored in the register r8 is the following data in units of 8 bits from the top,
[0,0], [0,1], [0,2], [0,3], [0,4], [0,5], [0,6], [0,7], [0 , 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15]
The shift process in step S222 is executed as the following shift process.

([0,0], [0,1], [0,2], [0,3], [0,4], [0,5], [0,6], [0,7], [ 0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15]) → ([ 0, 1], [0, 2], [0, 3], [0, 0], [0, 0], [0, 0], [0, 0], [0, 0], [0, 0], [0, 0], [0, 0], [0, 0], [0, 0], [0, 0], [0, 0], [0, 0]),
That is, a leftward shift in units of 8-bit data is performed.
The result is the data shown in FIG.

Next, in step S223, arithmetic processing corresponding to a predetermined non-linear transformation (Sbox logic instruction sequence) is executed on the data stored in the registers r9, r10, r11, r8.
As shown in FIG. 16, the result of executing the non-linear transformation (Sbox logic instruction sequence) processing on the blocks 18, 17, 16, 15 which are the stored data of the registers r9, r10, r11, r8 is the result of the register r8, r9. , R10, r11. The result of the nonlinear conversion processing is the following data shown in FIG.
Data S0 of register r8,
Data S1 of register r9,
Data S2 of register r10,
Data S3 of register r11,
Note that the non-linear transformation (Sbox logical instruction sequence) processing applied in the present embodiment is executed as an arithmetic processing for executing, for example, the logical instruction sequence shown in FIG. 17 between stored data between registers.
The registers x3, x2, x1, x0, and x4 shown as logical instruction sequences in FIG. 17 correspond to the registers r9, r10, r11, r8, and r12 shown in FIG.
The register r12 shown in FIG. 16 corresponds to the register x4 in the logical instruction sequence shown in FIG. 17, and is used as a temporary area for storing intermediate data for arithmetic processing.

In step S224, the data stored in the registers r8, r9, r10, r11 are shifted by 120 bits to the left.
FIG. 18 shows a result obtained by shifting the data stored in the registers r8, r9, r10, r11 to the left by 120 bits.

Next, in step S225, the data stored in the registers r5, r6, r7 is shifted to the right by 8 bits,
AND processing of register r4 and mask 0 (MASK0) consisting of predetermined data;
An AND process is performed on the registers r5, r6, r7 and a mask 1 (MASK1) made of predetermined data.
Note that the mask value need not be stored in the register.

As shown in FIG. 19, the mask 0 (MASK0) is a mask in which only the bits of the 2nd to 4th blocks of the 8-bit data unit are set to 1 and the others are set to 0.
As shown in FIG. 19, the mask 1 (MASK1) is a mask in which only the bits of the second to fifth blocks of 8-bit data units are set to 1 and the others are set to 0.
By the AND processing with the mask data, the leading 8-bit data in the registers r4 to r7 is rewritten to 0 as shown in FIG.

Next, in step S226, an exclusive OR operation (XOR) of the registers r4, r5, r6, r7 and the registers r11, r8, r9, r10 is executed, and the output is stored in the registers r4, r5, r6, r7. To do.
FIG. 20 shows the exclusive OR (XOR) processing and the storage data of the processing result.
As a result of these exclusive OR operations (XOR) processing, the first 8 bits of the registers r4, r5, r6, r7 are replaced with the non-linear transformation processing of step S223 which is the first 8 bits data of the registers r11, r8, r9, r10. The calculation result of (Sbox) is stored.

Next, in step S227, a shuffle instruction is executed for the registers r0, r1, r2, and r3, and the shuffle result is stored in the registers r0, r1, r2, and r3.
FIG. 21 shows data stored in the registers r0, r1, r2, and r3 before and after the shuffle process.

The order of data rearrangement in the shuffle process is different between the register r0 and the registers r1, r2, and r3. From the top of the 8-bit unit data of each register,
[0,0, [0,1], [0,2], [0,3], [0,4], [0,5], [0,6], [0,7], [0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15]
And

The shuffle process in step S227 is executed with the following settings for the register r0.
([0,0], [0,1], [0,2], [0,3], [0,4], [0,5], [0,6], [0,7], [ 0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15]) → ([ 0, 12], [0, 13], [0, 14], [0, 15], [0, 0], [0, 1], [0, 2], [0, 3], [0, 4], [0, 5], [0, 6], [0, 7], [0, 8], [0, 9], [0, 10], [0, 11])

Further, the following settings are executed for the registers r1, r2, and r3.
([0,0], [0,1], [0,2], [0,3], [0,4], [0,5], [0,6], [0,7], [ 0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15]) → ([ 0, 11], [0, 12], [0, 13], [0, 14], [0, 15], [0, 0], [0, 1], [0, 2], [0, 3], [0, 4], [0, 5], [0, 6], [0, 7], [0, 8], [0, 9], [0, 10])

In the next step S228, the data in the registers r0, r1, r2, and r3 are copied to the registers r8, r9, r10, and r11.
AND processing of register r8 and mask 2 (MASK2),
AND processing of registers r9, r10, r11 and mask 3 (MASK3),
These AND processes are executed, and the results are stored in the registers r8, r9, r10, r11.
These processing results are shown in FIG.

As shown in FIG. 22, mask 2 (MASK2) is mask data of the first 32 bits = 0 and then 96 bits = 1.
As shown in FIG. 22, the mask 3 (MASK3) is mask data of the first 40 bits = 0 and then 88 bits = 1.

  As a result of this processing, the first 32 bits of the register r8 are set to 0, and the first 40 bits of the registers r9, r10, r11 are set to 0.

Next, in step S229, an exclusive OR operation (XOR) of the registers r4, r5, r6, r7 and the registers r8, r9, r10, r11 is executed, and the result is stored in r4, r5, r6, r7. .
This exclusive OR operation (XOR) process is shown in FIG.

Next, in step S230, an exclusive OR operation is performed on the right 8 bits of the registers r5, r6, r7, and r4 and the left 8 bits of r1 with a round counter value that is a preset count value. (XOR) is performed.
Round counter
Number of rounds: Set to each count value of 00000 to 11111 as a binary expression according to 0 to 31.

For example, when generating a round key with round number = 13, the round counter is set to each count value of 01101 indicating 13 as a binary number expression.
An XOR operation is performed on the count value 01101 with the right 8 bits of the registers r5, r6, r7, r4 and the left 8 bits of r1.
Note that the order of the XOR operation with the count values 00000 to 11111 of the round counter is the order from the upper bit of the original data of the stored value of each register. In the example shown in FIG. 24, the values are in the descending order, ie, 38, 37, 36, 35, 34.
That is, the register order is r5, r6, r7, r4, r1.

As shown in FIG.
From the top
The right 8-bit data of register r5 with respect to 0 of the first bit of count value 01101 ([38] of register r5 shown in FIG. 24)
The right 8-bit data of the register r6 ([37] of the register r6 shown in FIG. 24) with respect to 1 of the second bit of the count value 01101
For the third bit 1 of the count value 01101, the right 8-bit data of the register r7 ([36] of the register r7 shown in FIG. 24)
The right 8-bit data of the register r4 ([35] of the register r6 shown in FIG. 24) with respect to 0 of the fourth bit of the count value 01101
The left 8-bit data of the register r1 ([34] of the register r1 shown in FIG. 24) with respect to 1 of the fifth bit of the count value 01101
An XOR operation between these values is executed to update the respective data.

Note that a mask 4 (MASK4) and a mask 5 (MASK5) as shown in FIG. 25 can be applied to this exclusive OR (XOR) operation.
Mask 4 (MASK4) is mask data set with leading 120 bits = 0 and trailing 8 bits = 1.
Mask 5 (MASK5) is mask data in which the preceding 8 bits = 1 and the last 120 bits = 0.
MASK4 is used for XOR with the registers r5, r6, r7, r4, and MASK5 is used for XOR with the register r1.

  The exclusive OR operation (XOR) in step S230 is executed for the register corresponding to the bit in which 1 is set in the 5 bits of the round counter (roundcounter) = 00000 to 11111, and is set to 0. The same result is obtained even if the register corresponding to the set bit is set not to be processed.

