JP2013205437A - Method and apparatus for calculating nonlinear function s-box - Google Patents

Abstract

PROBLEM TO BE SOLVED: To achieve a nonlinear function S-box calculation technique capable of performing processing by a small number of remainder registers independently of encryption algorithm because a conventional nonlinear function S-box calculation method capable of performing processing by the small number of remainder registers requires individual investigation in each algorithm.SOLUTION: When performing register operation in polynomial mapping for calculating S-box, after performing operation using original data, operation for changing the original data by operation with the other data is performed, and when there is not register for storing the original data to be data to be used for succeeding operation or an operation result, the original data or the operation result is retreated to a remainder register.

Description

  The present invention relates to a block cipher, a stream cipher, an S-box calculation method for calculating a cryptographic hash function, and a program technique.

  Bit slice implementation is known as one method of software implementation of common key cryptography such as block cipher, stream cipher, and cryptographic hash function. Bit-slice implementation is a technology that configures a common key encryption algorithm by combining components (S-box, MixColumns, AddRoundKey, ShiftRows in the case of block cipher AES) that have input and output with a small bit width (for example, 4 bits). There is a software implementation method that parallelizes cryptographic processing, increases the efficiency of the arithmetic circuit of the processor, and increases the encryption processing speed and the decryption processing speed.

  The effect of the bit slice implementation depends on the structure of the encryption algorithm and the encryption usage mode to be used (in the case of block cipher), and is often designed with the assumption that the bit slice implementation is implemented. Block ciphers such as DES and Serpent are known as examples of encryption algorithms that can implement an efficient bit slice.

  In common key cryptosystems such as block ciphers, stream ciphers, and cryptographic hash functions, whether or not efficient bit slice implementation is possible depends on the structure of a nonlinear function included as a component of the cryptographic algorithm. The non-linear function is used as a component for enhancing security in common key cryptography such as block cipher, stream cipher, and cryptographic hash function.

S-box is known as one method for realizing this nonlinear function. Here, S-box is a non-linear function having m-bit input and n-bit output for a relatively small integer m, n (for example, 4 ≦ m, n ≦ 8) (in this embodiment, an input bit) (The integers m and n representing the length and output bit length are assumed to be m = n.)
S-box: {0,1} ^m → {0,1} ⁿ (Equation 1)
It is.

After that, the set {0,1} ^{n of the} entire bit sequence of n bits and the n-dimensional linear space GF (2) ⁿ on the finite field GF (2) are mapped φ
φ: {0, 1} ⁿ → GF (2) ⁿ , a ₁ a ₂ ... a _n−1 a _n → (a ₁ , a ₂ ,..., a _n−1 , a _n ) (Equation 2)
Will be identified.

Table reference is known as one of S-box calculation methods (see Non-Patent Document 1). As a table reference, a set {S-box (0), S-box (1),..., S-box (2 ^m −1)} is held as a table. Then, for the input x to the function S-box, S-box (x) that is the element of the set is extracted and output. For example, for the table for referring to the S-box table in the American standard block cipher AES, p.16 (S-box used in the encryption process), p.22 (reverse used in the decryption process) of Non-Patent Document 4. S-box).

It is known that the nonlinear function S-box expressed by (Expression 1) is expressed in the form of a polynomial map on the finite field GF (2). Here, the polynomial mapping on the finite field GF (2) representing the nonlinear function S-box includes n variable polynomials F ₁ ,..., F _n on GF (2), and all a ₁ a ₂ … for a _m−1 a _m ∈ {0,1} ^m
S−box (a ₁ ,…, a _m ) = (F ₁ (a ₁ ,…, a _m ),…, F _n (a ₁ ,…, a _m )) (Equation 3)
Is true. (Expression 3) indicates that the function S-box is expressed as S-box = (F ₁ ,... F _n ) as a function.

Here, F ₁ ,... F _n are n variable polynomials on GF (2). (Equation 3) is a set {0, 1} ^m of the original a ₁ ... a _m a function S-box to assign values S-box (a _1, ... a _m) is, (F ₁ (a ₁ , ... a _m ), ... F _n (a ₁ , ... a _m )). For example, Non-Patent Documents 2 and 3 describe the polynomial mapping. In the bit slice implementation, m-bit data a ₁ ,... A _{m that} are input / output of the S-box are stored in different registers. Therefore, in the S-box calculation, in addition to the register that holds the input / output data, a register (surplus register) for calculating and holding the intermediate value in the S-box calculation is required.

Hereinafter, integers m and n representing the input bit length and output bit length are assumed to be m = n. Further, it is assumed that the nonlinear function S-box is bijective (that is, permutation on a set {0, 1} ^{n of} n bit strings).

D.A.Osvik, Speeding up serpent, AES Candidate Conference, April 2000. A. van der Essen, Polynomial Automorphisms and the Jacobian Conjecture, Progress in Mathematics, Vol. 190, Birkhauser Verlag, Basel-Boston-Berlin, 2000. S. Maubach, Polynomial automorphisms over finite fields, Serdica Math. J. 27 (2001), No. 4, 343-350. National Institute of Standards and Technology, Announcing the ADVANCED ENCRYPTION STANDARD (AES), Federal Information Processing Standards Publication 197, November 2001. Available at http://csrc.nist.gov/publications/fips/fips197/fips−197.pdf E. Biham, A Fast New DES Implementation in Software, FSE'97, LNCS 1267, pp. 260-272, 1997. Hitachi, Ltd., Stream Cipher Enocoro Specification Ver. 2.0. (Http://www.hitachi.co.jp/rd/yrl/crypto/enocoro/index.html)

  Cryptographic technology has become an indispensable element for concealing and authenticating electronic information with the development of information and communication networks. In addition to security, requirements imposed on cryptographic techniques include processing speed, memory usage, and the number of registers used.

  However, in general, there is a trade-off relationship among safety, processing speed, memory usage, and the number of registers used, and it is difficult to satisfy all requirements.

  When executing a bit slice-implemented program on a CPU with a small number of registers (for example, an IA32 (x86 series CPU has 8 general-purpose registers)), key data and plaintext data (decryption) The ciphertext) is stored in the register. When encryption (or decryption) processing is performed using the program, encryption (or decryption) is started according to the program. At this time, in addition to the key data and plaintext data, it is necessary to hold intermediate value data for encryption (or decryption).

  In general-purpose PCs, registers and memory are used to hold values. When a certain calculation is executed on the CPU, the input value of the calculation is stored in a register, and then the actual calculation is performed. Therefore, when the input value is stored in the memory, it is necessary to transfer the input value from the memory to the register, and a transfer processing time is required. As described above, since the above-described transfer is necessary to use the value on the memory in the calculation, it is desirable to store the value necessary for the calculation in the register as much as possible.

  However, a CPU with a small number of registers may not be able to store all of the key data, plaintext data, and intermediate value data in the registers. Thus, when the data size of all data to be stored is larger than the data size that can be stored in the register, the data that cannot be stored must be stored in the memory, not in the register. Therefore, when the above program is implemented in assembly language, a large number of stack operations (assembly language push instructions, pop instructions) are inevitably required. Hereinafter, a register for storing intermediate value data is referred to as a surplus register.

  In general, in the bit slice implementation using a small number of surplus registers, the most important is the implementation method of the nonlinear function S-box.

  If a large number of stack operations are required, the memory access frequency is increased by the stack operations, and the speed is reduced. On the other hand, in an environment where various applications are executed in a real system (for example, a server, etc.), if an encryption software program that requires a lot of surplus registers is incorporated in the S-box calculation, However, the number of registers that can be used decreases, which greatly affects processing time. In addition, since the S-box differs for each encryption algorithm, it is necessary to individually examine whether or not bit slice implementation using a small number of surplus registers is possible for each encryption algorithm.

  For example, Non-Patent Document 1 provides a bit slice mounting method using a small number of surplus registers for the block cipher Serpent. However, the method described in Non-Patent Document 1 can be applied only to the block cipher Serpent and is difficult to apply directly to other block ciphers.

  In addition to Non-Patent Document 1, there is a block cipher that provides a bit slice mounting method using a small number of surplus registers. Although the block cipher DES is described in Non-Patent Document 5, Non-Patent Document 1 As with, direct application to other block ciphers is difficult.