That is, for the register order arranged from the top of the original data: r5, r6, r7, r4, r1, for example, when the value of the run and counter is 13 = 01011, the second and third round counters , 5 bits are 1, so for registers r5, r6, r7, r4, r1,
XOR operation between the registers r6 and r7 and the mask 4 (MASK4),
XOR operation of register r1 and mask 5 (MASK5),
It is good also as a structure which performs only these.

Of the register obtained as a result of this step S230,
The data stored in the registers r5, r6, r7, r4, r1, r2, r3, r0 is used as the next round key generation block.
64 blocks from the blocks stored in the registers r5, r6, r7, r4, r1, r2, r3, r0 are set as round keys for the next round.
Hereinafter, the updated register storage block is applied, and the process according to the flow of FIG. 13 is repeated to generate 32 round keys.

  The specific processing according to the flowchart shown in FIG. 13 has been described above, but when the round key generation and update processing is simplified and shown collectively, it can be shown as in FIG.

FIG. 26A shows register initial storage data in which 80 blocks stored in a plurality of registers shown in FIG.
From this initial setting block, 64 blocks are selected as initial round keys.
Thereafter, processing according to the flow shown in FIG. 13 is executed on the 80 blocks which are the register initial storage data shown in FIG. That is, the processing described with reference to FIGS. 14 to 25 is performed to update the register.
FIG. 26B collectively shows the register update processing.
Register update processing
(A) Rotation processing including block-unit shift processing and shuffle processing,
(B) Non-linear transformation processing (Sbox) in units of blocks,
(C) exclusive OR operation between block and round counter (00000 to 111111),
It is executed as a process including these processes.
As a result of these, the register update data shown in the lower part of FIG. 26B, that is, data for generating the next round key is set. From this register block, 64 blocks are selected from the left and set as round keys.
Thereafter, with respect to the register update data shown in the lower part of FIG. 26 (B), the key update in FIG. 26 (B) is repeated to update the register, thereby sequentially generating round keys.

  In the key schedule process of step S112 shown in FIG. 7, a round key is generated in this way.

[6. Key schedule processing (key schedule processing example 2)]
Next, another embodiment of the key schedule process of step S112 executed in the cryptographic processing unit 110 shown in FIG. 7 will be described.
[5. Regarding the key schedule processing (key schedule processing example 1)], it is necessary to perform Sbox, that is, non-linear conversion processing every round for each round. That is, the non-linear transformation process (Sbox) for the four blocks described with reference to FIGS.
As shown in FIG. 17, this nonlinear conversion process has a problem that the number of operation steps is large and the processing time is increased.

Hereinafter, as a key schedule processing example 2, a method in which the number of executions of the nonlinear transformation process (Sbox) is reduced to two will be described.
FIG. 27 shows a flow for explaining the processing executed by the key schedule unit of this processing example.

  The difference from the key schedule processing described above with reference to FIG. 12 is that the pre-calculation of non-linear transformation (Sbox) is performed in the first round and in steps S252 and S257 before the 17th round, This is the content of the round key generation / updating process in steps S255 and S260.

The process of step S251 in the flow in FIG. 27 is the same as the process in step S201 in the flow in FIG.
The processing in steps S254 and S259 in the flow in FIG. 27 is the same processing as the processing in step S203 in the flow in FIG.
The processing in steps S256 and S261 in the flow in FIG. 27 is the same processing as the processing in step S205 in the flow in FIG.
The process of step S262 in the flow of FIG. 27 is the same process as the process of step S206 of the flow in FIG.
A description of these processes will be omitted, and a process different from the key schedule process described with reference to FIG. 12 will be described below.

(6-1. Pre-computation processing of nonlinear transformation (Sbox))
A flow for explaining a detailed sequence of the pre-calculation process of the nonlinear transformation process (Sbox) executed in step S252 and step S257 is shown in FIGS.
In the initial state, as shown in FIG. 30, it is assumed that each bit slice expression key block of 79 to 0 is stored in the register. This is the same as the setting described above with reference to FIGS.
For example, the bit slice representation key block of [79] is 8-bit data obtained by collecting the first bits of eight 80-bit keys. In the following description, 78, 77, 76, 75... 0 corresponds to 8-bit data obtained by collecting the second, third, fourth, fifth, last (80th bit) of eight 80-bit keys.

  A detailed sequence of non-linear transformation (Sbox) pre-calculation executed in steps S252 and S257 of the flow of FIG. 27 will be described according to the flow shown in FIGS.

First, in step S281 shown in the flow of FIG.
As shown in FIG. 31, the registers r0, r1, r2, and r3 are copied to the registers r12, r13, r14, and r15, and a shuffle instruction is performed on the registers r12, r13, r14, and r15.

The order of rearrangement in the shuffle process is different for each register.
[0, 0], [0, 1], [0, 2], the arrangement of data before shuffling of registers r12, r13, r14, r15 (= same as registers r0, r1, r2, r3) from the left [0,3], [0,4], [0,5], [0,6], [0,7], [0,8], [0,9], [0,10], [0 , 11], [0, 12], [0, 13], [0, 14], [0, 15], the shuffle of each register is set as follows.

Registers r12, r13
([0,0], [0,1], [0,2], [0,3], [0,4], [0,5], [0,6], [0,7], [ 0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15]) → ([ 0, 1], [0, 2], [0, 3], [0, 4], [0, 6], [0, 7], [0, 8], [0, 9], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15], [0, 0], [0, 0], [0, 0])

Register r14
([0,0], [0,1], [0,2], [0,3], [0,4], [0,5], [0,6], [0,7], [ 0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15]) → ([ 0, 1], [0, 2], [0, 3], [0, 4], [0, 6], [0, 7], [0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 15], [0, 0], [0, 0], [0, 0])

Register r15:
[0,0], [0,1], [0,2], [0,3], [0,4], [0,5], [0,6], [0,7], [0 , 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15]) → ([0 , 1], [0, 2], [0, 3], [0, 4], [0, 5], [0, 6], [0, 7], [0, 8], [0, 10 ], [0,11], [0,12], [0,13], [0,15], [0,0], [0,0], [0,0]

In the next step S282,
As shown in FIG. 32, the data of registers r4, r5, r6, and r7 are stored in registers r8, r9, 10, and r11, r8 is logically shifted by 12 bytes on the right, and r9, r10, and r11 are logically shifted on the right by 13 bytes. .

In the next step S283,
As shown in FIG.
AND processing of register r12 and mask 6 (MASK6),
An AND process of the registers r13, r14, r15 and the mask 7 (MASK7) is executed.
The mask 6 (MASK6) is a mask with 96 bits at the beginning = 0 and 32 bits at the following = 1.
A mask 7 (MASK7) is a mask with 104 bits at the beginning = 0 and 24 bits at the following = 1.

In the next step S284,
As shown in FIG. 34, an exclusive OR operation (XOR) is performed on the registers r8, r9, r10, r11 and the registers r12, r13, r14, r15, and the results are stored in the registers r12, r13, r14, r15.

In the next step S285,
As shown in FIG. 35, a shuffle instruction is performed on the registers r13, r14, r15.
[0, 0], [0, 1], [0, 2], [0] from the left to the arrangement of data before shuffling of registers r13, r14, r15 (= same as registers r0, r1, r2, r3) , 3], [0, 4], [0, 5], [0, 6], [0, 7], [0, 8], [0, 9], [0, 10], [0, 11 ], [0, 12], [0, 13], [0, 14], [0, 15], the shuffle of each register is set as follows.

Register r13
([0,0], [0,1], [0,2], [0,3], [0,4], [0,5], [0,6], [0,7], [ 0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15]) → ([ 0, 12], [0, 13], [0, 14], [0, 15], [0, 0], [0, 1], [0, 2], [0, 3], [0, 4], [0, 5], [0, 6], [0, 7], [0, 8], [0, 9], [0, 10], [0, 11])

Register r14
([0,0], [0,1], [0,2], [0,3], [0,4], [0,5], [0,6], [0,7], [ 0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15]) → ([ 0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15], [0, 0], [0, 1], [0, 2], [0, 3], [0, 4], [0, 5], [0, 6], [0, 7])

Register r15
([0,0], [0,1], [0,2], [0,3], [0,4], [0,5], [0,6], [0,7], [ 0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15]) → ([ 0, 4], [0, 5], [0, 6], [0, 7], [0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15], [0, 0], [0, 1], [0, 2], [0, 3])

In the next step S286,
As shown in FIG. 36, the registers r13 and r15 are copied to r9 and r11.

In the next step S287,
As shown in FIG. 37, unpacking processing in units of bytes is executed on the left 64 bits of the registers r13, r14, r15, r12.
Note that the unpacking process in the process of the present disclosure refers to, for example, selecting data stored in two registers as a minimum unit from the upper or lower order and alternately storing the data in one of the two registers. It is processing.
Specifically, for example, a process of selecting one half of all blocks stored in each register from two registers and re-storing in one register.

As shown in FIG. 37, an unpacking process is executed in which the left 8 blocks (64 bits) of the register r13 and the register r14 are alternately stored in the register r13 from the left in units of blocks (8 bits).
Similarly, an unpacking process is executed in which the left 8 blocks (64 bits) of the register 15 and the register r12 are alternately stored from the left in the register r15 in units of blocks (8 bits).

In the next step S288,
As shown in FIG. 38, an unpacking process in units of bytes is executed on the right 64 bits of the registers r9 and r14 and r11 and r12.
As shown in FIG. 38, unpack processing is executed in which the right 8 blocks (64 bits) of the register r9 and the register r14 are alternately stored in the register r9 from the right in units of blocks (8 bits).
Similarly, an unpacking process is performed in which the right 8 blocks (64 bits) of the register 11 and the register r12 are alternately stored in the register r11 from the right in units of blocks (8 bits).

Next, in step S289,
As shown in FIG. 39, the registers r13 and r9 are copied to r12 and r14.

Next, in step S290,
As shown in FIG. 40, the left 64 bits of the registers r12 and r15 and the registers r14 and r11 are unpacked in units of words of two 8-bit blocks.
As shown in FIG. 40, unpack processing is executed in which the left 8 blocks (64 bits) of the register r12 and the register r15 are alternately stored in the register r12 from the left in units of 2 blocks (16 bits).
Similarly, an unpacking process is executed in which the left 8 blocks (64 bits) of the register r14 and the register r11 are alternately stored from the left in the register r14 in units of 2 blocks (16 bits).

Next, in step S291,
As shown in FIG. 41, the left 64 bits of the registers r13, r15 and the registers r9, r11 are unpacked in units of words of two 8-bit blocks.
As shown in FIG. 41, unpack processing is executed in which the right 8 blocks (64 bits) of the register r13 and the register r15 are alternately stored from the left in the register r13 in units of 2 blocks (16 bits).
Similarly, unpack processing is executed in which the right 8 blocks (64 bits) of the register r9 and the register r11 are alternately stored in the register r9 from the left in units of 2 blocks (16 bits).

Next, in step S292,
As shown in FIG. 42, a shuffle instruction is executed for the registers r13, r14, r9.
[0, 0], [0, 1], [0, 2], [0] from the left to the sequence of data before shuffling of registers r13, r14, r9 (= same as registers r0, r1, r2, r3) , 3], [0, 4], [0, 5], [0, 6], [0, 7], [0, 8], [0, 9], [0, 10], [0, 11 ], [0, 12], [0, 13], [0, 14], [0, 15], the shuffle of each register is set as follows.

Register r13
([0,0], [0,1], [0,2], [0,3], [0,4], [0,5], [0,6], [0,7], [ 0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15]) → ([ 0, 1], [0, 2], [0, 3], [0, 0], [0, 5], [0, 6], [0, 7], [0, 4], [0, 9], [0, 10], [0, 11], [0, 8], [0, 13], [0, 14], [0, 15], [0, 12])

Register 14
([0,0], [0,1], [0,2], [0,3], [0,4], [0,5], [0,6], [0,7], [ 0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15]) → ([ 0, 2], [0, 3], [0, 0], [0, 1], [0, 6], [0, 7], [0, 4], [0, 5], [0, 10], [0, 11], [0, 8], [0, 9], [0, 14], [0, 15], [0, 12], [0, 13])

Register 9
([0,0], [0,1], [0,2], [0,3], [0,4], [0,5], [0,6], [0,7], [ 0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15]) → ([ 0, 3], [0, 0], [0, 1], [0, 2], [0, 7], [0, 4], [0, 5], [0, 6], [0, 8], [0, 11], [0, 9], [0, 10], [0, 15], [0, 12], [0, 13], [0, 14])

Next, in step S293,
As shown in FIG. 43, the AND of the registers r12, r13, r14, r9 and mask 8 (MASK8), mask 9 (MASK9), mask 10 (MASK10), mask 11 (MASK11) is obtained and stored in the respective registers. To do.
Note that the mask 8 (Mask 8) is a mask with 64 leading bits = 0 and 64 succeeding bits = 1,
The mask 9 (MASK9) is a mask set to 0, 1, 0, 1 in units of 32 bits from the top.
Mask 10 (MASK10) is a mask in which 16-bit continuous 0 and 16-bit continuous 1 appear alternately from the beginning,
A mask 11 (MASK11) is a mask in which 8-bit continuous 0 and 8-bit continuous 1 appear alternately from the top.

Next, in step S294,
As shown in FIG. 44, nonlinear conversion processing (Sbox) is performed on the data in the registers r12, r13, r14, r9.
The non-linear conversion process is the process described above with reference to FIG.
The result of the nonlinear conversion process is stored in the registers r9, r14, r13, r12. In this process, the register r8 is used as a temporary area.

The resulting data stored in 16 blocks of 8 bits from the left of the registers r9, r14, r13, r12 shown in FIG. 45 is the result of the non-linear conversion processing (Sbox) for 16 rounds.
After this Sbox pre-calculation, the registers r9, r14, r13, r12 are stored in r12, r13, r14, r15 before executing the key update process.
Note that this register replacement process can be executed by simply replacing the register in the program.

In this way, in the Sbox pre-calculation in step S252 shown in FIG. 27, the result of nonlinear conversion processing (Sbox) applied to round key generation of 1 to 16 rounds is generated, and the Sbox pre-calculation in step S257 shown in FIG. Then, a non-linear conversion processing (Sbox) result to be applied to 17 to 32 round key generation is generated.
In the present embodiment, it is possible to generate a non-linear conversion process (Sbox) result necessary for generating round keys for all rounds only by these two non-linear conversion processes (Sbox).

(6-2. About round key generation and update processing)
Next, details of step S255 in the flow shown in FIG. 27 and round key generation / update processing in step S260 will be described with reference to FIG.

FIG. 46 is a flowchart for explaining a detailed sequence of step S255 in the flow shown in FIG. 27 and the round key generation update processing in step S260.
A detailed sequence of the round key generation / updating process executed in steps S255 and S260 of the flow of FIG. 27 will be described according to the flow shown in FIG.

Note that the register setting before the generation and update of the round key is as shown in FIG.
As shown in FIG. 47, the keys of bit slice representation are stored in the registers r0, r1, r2, r3, r4, r5, r6, r7.
The registers r12, r13, r14, r15 store the results of the pre-computed non-linear transformation (Sbox) processing generated by the processing described in (6-1. Pre-computation processing of non-linear transformation (Sbox)) described above. It is assumed that

First, in step S301 of FIG.
As shown in FIG. 48, registers r12, r13, r14, r15 storing the result of nonlinear transformation (Sbox) processing are copied to registers r8, r9, r10, r11, and mask 5 (MASK5) and AND processing are performed. Run.

Here, as an example, a round key generation / update processing example using the value of the Sbox for the first round will be described.
The pre-calculated non-linear conversion processing (Sbox) value uses the left 8 bits of the registers r12, r13, r14, r15.

Next, in step S302,
As shown in FIG. 49, the registers r12, r13, r14, r15 are logically shifted to the left by 8 bits.