  Therefore, a general-purpose software implementation method for S-box using a small number of surplus registers is not provided without depending on the structure of the nonlinear function S-box.

  The present invention has been made in view of the above problems, and an object of the present invention is to realize a non-linear function S-box calculation technique that can be processed with a small number of surplus registers without depending on the replacement of the non-linear function S-box.

  As described above, in the conventional technique for calculating the S-box with a small number of surplus registers, it is necessary to individually consider the calculation method for each cryptographic algorithm (for each replacement of the S-box).

  The present invention calculates the S-box by performing limited types of permutations according to a predetermined order. Here, when the permutation is expressed by a polynomial mapping, the limited types of permutations refer to a basic polynomial mapping, a triangular polynomial mapping, and a reversible affine polynomial mapping described later. Using the feature that basic polynomial mapping, triangular polynomial mapping, and reversible affine polynomial mapping can be processed with a small number of surplus registers, a nonlinear function S-box that can be processed with a small number of surplus registers is calculated.

  According to the present invention, the nonlinear function S-box can be calculated with a small number of surplus registers. It is possible to calculate S-boxes corresponding to various cryptographic algorithms only by changing the above limited replacement. Since calculation can be performed with a small number of surplus registers, various common key encryption processes can be performed without greatly affecting the processing time of other applications even when applied to a real system.

It is a system configuration figure of the encryption communication system of a first embodiment. It is a functional block of the S-box calculation part of 1st embodiment. It is a flowchart for demonstrating the process of the S-box calculation part of 1st embodiment. It is a figure which shows the structural example of the polynomial mapping which concerns on the process of the S-box calculation part of 2nd embodiment. It is a calculation example for demonstrating the calculation process of number 4 of 1st embodiment. It is a calculation example for demonstrating the calculation process of several 6 of 1st embodiment. It is a calculation example for demonstrating the calculation process of several 8 of 1st embodiment.

  Hereinafter, a first embodiment to which the present invention is applied will be described with reference to the drawings.

(System configuration)
FIG. 1 is a system configuration diagram of the cryptographic communication system in the first embodiment, and also shows a functional block configuration of the cryptographic communication system of the present invention.

  Data is transferred from the computer A (114) having the display 124 and the keyboard 125 to the computer B (145) having the display 152 and the keyboard 153 via the network 126. The computer A (114) includes a RAM 115, an input / output interface 130, and a CPU 144. The RAM 115 includes an encryption processing program PROG1 (116) including an S-box processing program PROG2 (120), a secret key Key (117 ), Auxiliary information IV (118), and plaintext M (119). The computer B (145) includes a RAM 146, an input / output interface 156, and a CPU 157. The RAM 146 includes a decryption processing program PROG3 (147) including an S-box processing program PROG4 (151), and a secret key Key (148). , Auxiliary information IV (149) and plaintext M (150) are stored.

(S-box calculation unit configuration)
FIG. 2 is a diagram showing a configuration example of the S-box processing program 120 according to the present embodiment. The configuration shown in FIG. 2 is a common configuration in computer A 114 and computer B 145 in FIG.

  The S-box processing program 120 inputs n-bit data stored in the input / output register 208 in the CPU 144 and outputs n-bit data. The affine polynomial mapping calculation unit 201 and the basic polynomial calculation unit 202 , A triangular polynomial mapping calculation unit 203, a program reading unit 204, an iterative determination unit 205, and a polynomial mapping affiliation determination unit 206.

  The CPU 144 includes a surplus register 207 and an input / output register 208. The functions of the units 201 to 208 will be described later in the description of the processing.

(Send and receive information)
Next, an outline of message encryption processing and decryption processing will be described with reference to FIG.

  First, an operation when the computer A 114 encrypts an input message will be described with reference to FIG. The message may be any digitized data, and may be any type of text, image, video, sound, etc.

  First, the CPU 144 acquires a plain text message (input message) M 119 via the input / output interface 130.

  Next, the CPU 144 acquires a secret key Key117 and auxiliary information IV (118) stored in the RAM 115. If the block cipher is used as the encryption processing program PROG1 (116), the auxiliary information IV (118) is an initial value of the encryption usage mode such as the counter mode, and the encryption processing program PROG1 (116) When stream cipher is used, it is the initial value of stream cipher.

  The CPU 144 encrypts the plaintext message M using the received secret key Key117 and auxiliary information IV (118).

  Hereinafter, it is assumed that the encryption method used as the encryption processing program PROG1 (116) has a nonlinear function S-box as a component. Further, it is assumed that the nonlinear function S-box is realized as the S-box processing program PROG2 (120). The encryption processing includes S-box calculation processing described later in FIG.

  Then, the CPU 144 outputs an output message (ciphertext) of the plaintext message 119 as data 127 from the input / output interface 130. Data 127 is transferred to computer B 145 via network 126.

  Next, the operation when the computer B 145 decrypts the data 127 that is an encrypted message will be described with reference to FIG.

  The CPU 157 of the computer B 145 receives an input of the message encrypted by the computer A 114 as the data 101 via the input / output interface 156.

  Next, the CPU 157 acquires the secret key Key 148 and auxiliary information IV (149) stored in the RAM 146. If the block cipher is used as the decryption processing program PROG3 (147), the auxiliary information IV (149) is an initial value of the cipher usage mode such as the counter mode, and the stream cipher is used as the decryption processing program PROG3 (147). Is the initial value of the stream cipher.

  The CPU 157 uses the received secret key Key 148 and auxiliary information IV (149) to decrypt the encrypted message.

  Hereinafter, it is assumed that the encryption method used as the decryption processing program PROG3 (147) has a nonlinear function S-box as a component. Further, it is assumed that the nonlinear function S-box is realized as the S-box processing program PROG2 (120). Decoding processing also includes S-box calculation processing described later in FIG.

  The computer B 145 outputs the decrypted message as an output message from the display 152 or the like via the input / output interface 156 for the data decrypted by the CPU 157.

(S-box calculation process)
Next, the S-box calculation process will be described in detail with reference to FIG.

  First, basic polynomial mapping, triangular polynomial mapping, and reversible affine polynomial mapping, which are the limited types of permutations described above, will be described. Basic polynomial maps, triangular polynomial maps, and reversible affine polynomial maps are known as polynomial maps for which an inverse function is efficiently obtained. Hereinafter, k is a body.

  Since these polynomial maps have a feature that the conversion target can be converted before or during the conversion, the S-box calculation processing can be performed with a small number of registers.

F = (F ₁ ,... F _n ) is a basic polynomial mapping on k. A polynomial mapping F is F (x ₁ ,..., X _n ) = (x ₁ ,..., X _i−1 , x _i + F (x ₁ , ..., x _i−1 , x _{i + 1} , ..., x _n ), x _{i + 1} , ..., x _n ) (Equation 4)
fεk [x ₁ , ..., x _i−1 , x _{i + 1} , ..., x _n ] (Formula 5)
This is a polynomial mapping that has the form

G = (G ₁ ,... G _n ) is a triangular polynomial on k. The polynomial mapping G is G (x ₁ ,..., X _n ) = (a ₁ x ₁ + f ₁ (x ₂ ,..., X _{n), a 2 x 2 +} f 2 (x 3, ..., x n), ..., a n x n + f n) ( 6)
f _i εk [x _{i + 1} ,..., x _n ] (i = 1,..., n−1), f _n εk, a _i εk (i = 1,..., n) (Equation 7)
This is a polynomial mapping that has the form

H = (H ₁ ,... H _n ) is a reversible affine polynomial map on k. The polynomial map H is H (x ₁ ,..., X _n ) = (Σ _{j = 1} ⁿ a _{1, j} x _j + b ₁ , Σ _{j = 1} ⁿ a _{2, j} x _j + b ₂ ,..., Σ _{j = 1} ⁿ a _{n, j} x _j + b _n ) (Equation 8)
This is a polynomial mapping that has the form However, the matrix A = {a _{i, j} } _{1 ≦ i, j ≦ n} is a reversible matrix. In the present embodiment, when the field k = GF (2) = {0, 1}, the element a of GF (2) is regarded as a bit naturally. For example, if a = 0, a is regarded as 1 bit 0 naturally, and if a = 1, a is regarded as 1 bit 1 naturally.