Next, in step S303,
As shown in FIG. 50, the registers r5, r6, and r7 are logically shifted to the right by 8 bits, and AND is performed between r4 and MASK0, r5, r6, r7, and MASK1.
This process is the same as the process of step S225 in the flow of FIG.

The data stored in the registers r5, r6, r7 is shifted 8 bits to the right,
AND processing of register r4 and mask 0 (MASK0) consisting of predetermined data;
An AND process is performed on the registers r5, r6, r7 and a mask 1 (MASK1) made of predetermined data.
Note that the mask value need not be stored in the register.

As shown in FIG. 50, the mask 0 (MASK0) is a mask in which only the bits of the 2nd to 4th blocks of the 8-bit data unit are set to 1 and the others are set to 0.
As shown in FIG. 50, the mask 1 (MASK1) is a mask in which only the bits of the second to fifth blocks of 8-bit data units are set to 1 and the others are set to 0.
By the AND processing with the mask data, the leading 8-bit data of the registers r4 to r7 is rewritten to 0 as shown in FIG.

Next, in step S304,
As shown in FIG. 51, the exclusive OR operation (XOR) of the registers r4, r5, r6, r7 and the registers r11, r8, r9, r10 is executed, and the output is stored in the registers r4, r5, r6, r7. To do.
This process is the same as the process of step S226 in the flow of FIG.

  As a result of these exclusive OR operations (XOR) processing, the first 8 bits of the registers r4, r5, r6, r7 are replaced with the non-linear transformation processing of step S223 which is the first 8 bits data of the registers r11, r8, r9, r10. The calculation result of (Sbox) is stored.

Next, in step S305,
As shown in FIG. 52, a shuffle instruction is executed for the registers r0, r1, r2, and r3, and the shuffle result is stored in the registers r0, r1, r2, and r3.
FIG. 52 shows data stored in the registers r0, r1, r2, and r3 before and after the shuffle process.
This process is the same as the process of step S227 in the flow of FIG.

The order of data rearrangement in the shuffle process is different between the register r0 and the registers r1, r2, and r3. From the top of the 8-bit unit data of each register,
[0,0, [0,1], [0,2], [0,3], [0,4], [0,5], [0,6], [0,7], [0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15]
And

The shuffle process in step S305 is executed with the following settings for the register r0.
([0,0], [0,1], [0,2], [0,3], [0,4], [0,5], [0,6], [0,7], [ 0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15]) → ([ 0, 12], [0, 13], [0, 14], [0, 15], [0, 0], [0, 1], [0, 2], [0, 3], [0, 4], [0, 5], [0, 6], [0, 7], [0, 8], [0, 9], [0, 10], [0, 11])

Further, the following settings are executed for the registers r1, r2, and r3.
([0,0], [0,1], [0,2], [0,3], [0,4], [0,5], [0,6], [0,7], [ 0, 8], [0, 9], [0, 10], [0, 11], [0, 12], [0, 13], [0, 14], [0, 15]) → ([ 0, 11], [0, 12], [0, 13], [0, 14], [0, 15], [0, 0], [0, 1], [0, 2], [0, 3], [0, 4], [0, 5], [0, 6], [0, 7], [0, 8], [0, 9], [0, 10])

In the next step S306,
As shown in FIG. 53, the data in the registers r0, r1, r2, r3 are copied to the registers r8, r9, r10, r11,
AND processing of register r8 and mask 2 (MASK2),
AND processing of registers r9, r10, r11 and mask 3 (MASK3),
These AND processes are executed, and the results are stored in the registers r8, r9, r10, r11.
This process is the same as the process of step S228 in the flow of FIG.

As shown in FIG. 53, mask 2 (MASK2) is mask data of the first 32 bits = 0 and then 96 bits = 1.
As shown in FIG. 53, the mask 3 (MASK3) is mask data of the first 40 bits = 0 and then 88 bits = 1.

  As a result of this processing, the first 32 bits of the register r8 are set to 0, and the first 40 bits of the registers r9, r10, r11 are set to 0.

In the next step S307,
As shown in FIG. 54, the exclusive OR operation (XOR) of the registers r4, r5, r6, r7 and the registers r8, r9, r10, r11 is executed, and the result is stored in r4, r5, r6, r7. .
This process is the same as the process of step S229 in the flow of FIG.

In the next step S308,
As shown in FIG. 55, an exclusive OR operation with a round counter value that is a preset count value is applied to the right 8 bits of the registers r5, r6, r7, and r4 and the left 8 bits of r1. (XOR) is performed.
This process is the same as the process in step S230 of the flow of FIG.
Round counter
Number of rounds: Set to each count value of 00000 to 11111 as a binary expression according to 0 to 31.

For example, when generating a round key with round number = 13, the round counter is set to each count value of 01101 indicating 13 as a binary number expression.
An XOR operation is performed on the count value 01101 with the right 8 bits of the registers r5, r6, r7, r4 and the left 8 bits of r1.
Note that the order of the XOR operation with the count values 00000 to 11111 of the round counter is the order from the upper bit of the original data of the stored value of each register. In the example shown in FIG. 24, the values are in the descending order, ie, 38, 37, 36, 35, 34.
That is, the register order is r5, r6, r7, r4, r1.

As shown in FIG.
From the top
The right 8-bit data of register r5 with respect to 0 of the first bit of count value 01101 ([38] of register r5 shown in FIG. 55)
The right 8-bit data of the register r6 ([37] of the register r6 shown in FIG. 55) with respect to 1 of the second bit of the count value 01101
The right 8-bit data of the register r7 ([36] of the register r7 shown in FIG. 55) for 1 of the third bit of the count value 01101
The right 8-bit data of register r4 with respect to 0 of the fourth bit of count value 01101 ([35] of register r6 shown in FIG. 55)
The left 8-bit data of the register r1 ([34] of the register r1 shown in FIG. 55) for 1 of the fifth bit of the count value 01101
An XOR operation between these values is executed to update the respective data.

Note that mask 4 (MASK4) and mask 5 (MASK5) as shown in FIG. 55 can be applied to the exclusive OR (XOR) operation.
Mask 4 (MASK4) is mask data set with leading 120 bits = 0 and trailing 8 bits = 1.
Mask 5 (MASK5) is mask data in which the preceding 8 bits = 1 and the last 120 bits = 0.
MASK4 is used for XOR with the registers r5, r6, r7, r4, and MASK5 is used for XOR with the register r1.

  The exclusive OR operation (XOR) in step S230 is executed for the register corresponding to the bit in which 1 is set in the 5 bits of the round counter (roundcounter) = 00000 to 11111, and is set to 0. The same result is obtained even if the register corresponding to the set bit is set not to be processed.

That is, for the register order arranged from the top of the original data: r5, r6, r7, r4, r1, for example, when the value of the run and counter is 13 = 01011, the second and third round counters , 5 bits are 1, so for registers r5, r6, r7, r4, r1,
XOR operation between the registers r6 and r7 and the mask 4 (MASK4),
XOR operation of register r1 and mask 5 (MASK5),
It is good also as a structure which performs only these.

Of the register obtained as a result of this step S308,
The data stored in the registers r5, r6, r7, r4, r1, r2, r3, r0 is used as the next round key generation block.
64 blocks from the blocks stored in the registers r5, r6, r7, r4, r1, r2, r3, r0 are set as round keys for the next round.
Hereinafter, the updated register storage block is applied, and the process according to the flow of FIG. 46 is repeated to generate 32 round keys.

Thus, in (Key Schedule Processing Example 2), the number of executions of the four non-linear transformation processes (Sboxes) required in Key Schedule Processing Example 1 can be reduced to two.
The effect of reducing the number of processes in this (key schedule process example 2) will be considered.

The two key schedule processes described above:
(A) Key schedule processing example 1 (processing according to the flow of FIGS. 12 and 13)
(B) Key schedule processing example 2 (processing according to the rows in FIGS. 27 to 29 and FIG. 46)
A comparison of the number of processing steps of these two key schedule processes is as follows.

(A) Key schedule processing example 1
The number of instructions required for the key update process without Sbox pre-calculation is as follows.
Key update processing: 1847 (= 57 × 31 + 80)
(B) Key schedule processing example 2
The number of instructions required for the key update process with Sbox pre-calculation is as follows.
Sbox pre-calculation + key update processing: 1411
(Sbox pre-calculation: 132 (= 66 × 2), key update processing: 1289 (39 × 31 + 80))
In this way, (B) Key Schedule Processing Example 2 can reduce the number of processing steps compared to (A) Key Schedule Processing Example 1, and higher-speed processing is realized.

[7. About cryptographic processing]
Next, the details of the process of step S122 executed by the encryption processing unit 110 shown in FIG. 7, that is, the encryption process will be described.
The encryption process (Data Processing) in step S122 is a step of executing an encryption process using a round key for the bit slice expression data generated based on the plain text data in the data conversion process (Data Conversion) in step S111. .

Processing according to the cryptographic algorithm, such as addition (XOR) processing with a round key (XOR) processing, linear conversion processing, and nonlinear conversion processing in units of blocks constituting the bit slice expression data generated by the bit slice processing, is executed according to software (program) To do.
Details of this encryption processing will be described with reference to FIG.

  The flowchart shown in FIG. 57 is a flowchart for explaining the detailed sequence of the process of step S122 executed by the encryption processing unit 110 shown in FIG. 7, that is, the encryption process.

In step S401, data input and initial setting are performed.
Specifically, bit slice expression data of plaintext data to be encrypted and stored in the register is input.
This is data generated in the data conversion process in step S121 of FIG. 7, and is bit slice expression data generated by the conversion process of the plain text data 82 described with reference to FIG. That is, 64 blocks of bit slice expression blocks [0, 0] to [3, 15] shown in FIG. 9 are input.
In this embodiment, the bit slice expression blocks [0, 0] to [3, 15] shown in FIG. 9 are blocks storing the same bit of eight plaintexts to be encrypted, each of which is 8-bit data. is there.

  In step S401, this bit slice expression data is input, and further, an initial setting of a round number Rn = 0 corresponding to the count value of the number of rounds of encryption processing, and a key pointer (pt indicating the memory area in which the round key is stored) ). The key pointer (pt) represents the memory address of the round key written in the memory area. The initial value of the round number Rn is set to 0, and Rn is incremented after each round.

Steps S402 to S404 are processes for each round of encryption processing.
Step S402: Round key addition, that is, exclusive OR operation processing (addRoundKey) of the round key and input plaintext data (bit slice expression data),
Step S403: Nonlinear transformation processing (SboxLayer) for the round key addition result,
Step S404: Linear conversion processing (pLayer) for the nonlinear conversion result;
These processes are executed.
Details of these processes will be described later.

In step S405, it is confirmed whether or not the processing round has reached the final round Rn = 31.
When Rn is less than 31, the processes of steps S402 to S404 are executed as the next round process.

If it is determined in step S405 that the processing round has reached the final round Rn = 31, the ciphertext is output in step S406.
The data reverse conversion process in step S23 shown in FIG. 7 is performed on the output ciphertext, and the final ciphertext 90 is output.

FIG. 58 shows a configuration example when the cryptographic processing step of step S122 executed by the cryptographic processing unit 110 shown in FIG. 7 is executed with a hardware configuration, for example.
58 shows two rounds.
(A) Round key addition (addRoundKey),
(B) Non-linear transformation (SboxLayer),
(C) Linear transformation (pLayer)
These three processes are shown.
A round operation consisting of these three types of processing is repeatedly executed for a plurality of rounds to output a ciphertext.

In the apparatus of the present disclosure, for example, without applying hardware dedicated to an anchovy as shown in FIG. 58, a round operation is performed by an arithmetic process on the bit slice expression data stored in the register, a shift process of the register stored data, That is, each process of steps S402 to S404 shown in the flow of FIG.
(A) Round key addition (addRoundKey),
(B) Non-linear transformation (SboxLayer),
(C) Linear transformation (pLayer)
These three processes are executed.

Hereinafter, details of each of these processes executed by the apparatus of the present disclosure will be described.
First, the key addition process (addRoundKey) in step S402 will be described with reference to FIG.

The round key addition in step S402 is an exclusive OR operation process (addRoundKey) of the round key and the input plaintext data (bit slice expression data).
The round key is a round key generated by the key conversion process in step S111 and the key schedule process in step S112 in the encryption processing unit 110 with the encryption key 81 shown in FIG. 7 as an input.
This round key generation process is performed in the above-mentioned [4. Key conversion process and data conversion process], [5. Key schedule processing (key schedule processing example 1)], [6. The key schedule process (key schedule process example 2)] is the process described in these items.
The round key is stored in the memory, and the round key is acquired from the area indicated by the key point (pt).

The plaintext data to be encrypted is the above described [4. As described in [About Key Conversion Process and Data Conversion Process], it is bit slice expression data of the plaintext data 82 shown in FIG. That is, the bit slice expression data stored in the register by the processing described with reference to FIG.
In this embodiment, as shown in FIG. 9, description will be made assuming that encryption processing is performed on bit slice expression data generated based on eight 64-bit plaintexts (a1) to (a8).

FIG. 59 shows bit slice expression data stored in four 128-bit registers r0 to r3. [I, j], which is the data stored in the register of FIG. 59, is a bit slice expression block including a set of the same bits of the eight plaintexts (a1) to (a8) shown in FIG.
Of the eight plaintexts (a1) to (a8),
The bit slice representation block consisting of the first bit set is [0, 0].
The bit slice representation block consisting of the second bit set is [1, 0].
The bit slice representation block consisting of the third bit set is [2, 0].
The bit slice representation block consisting of the fourth bit set is [3, 0].
The bit slice representation block consisting of the fifth bit set is [0, 1].
・ ・
The bit slice expression block consisting of the set of the 63rd bit is [2,15].
The bit slice representation block consisting of the 64th bit set is [3, 15].
These 8-bit bit slice expression blocks [0, 0] to [3, 15] are distributed and stored in four registers r0 to r3.

The key addition process of step S402 in the flow of FIG. 57 is an exclusive OR operation (XOR) process of the stored data of the four 128-bit registers r0 to r3 shown in FIG. 59 and the round key functioned in each memory. Executed.
Both the plaintext and the round key that execute the exclusive OR operation (XOR) processing are data of 64 blocks of 8-bit bit slice expression blocks.
Exclusive OR operation (XOR) with the round key (128 bits (16 blocks)) stored in the memory location specified by the pointer (pt) in units of each register (= 128 bit registers (16 blocks)) Execute the process.

The round key uses data in the area designated by the key pointer (pt).
For each exclusive OR operation (XOR) of one register (128 bits), the key pointer (pt) is advanced by 16 blocks (128 bits) and the encryption target stored in the four registers r0 to r3 An exclusive OR operation (XOR) with the bit slice expression data of the plaintext data is executed, and the operation result is stored in the register.

Next, the process of step S403 in the flowchart shown in FIG. 57 will be described.
Step S403 is a non-linear transformation process (SboxLayer) for the round key addition result in step S402.

This non-linear conversion process (SboxLayer) is executed as an arithmetic process between registers using four 128-bit registers storing a round key addition result and one temporary register.
Specifically, as shown in FIG. 60, it is executed as an arithmetic process between registers.
Realized by arithmetic processing.
The registers shown in FIG. 17: x3, x2, x1, x0, x4 are
Four 128-bit registers in which the registers x3 to x0 store the round key addition result,
The register x4 corresponds to a register used as a temporary area.
The result of this non-linear transformation process (SboxLayer) is stored in four 128-bit registers, for example, registers r0 to r4.

Next, the process of step S404 in the flowchart shown in FIG. 57 will be described.
The process of step S404 is a linear conversion process (pLayer) for the nonlinear conversion result of step S403.

FIG. 61 shows a flowchart for explaining the detailed sequence of this linear conversion process (pLayer).
The processing of each step in the flowchart shown in FIG. 61 will be described sequentially.
Note that the data to be subjected to the type conversion process (pLayer) is the non-linear conversion result in step S403, and the non-linear conversion result in step S403 is stored in four 128-bit registers r0 to r3 as shown in FIG. Has been.