  Next, it will be described with reference to FIGS. 5, 6, and 7 that a basic polynomial map, a triangular polynomial map, and a reversible affine polynomial map can be calculated with one extra register as k = GF (2).

Here, the principle of register operation in each of the following polynomial maps will be described. () Shows a specific example in the figure.
(1) Data that uses the original data as it is after mapping is left in the register. (X ₁ , x ₃ , x _{4 in} FIG. 5)
(2) If the original data is not used as it is, but the original data is not changed as it is, the result of the operation is stored in the register where the original data was stored. _{(X 2} in FIG. 5, _{x 1} in FIG. 6, _x 2 of FIG. 7)
(3) Although it is changed by an operation with other data, when the original data is used in another operation, the original data is temporarily saved in a surplus register before the operation with the other data. (X _{1 in} FIG. 7)
(4) If the operation result (or intermediate data) cannot be stored (including addition) in the register in which the original data was stored, the operation result is temporarily stored in the surplus register. (X ₃ x ₄ in FIG. 5, x ₂ x ₄ in FIG. 6, x ₁ + x _{4 in} FIG. 7)
(5) (a) It is changed by calculation with other data. (B) When the original data is used in other calculation, (a) is performed after (a) is performed. (X _{3 in} FIG. 6)
Summarizing the above principles, after the calculation using the original data, the calculation that changes the original data by the calculation with the other data, the data used in the subsequent calculation (original data or calculation result) ) Is stored in a surplus register.

(Basic polynomial mapping)
FIG. 5 is a diagram for explaining the calculation processing of the basic polynomial mapping. Here, it is assumed that the CPU 144 has five or more registers, of which four registers are reg.1,... Reg.4, and the remaining one register is reg.tmp. Registers reg.1,..., Reg.4 are input / output registers 208, and register reg.tmp is a surplus register 207. Assume that x ₁ , x ₂ , x ₃ , and x ₄ are stored as values in the four registers reg. It is assumed that an appropriate value t is stored in the surplus register reg.tmp.

First, the CPU 144 reads the S-box processing program PROG2 (120) stored in the RAM 115. Here, F (x ₁ ,..., X ₄ ) = (x ₁ , x ₂ + x ₃ + x ₃ x ₄ , x ₃ , x ₄ ) as a basic polynomial mapping F in the S-box processing program PROG2 (120). Is stored.

At this time, x ₁ , x ₂ , x ₃ , x ₄ , and t are stored in the registers reg.1,..., Reg.4, and reg.tmp at the timing of (1) in FIG. The CPU 144 reads the S-box processing program PROG2 (120), calculates the exclusive OR of the values of reg.2 and reg.3, and stores the result in reg.2. At this time, x ₁ , x ₂ + x ₃ , x ₃ , x ₄ , and t are stored in the registers reg.1,..., Reg.4, and reg.tmp at the timing of (2) in FIG. Next, the CPU 144 reads the S-box processing program PROG2 (120), calculates the logical product of the values of the register 3 and the register 4, and stores the result in reg.tmp. At this time, x ₁ , x ₂ + x ₃ , x ₃ , x ₄ , x ₃ x ₄ are stored in the registers reg.1,... Reg.4, reg.tmp at the timing of (3) in FIG. ing.

Next, the CPU 144 reads the S-box processing program PROG2 (120), calculates the exclusive OR of the values of the registers reg.2 and reg.tmp, and stores the result in reg.2. At this time, register at timing (4) in FIG. 5 reg.1, ..., reg.4, each of the _{reg.tmp x 1, x 2 + x} 3 + x 3 x 4, x 3, x 4, x 3 x ₄ is stored, and the above basic polynomial map F can be calculated.