First, in step S451,
As shown in FIG. 63, a shuffle instruction is executed for the registers r0, r1, r2, and r3, and the result is stored in r0, r1, r2, and r3.

From the left, the sequence of data before shuffling of registers r0, r1, r2, r3 (= same as registers r0, r1, r2, r3) is [i, 0], [i, 1], [i, 2], [I, 3], [i, 4], [i, 5], [i, 6], [i, 7], [i, 8], [i, 9], [i, 10], [i , 11], [i, 12], [i, 13], [i, 14], [i, 15],
However, i = {0, 1, 2, 3}
The shuffle of each register is set as follows.

Register ri
i = {0, 1, 2, 3}.
([I, 0], [i, 1], [i, 2], [i, 3], [i, 4], [i, 5], [i, 6], [i, 7], [ i, 8], [i, 9], [i, 10], [i, 11], [i, 12], [i, 13], [i, 14], [i, 15]) → ([ i, 0], [i, 4], [i, 8], [i, 12], [i, 1], [i, 5], [i, 9], [i, 13], [i, 2], [i, 6], [i, 10], [i, 14], [i, 3], [i, 7], [i, 11], [i, 15])

Next, in step S452,
As shown in FIG. 64, the registers r0 and r2 are copied to the registers r4 and r5.

Next, in step S453,
As shown in FIG. 65, the unpack instruction is executed in double word units for the left 64 bits of the registers r0 and r1 and the registers r2 and r3.
As shown in FIG. 65, unpack processing is executed in which the left 8 blocks (64 bits) of the registers r0 and r2 are alternately stored in the register r0 from the left in units of double words (32 bits (4 blocks)).
Similarly, unpack processing is executed in which the left 8 blocks (64 bits) of the registers r2 and r3 are alternately stored in the register r2 from the left in units of double words (32 bits (4 blocks)).

Next, in step S454,
As shown in FIG. 66, the unpack instruction is executed in double word units for the right 64 bits of the registers r4 and r1 and the registers r5 and r3.
As shown in FIG. 66, an unpacking process is executed in which the right 8 blocks (64 bits) of the register r4 and the register r1 are alternately stored from the left in the register r4 in units of double words (32 bits (4 blocks)).
Similarly, unpack processing is executed in which the right 8 blocks (64 bits) of the register 5 and the register r3 are alternately stored from the left in the register r5 in units of double words (32 bits (4 blocks)).

Next, in step S455,
As shown in FIG. 67, the registers r0 and r4 are copied to the registers r1 and r3.

Next, in step S456,
As shown in FIG. 68, the unpack instruction is executed in units of quad words for the left 64 bits of the registers r0 and r2 and the registers r4 and r5.
As shown in FIG. 68, an unpacking process is executed in which the left 8 blocks (64 bits) of the registers r0 and r2 are alternately stored in the register r0 from the left in units of quadwords (64 bits (8 blocks)).
Similarly, an unpacking process is executed in which the left 8 blocks (64 bits) of the registers r4 and r5 are alternately stored in the register r4 from the left in units of quadwords (64 bits (8 blocks)).

Next, in step S457,
As shown in FIG. 69, the unpack instruction is executed in quadword units for the right 64 bits of the registers r1 and r2 and the registers r3 and r5.
As shown in FIG. 69, unpack processing is executed in which the right 8 blocks (64 bits) of the register r1 and the register r2 are alternately stored in the register r1 from the left in units of quadwords (64 bits (8 blocks)).
Similarly, unpack processing is executed in which the right 8 blocks (64 bits) of the register r3 and the register r5 are alternately stored in the register r3 from the left in units of quadwords (64 bits (8 blocks)).

The registers r0, r1, r4, and r3 generated as the processing results of steps S451 to S457 in the flow shown in FIG. 61 are used as the input of the next round as the linear conversion results.
FIG. 70 shows the correspondence between the input and output of the linear transformation process in step S404 of the flow of FIG.

In this way, one round operation is constituted by the round key addition in step S402, the non-linear transformation in step S403, and the linear transformation in step S404 in the flow shown in FIG.
The number of instructions in each process in this round calculation process is as follows.
(A) Round key addition (addRoundKey): 4
(B) Nonlinear transformation (SboxLayer): 20
(C) Linear transformation (pLayer): 16

  In step S122 of the cryptographic processing unit 110 shown in FIG. 7, the round calculation according to the flow shown in FIG. 57 is repeated a predetermined number of times (32 times) defined in the cryptographic algorithm. A data reverse conversion process is performed on the processing result in the next step S123.

This step S123 is a data reverse conversion process (Data Conversion ⁻¹ ) for the result of the encryption process (Data Processing) of Step S122, and the bit slice representation data is encrypted data corresponding to the plain text data 82 before being bit sliced. It is processing to return to the set. This process is executed as the reverse process of the bit slice expression data generation process described above with reference to FIG.
By this processing, encrypted data 91 corresponding to the plain text data 82 is generated as the output data 90.

  In the above-described embodiment, in order to efficiently execute the linear conversion processing (pLayer) of [PRESENT], which is an encryption algorithm, by software, as described with reference to FIG. The configuration is performed at bit intervals. With this configuration, for example, it is possible to execute linear conversion (pLayer) with 16 instructions per round by combining the shuffling and unpacking instructions of the Intel extended SIMD instruction and performing the processing according to the processing with reference to FIGS. It becomes.

In addition, the encryption algorithm [PRESENT] is configured to perform a non-linear transformation process to which one Sbox is applied when a round key corresponding to one round is updated.
In contrast, [6. According to the configuration described in “Key Schedule Processing (Key Schedule Processing Example 2)]”, the key schedule unit that performs processing by inputting an 80-bit key receives round keys for 32 rounds by two nonlinear conversion processes. It is possible to generate a round key with a small number of instructions, and high-speed processing is realized.

  As described above, the information processing apparatus of the present disclosure is an information processing apparatus that does not have dedicated hardware for executing processing of a specific cryptographic algorithm, for example, the above-described cryptographic algorithm [PRESENT]. For example, the information processing apparatus such as a PC can be executed at high speed.

[8. Configuration example of information processing apparatus and cryptographic processing apparatus]
Finally, an apparatus configuration example of an information processing apparatus that executes cryptographic processing according to the above-described embodiment and a cryptographic processing apparatus will be described. The information processing apparatus includes, for example, the server described with reference to FIGS.
The cryptographic processing according to the above-described embodiment is performed by a data processing unit including a CPU or the like that executes software (program) that defines a cryptographic processing algorithm, a program, or a memory that stores data, such as a PC or a server. It can be executed on the device.

FIG. 71 illustrates an example of a hardware configuration of an information processing device that executes the cryptographic processing of the present disclosure and the cryptographic processing device.
A CPU (Central Processing Unit) 701 functions as a data processing unit that executes various processes according to a program stored in a ROM (Read Only Memory) 702 or a storage unit 708. For example, processing according to the above-described sequence is executed.

A RAM (Random Access Memory) 703 stores programs executed by the CPU 701, data, and the like. For example, a program defining the above-described cryptographic processing sequence is stored. The RAM also includes a register that stores data to be applied to each process described above, and also includes a memory area that is used as a work area.
The CPU 701, ROM 702, and RAM 703 are connected to each other via a bus 704.

  The CPU 701 is connected to an input / output interface 705 via a bus 704. The input / output interface 705 is connected to an input unit 706 including various switches, a keyboard, a mouse, and a microphone, and an output unit 707 including a display and a speaker. Yes. The CPU 701 executes various processes in response to commands input from the input unit 706 and outputs the processing results to the output unit 707, for example.

The storage unit 708 connected to the input / output interface 705 includes, for example, a hard disk and stores programs executed by the CPU 701 and various data. A communication unit 709 communicates with an external device via a network such as the Internet or a local area network.
For example, in the case of the server described with reference to FIGS. 1 to 5, the communication unit 709 receives encrypted data from a large number of user terminals, sensors, or the like, or encrypted data for a large number of user terminals, sensors, or the like. Execute the transmission process.

  A drive 710 connected to the input / output interface 705 drives a removable medium 711 such as a semiconductor memory such as a magnetic disk, an optical disk, a magneto-optical disk, or a memory card, and executes data recording or reading.

  In the above-described embodiment, the encryption process for mainly encrypting the plain text as the input data has been described. However, the process of the present disclosure is not limited to the encryption process for encrypting the plain text as the input data. The present invention can also be applied to decryption processing for restoring ciphertext as data into plaintext.

[9. Summary of composition of the present disclosure]
As described above, the embodiments of the present disclosure have been described in detail with reference to specific embodiments. However, it is obvious that those skilled in the art can make modifications and substitutions of the embodiments without departing from the gist of the present disclosure. In other words, the present invention has been disclosed in the form of exemplification, and should not be interpreted in a limited manner. In order to determine the gist of the present disclosure, the claims should be taken into consideration.

  In addition, in the decoding process according to an embodiment of the present disclosure, processing is performed by calculation or movement processing in units of bit slice expression blocks stored in a register, and a large amount of data can be processed at high speed. Specifically, when the encryption algorithm [PRESENT (key length 80 bits)] is executed on the Intel Core i7 870 processor, a high speed of 11.06 cycles / byte is achieved.

  In the above embodiment, an example of execution processing of the encryption algorithm [PRESENT (key length: 80 bits)] has been mainly described, but the processing of the present disclosure can be applied to other algorithms. For example, when the cryptographic algorithm [Piccolo (key length: 80 bits)] is executed in accordance with the processing of the present disclosure, a high speed of 5.59 cycles / bytes is achieved. In particular, the speed of Piccolo exceeds the speed record of 6.92 cycles / byte of the US government standard cipher AES on the same platform (Intel Core i7 920) which has been conventionally known.

  Furthermore, in the bit slice implementation according to an embodiment of the present disclosure, the S-box is calculated by a logical operation instead of a table reference, so that it is possible to increase resistance to side channel attacks such as a cache attack and an attack between virtual machines. . Furthermore, the speedup of cryptographic processing by software in cloud computing processing can complete cryptographic processing in a smaller number of cycles, leading to lower power consumption of the cloud and data center.

The technology disclosed in this specification can take the following configurations.
(1) having a data processing unit for executing data processing in accordance with a program defining a cryptographic processing sequence;
The data processing unit, according to the program,
Data conversion processing for generating bit slice expression data by bit slice processing for a plurality of plaintext data to be encrypted;
A key conversion process for generating a bit slice expression key by a bit slice process for each of the plurality of plaintext data encryption keys;
Key schedule processing for inputting the bit slice expression key and generating a round key for each round in cryptographic processing;
An encryption process applying the round key to the bit slice representation data;
A data reverse conversion process for generating a plurality of encrypted data corresponding to the plurality of plaintext data by performing an inverse conversion of the bit slice process with respect to a result of the encryption process,
In the key schedule process,
The same bit or every nth bit of each encryption key constituting the bit slice representation key, where n is a power of 2.
An information processing apparatus for generating the round key by applying arithmetic processing and movement processing in units of a bit slice expression key block configured by:

  (2) In the data conversion process, the data processing unit is a bit constituted by the same bit or every n bits of plaintext data constituting the bit slice expression data, where n is a power of 2. A process of storing a slice representation data block as a processing unit in a register is executed, and in the key conversion process, a processing of storing the bit slice expression data block as a processing unit in a register is executed. The information processing apparatus according to (1), wherein encryption processing is performed by applying block-unit arithmetic processing and movement processing in units of the bit slice expression data block stored in the register and the bit slice expression key block.

  (3) In the key conversion process, the data processing unit executes a process of storing the bit slice expression key block in a plurality of registers in units of processing, and in the key schedule process, the plurality of registers (1) or (2) for performing round key generation by performing arithmetic processing between the plurality of registers and shifting and shuffling of each register storage block on the bit slice expression key block stored in ).

(4) The information processing apparatus according to (3), wherein the data processing unit executes an unpacking process in which the block selected from the storage blocks of the plurality of registers is re-stored in one register in the key schedule process. .
(5) In the key schedule process, the data processing unit is configured to indicate a round number of each round in the cryptographic process for a plurality of bit slice expression key blocks of a plurality of registers storing the bit slice expression key blocks. The information processing apparatus according to (3) or (4), wherein round key generation is performed by executing an exclusive OR operation with a counter.

(6) In the key schedule process, the data processing unit performs an operation according to a predetermined logical instruction sequence on the bit slice expression key block stored in the plurality of registers, thereby performing nonlinear conversion The information processing apparatus according to any one of (3) to (5), wherein round key generation is performed by executing processing (Sbox).
(7) In the key schedule processing, the data processing unit performs non-linear conversion processing (Sbox) in units of registers on the bit slice expression key blocks stored in the plurality of registers, and performs a plurality of rounds. The information processing apparatus according to any one of (3) to (6), wherein key generation is generated collectively.
(8) The information processing apparatus according to any one of (1) to (7), wherein the data processing unit executes cryptographic processing according to a cryptographic algorithm PRESENT according to a program in the cryptographic processing.

(9) having a data processing unit that executes data processing according to a program that defines a decoding processing sequence;
The data processing unit, according to the program,
Data conversion processing for generating bit slice expression data by bit slice processing for a plurality of encrypted data to be decrypted;
A key conversion process for generating a bit slice expression key by a bit slice process for each encryption key of the plurality of encrypted data;
A key schedule process for inputting the bit slice expression key and generating a round key for each round in the decryption process;
Decryption processing applying the round key to the bit slice representation data;
By performing an inverse transform of the bit slice process on the result of the decryption process, a data inverse transform process for generating a plurality of plaintext data corresponding to the plurality of encrypted data is performed,
In the key schedule process,
The same bit or every nth bit of each encryption key constituting the bit slice representation key, where n is a power of 2.
An information processing apparatus for generating the round key by applying arithmetic processing and movement processing in units of a bit slice expression key block configured by:

  (10) In the data conversion process, the data processing unit is configured by the same bit or every n bits of the encrypted data constituting the bit slice expression data, where n is a power of 2. A process of storing in a register in units of bit slice representation data blocks is executed, and a process of storing in a register in units of the bit slice expression key blocks in the key conversion process is executed. The information processing apparatus according to (9), wherein the bit slice expression data block stored in the block and a block unit arithmetic process and a decryption process using the bit slice expression key block as a unit are executed.

(11) In the key conversion process, the data processing unit executes a process of storing the bit slice expression key block in a plurality of registers in units of processing, and in the key schedule process, the plurality of registers (9) or (10) in which round key generation is performed by performing arithmetic processing between the plurality of registers and shifting and shuffling of each register storage block on the bit slice representation key block stored in ).
(12) The information processing apparatus according to (11), wherein the data processing unit executes an unpacking process in which the block selected from the storage blocks of the plurality of registers is re-stored in one register in the key schedule process. .

  Furthermore, the configuration of the present disclosure includes a method of processing executed in the above-described apparatus and system, and a program for executing the processing.

  The series of processing described in the specification can be executed by hardware, software, or a combined configuration of both. When executing processing by software, the program recording the processing sequence is installed in a memory in a computer incorporated in dedicated hardware and executed, or the program is executed on a general-purpose computer capable of executing various processing. It can be installed and run. For example, the program can be recorded in advance on a recording medium. In addition to being installed on a computer from a recording medium, the program can be received via a network such as a LAN (Local Area Network) or the Internet and installed on a recording medium such as a built-in hard disk.

  Note that the various processes described in the specification are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary. Further, in this specification, the system is a logical set configuration of a plurality of devices, and the devices of each configuration are not limited to being in the same casing.