In general, the basic polynomial mapping has the form of Equation 4. From Equation 4, n−1 registers reg.1,..., Reg. The values of i-1, reg.i + 1, ..., reg.n are not changed. Then, only the value of the i-th register reg.i is changed. At this time, when f (x ₁ ,..., X _i−1 , x _{i + 1} ,..., X _n ) on the right side of Equation 4 is transformed into the monomial sum form, each monomial becomes n− other than the register i. , Reg.i−1, reg.i + 1,..., Reg.n can be used to calculate sequentially using the values stored in one register reg.1,. At this time, by storing the intermediate value in the above sequential calculation in the surplus register reg.tmp, the values of f (x ₁ ,..., X _i−1 , x _{i + 1} ,..., X _n ) are stored in the surplus register reg. Can be calculated to be stored in tmp. After that, the exclusive OR of the value of the surplus register reg.tmp and the value of the i-th register reg.i is calculated, and the result is stored in the i-th register reg.i. The basic polynomial mapping can be calculated using only n input / output registers and one extra register.

(Triangular polynomial mapping)
FIG. 6 is a diagram for explaining calculation processing of a triangular polynomial map. As in the description of FIG. 5, the CPU 144 is assumed to have five or more registers, of which four registers are reg.1,... Reg.4, and the remaining one register is reg.tmp. And Registers reg.1,..., Reg.4 are input / output registers 208, and register reg.tmp is a surplus register 207. Assume that x ₁ , x ₂ , x ₃ , and x ₄ are stored as values in the four registers reg. It is assumed that an appropriate value t is stored in the surplus register reg.tmp.

First, the CPU 144 reads the S-box processing program PROG2 (120) stored in the RAM 115. Here, G (x ₁ ,..., X ₄ ) = (x ₁ + x ₂ + x ₂ x ₄ , x ₂ + x ₃ + x ₃ x ₄ , as triangular polynomial mapping G in the S-box processing program PROG2 (120). It is assumed that x ₃ + x ₄ , x ₄ +1) is stored. At this time, x ₁ , x ₂ , x ₃ , x ₄ , and t are stored in the registers reg.1,..., Reg.4, and reg.tmp at the timing of (1) in FIG. The CPU 144 reads the S-box processing program PROG2 (120), calculates the exclusive OR of the values of reg.1 and reg.2, and stores the result in reg.1. At this time, x ₁ + x ₂ , x ₂ , x ₃ , x ₄ , and t are stored in the registers reg.1,..., Reg.4, and reg.tmp at the timing of (2) in FIG.

Next, the CPU 144 reads the S-box processing program PROG2 (120), calculates the logical product of the values of the register 2 and the register 4, and stores the result in reg.tmp. At this time, x ₁ + x ₂ , x ₂ , x ₃ , x ₄ , x ₂ x ₄ are stored in the registers reg.1, ..., reg.4, reg.tmp at the timing of (3) in FIG. ing. Next, the CPU 144 reads the S-box processing program PROG2 (120), calculates the exclusive OR of the values of the registers reg.1 and reg.tmp, and stores the result in reg.1. At this time, the timing register reg.1 of (4) in FIG. 6, ..., reg.4, each of the _{reg.tmp x 1 + x 2 + x} 2 x 4, x 2, x 3, x 4, x 2 x ₄ is stored.

Next, the CPU 144 reads the S-box processing program PROG2 (120), calculates the exclusive OR of the values of reg.2 and reg.3, and stores the result in reg.2. At this time, the timing register reg.1 of (5) in FIG. 6, ..., reg.4, each of the _{reg.tmp x 1 + x 2 + x} 2 x 4, x 2 + x 3, x 3, x 4, x ₂ x ₄ is stored. Next, the CPU 144 reads the S-box processing program PROG2 (120), calculates the logical product of the values of reg.3 and reg.4, and stores the result in reg.tmp. At this time, at the timing of (6) in FIG. 6, the registers reg.1,... Reg.4, reg.tmp have x ₁ + x ₂ + x ₂ x ₄ , x ₂ + x ₃ , x ₃ , x ₄ , x, respectively. ₃ x ₄ is stored.