10 cloud 20 sensor network 30 server 31 encryption key 32 sensor ID
33 Encrypted data 70 Plain text data 80 Input data 81 Encryption key 82 Plain text data 90 Output data 91 Encrypted data 100 Information processing device 110 Encryption processing unit 701 CPU
702 ROM
703 RAM
704 Bus 705 I / O interface 706 Input unit 707 Output unit 708 Storage unit 709 Communication unit 710 Drive 711 Removable media

Claims (16)

A data processing unit that executes data processing according to a program that defines an encryption processing sequence;
The data processing unit, according to the program,
Data conversion processing for generating bit slice expression data by bit slice processing on plaintext data to be encrypted;
A key conversion process for generating a bit slice expression key by a bit slice process for each encryption key of the plaintext data;
Key schedule processing for inputting the bit slice expression key and generating a round key for each round in cryptographic processing;
An encryption process applying the round key to the bit slice representation data;
By performing an inverse transformation of the bit slice processing with respect to the result of the encryption processing, a data inverse transformation processing for generating encrypted data corresponding to the plaintext data is executed,
In the key schedule process,
The same bit or every nth bit of each encryption key constituting the bit slice representation key, where n is a power of 2.
An information processing apparatus for generating the round key by applying arithmetic processing and movement processing in units of a bit slice expression key block configured by: The data processing unit
In the data conversion process, the same bit or every nth bit of the plaintext data constituting the bit slice expression data, where n is a power of 2.
Execute the process of storing in the register, with the bit slice representation data block configured by
In the key conversion process, a process of storing the bit slice expression key block as a processing unit in a register is performed,
In the cryptographic process,
The information processing apparatus according to claim 1, wherein encryption processing is performed by applying block-unit arithmetic processing and movement processing in units of the bit slice expression data block stored in the register and the bit slice expression key block. The data processing unit
In the key conversion process, the bit slice expression key block is used as a processing unit, and a process of distributing and storing in a plurality of registers is performed,
In the key schedule process,
For the bit slice representation key block stored in the plurality of registers, arithmetic processing between the plurality of registers,
The information processing apparatus according to claim 1, wherein round key generation is performed by executing shift and shuffle processing of each register storage block. The data processing unit
The information processing apparatus according to claim 3, wherein in the key schedule process, an unpacking process is performed in which a block selected from the storage blocks of the plurality of registers is re-stored in one register. The data processing unit
In the key schedule processing, exclusive OR operation with a round counter indicating a round number of each round in encryption processing is performed on a plurality of bit slice representation key blocks of a plurality of registers storing the bit slice representation key blocks. The information processing apparatus according to claim 3, which executes round key generation. The data processing unit
In the key schedule process, a non-linear transformation process (Sbox) is performed by performing an operation according to a predetermined logical instruction sequence for the bit slice expression key block stored in the plurality of registers, thereby performing a round The information processing apparatus according to claim 3, wherein key generation is performed. The data processing unit
The said key schedule process WHEREIN: The nonlinear transformation process (Sbox) of a register unit is performed with respect to the said bit slice expression key block stored in these registers | resistors, The several round key generation is produced | generated collectively. 3. The information processing apparatus according to 3. The data processing unit
The information processing apparatus according to claim 1, wherein in the cryptographic processing, cryptographic processing according to a cryptographic algorithm PRESENT is executed according to a program. A data processing unit that executes data processing according to a program that defines a decoding processing sequence;
The data processing unit, according to the program,
A data conversion process for generating bit slice expression data by a bit slice process for encrypted data to be decrypted;
A key conversion process for generating a bit slice representation key by a bit slice process for each encryption key of the encrypted data;
A key schedule process for inputting the bit slice expression key and generating a round key for each round in the decryption process;
Decryption processing applying the round key to the bit slice representation data;
By performing inverse transformation of the bit slice processing on the result of the decryption processing, performing data inverse transformation processing for generating plaintext data corresponding to the encrypted data,
In the key schedule process,
The same bit or every nth bit of each encryption key constituting the bit slice representation key, where n is a power of 2.
An information processing apparatus for generating the round key by applying arithmetic processing and movement processing in units of a bit slice expression key block configured by: The data processing unit
In the data conversion process, the same bit or every nth bit of each encrypted data constituting the bit slice expression data, where n is a power of 2.
Execute the process of storing in the register in units of the bit slice representation data block configured by
In the key conversion process, a process of storing in a register in units of the bit slice expression key block is performed,
In the decryption process,
The information processing apparatus according to claim 9, wherein a decryption process is performed by applying a block-unit operation process and a move process in units of the bit slice expression data block stored in the register and the bit slice expression key block. The data processing unit
In the key conversion process, the bit slice expression key block is used as a processing unit, and a process of distributing and storing in a plurality of registers is performed,
In the key schedule process,
For the bit slice representation key block stored in the plurality of registers, arithmetic processing between the plurality of registers,
The information processing apparatus according to claim 9, wherein round key generation is performed by executing shift and shuffle processing of each register storage block. The data processing unit
The information processing apparatus according to claim 11, wherein in the key schedule process, an unpacking process is performed in which a block selected from the storage blocks of the plurality of registers is re-stored in one register. An information processing method executed in an information processing apparatus,
In the data processing unit of the information processing apparatus, according to a program that defines an encryption processing sequence,
Data conversion processing for generating bit slice expression data by bit slice processing on plaintext data to be encrypted;
A key conversion process for generating a bit slice expression key by a bit slice process for each encryption key of the plaintext data;
Key schedule processing for inputting the bit slice expression key and generating a round key for each round in cryptographic processing;
An encryption process applying the round key to the bit slice representation data;
By performing an inverse transformation of the bit slice processing with respect to the result of the encryption processing, a data inverse transformation processing for generating encrypted data corresponding to the plaintext data is executed,
In the key schedule process,
The same bit or every nth bit of each encryption key constituting the bit slice representation key, where n is a power of 2.
An information processing method for generating the round key by applying a calculation process and a transfer process in units of a bit slice expression key block constituted by: An information processing method executed in an information processing apparatus,
In the data processing unit of the information processing apparatus, according to a program that defines a decoding processing sequence,
A data conversion process for generating bit slice expression data by a bit slice process for encrypted data to be decrypted;
A key conversion process for generating a bit slice representation key by a bit slice process for each encryption key of the encrypted data;
A key schedule process for inputting the bit slice expression key and generating a round key for each round in the decryption process;
Decryption processing applying the round key to the bit slice representation data;
By performing inverse transformation of the bit slice processing on the result of the decryption processing, performing data inverse transformation processing for generating plaintext data corresponding to the encrypted data,
In the key schedule process,
The same bit or every nth bit of each encryption key constituting the bit slice representation key, where n is a power of 2.
An information processing method for generating the round key by applying a calculation process and a transfer process in units of a bit slice expression key block constituted by: A program for executing cryptographic processing in an information processing device,
In the data processing unit of the information processing apparatus,
Data conversion processing for generating bit slice expression data by bit slice processing on plaintext data to be encrypted;
A key conversion process for generating a bit slice expression key by a bit slice process for each encryption key of the plaintext data;
Key schedule processing for inputting the bit slice expression key and generating a round key for each round in cryptographic processing;
An encryption process applying the round key to the bit slice representation data;
By performing an inverse transform of the bit slice process on the result of the encryption process, a data inverse transform process for generating encrypted data corresponding to the plaintext data is executed,
In the key schedule process,
The same bit or every nth bit of each encryption key constituting the bit slice representation key, where n is a power of 2.
A program for executing processing for generating the round key by applying arithmetic processing and movement processing in units of a bit slice expression key block constituted by: A program for executing a decryption process in an information processing device,
In the data processing unit of the information processing apparatus,
A data conversion process for generating bit slice expression data by a bit slice process for encrypted data to be decrypted;
A key conversion process for generating a bit slice representation key by a bit slice process for each encryption key of the encrypted data;
A key schedule process for inputting the bit slice expression key and generating a round key for each round in the decryption process;
Decryption processing applying the round key to the bit slice representation data;
By performing an inverse transform of the bit slice process on the result of the decryption process, a data inverse transform process for generating plaintext data corresponding to the encrypted data is executed,
In the key schedule process,
The same bit or every nth bit of each encryption key constituting the bit slice representation key, where n is a power of 2.
A program for executing processing for generating the round key by applying arithmetic processing and movement processing in units of a bit slice expression key block constituted by:

Images