Next, the CPU 144 reads the S-box processing program PROG2 (120), calculates the exclusive OR of the values of reg.2 and reg.tmp, and stores the result in reg.2. At this time, the registers reg.1,..., Reg.4, and reg.tmp at timing (7) in FIG. 6 are respectively x ₁ + x ₂ + x ₂ x ₄ , x ₂ + x ₃ + x ₃ x ₄ , x ₃ , x ₄ and x ₃ x ₄ are stored. Next, the CPU 144 reads the S-box processing program PROG2 (120), calculates the exclusive OR of the values of reg.3 and reg.4, and stores the result in reg.3. At this time, the timing register reg.1 (8) in FIG. 6, ..., reg.4, each of the _{reg.tmp x 1 + x 2 + x} 2 x 4, x 2 + x 3 + x 3 x 4, x 3 + x ₄ , x ₄ , x ₃ x ₄ are stored.

Next, the CPU 144 reads the S-box processing program PROG2 (120), calculates the exclusive OR of the value of reg.4 and the constant 1, and stores the result in reg.4. Since this operation can be realized by using the negation operator of the value stored in the register, the registers other than the above-described registers reg.1, ..., reg.4, reg.tmp are not used. At this time, the registers reg.1, ..., reg.4, and reg.tmp at the timing of (9) in FIG. 6 are x ₁ + x ₂ + x ₂ x ₄ and x ₂ + x ₃ + x ₃ x ₄ and x ₃ + x, respectively. ₄ , x ₄ +1, and x ₃ x ₄ are stored, and the above-described triangular polynomial map G can be calculated.

  In general, the triangular polynomial mapping has the form of Expression 6, and the value of the i-th register reg.i from Expression 6 is changed using the values of the registers reg.i + 1,..., Reg.n after i + 1. . At this time, for the same reason as described above with reference to FIG. 5, the value of the i-th register reg.i is the value of n−i registers reg.i + 1,..., Reg.n and only one extra register. Can be used to calculate. By sequentially processing this operation from 1 to n, a triangular polynomial map on GF (2) can be calculated using only n input / output registers and one extra register.

(Reversible affine polynomial mapping)
FIG. 7 is a diagram for explaining a calculation process of a reversible affine polynomial map. As in the description of FIGS. 5 and 6, the CPU 144 is assumed to have five or more registers, four of which are reg.1, ..., reg.4, and the remaining one register. Is reg.tmp. Registers reg.1,..., Reg.4 are input / output registers 208, and register reg.tmp is a surplus register 207. Assume that x ₁ , x ₂ , x ₃ , and x ₄ are stored as values in the four registers reg. It is assumed that an appropriate value t is stored in the surplus register reg.tmp.

First, the CPU 144 reads the S-box processing program PROG2 (120) stored in the RAM 115. Here, as the reversible affine polynomial mapping H in the S-box processing program PROG2 (120), H (x ₁ ,..., X ₄ ) = (x ₁ + x ₃ , x ₂ + x ₄ , x ₁ + x ₄ , x ₃ ) is stored.

At this time, x ₁ , x ₂ , x ₃ , x ₄ , and t are stored in the registers reg.1,..., Reg.4, and reg.tmp at the timing of (1) in FIG. The CPU 144 reads the S-box processing program PROG2 (120) and stores the value of reg.1 in reg.tmp. At this time, x ₁ , x ₂ , x ₃ , x ₄ , and x ₁ are stored in the registers reg.1,..., Reg.4, and reg.tmp at the timing of (2) in FIG.

Next, the CPU 144 reads the S-box processing program PROG2 (120), calculates the exclusive OR of the values of the register 1 and the register 3, and stores the result in reg.1. At this time, x ₁ + x ₃ , x ₂ , x ₃ , x ₄ , x ₁ are stored in the registers reg.1,..., Reg.4, reg.tmp at the timing of 8 (3) in FIG. Yes.

Next, the CPU 144 reads the S-box processing program PROG2 (120), calculates the exclusive OR of the values of the registers reg.2 and reg.4, and stores the result in reg.2. At this time, x ₁ + x ₃ , x ₂ + x ₄ , x ₃ , x ₄ , x ₁ are stored in the registers reg.1, ..., reg.4, reg.tmp at the timing of (4) in FIG. ing.

Next, the CPU 144 reads the S-box processing program PROG2 (120), calculates the exclusive OR of the values of reg.4 and reg.tmp, and stores the result in reg.tmp. At this time, the registers reg.1, ..., reg.4, and reg.tmp at timing (5) in Fig. 7 have x ₁ + x ₃ , x ₂ + x ₄ , x ₃ , x ₄ , x ₁ + x ₄ , respectively. Stored.

Next, the CPU 144 reads the S-box processing program PROG2 (120) and stores the value of reg.3 in reg.4. At this time, the registers reg.1,..., Reg.4, and reg.tmp at timing (6) in FIG. 7 are respectively x ₁ + x ₃ , x ₂ + x ₄ , x ₃ , x ₃ , x ₁ + x ₄ is stored. Next, the CPU 144 reads the S-box processing program PROG2 (120) and stores the value of reg.tmp in reg.3. At this time, at the timing of (7) in FIG. 7, the registers reg.1,..., Reg.4, reg.tmp are respectively x ₁ + x ₃ , x ₂ + x ₄ , x ₁ + x ₄ , x ₃ , x ₁ + x ₄ is stored, and the above reversible affine polynomial map H can be calculated.

In general, the reversible affine polynomial mapping has the form of number 8, and for input x ₁ ,…, x _n longitudinal vector ^t (x ₁ ,…, x _n ) (left shoulder t represents vector transpose) It can be regarded as affine transformation (linear transformation + addition of a constant). The linear transformation can be regarded as having been subjected to a certain matrix. In particular, a regular matrix (reversible matrix) is represented by a product of six basic deformations. Here, the six basic deformations are the following operations.
1. Swap the i-th row and j-th row of the matrix.
2. Multiply i-th row of matrix by non-zero constant c.
3. Add the non-zero constant multiple of j-th row to the i-th row of the matrix.
4). Swap the i-th column and j-th column of the matrix.
5. Multiplies the i-th column of the matrix by a non-zero constant c.
6). Add the non-zero constant multiple of the jth column to the ith column of the matrix.

  For the same reason as described above with reference to FIGS. 5 and 6, each of the six basic variations can be calculated using only n input / output registers and one extra register. Therefore, a linear transformation using a regular matrix can also be calculated using only n input / output registers and one extra register, so a reversible affine polynomial mapping on GF (2) is obtained with n input / output registers. Calculations can be made using only one extra register.

  It is known that the set of all affine polynomial maps, the set of all triangular polynomial maps, and the set of all basic polynomial maps are subgroups of reversible polynomial maps, and each of these sets is called Aff (k, n) , J (k, n), and E (k, n).

  The subgroup of the reversible polynomial mapping generated by all the elements of Aff (k, n) and E (k, n) is called the tame polynomial mapping subgroup (see Non-Patent Document 2). The element of the subgroup of the tame polynomial map is called the tame polynomial map.

  Also, a subgroup of reversible polynomial maps generated from all elements of Aff (k, n) and J (k, n) and all of Aff (k, n) and E (k, n). The subgroups of the reversible polynomial maps generated by the elements of, and the elements of J (k, n) are n elements of E (k, n) and one of Aff (k, n) It is also known that it can be expressed in the original synthetic form (see Non-Patent Document 2).

  In general, it is difficult to determine whether a polynomial map can be represented in the above composite form, but when the polynomial map is regarded as a permutation, if the field k is a finite field GF (2), then the above It is known that it can be decomposed into a synthetic form (see Non-Patent Document 3).

  FIG. 3 is a flowchart showing the flow of S-box calculation according to the first embodiment.

First, CPU 144 is n-bit data a _1, ... input a _n, the program reading section 204 is a polynomial mapping F _1, the input of ... F _L, receives each (step 301).

Here, the polynomial map F ₁ ,… F _L is an n-variable polynomial map on the finite field GF (2), L is the number of polynomial maps F ₁ ,… F _L , and an n-bit string {0, 1} ⁿ Let's say it's bijective. Further, the polynomial mapping F _1, ... F _L is dependent on the encryption algorithm which is utilized in the encryption processing program PROG1 (116), F _1, synthesized polynomial mapping ... F _L as mapping, S- It is assumed that it matches the n-variable polynomial mapping on the finite field GF (2) representing the box, and that the polynomial mappings F ₁ ,... _FL are calculated in advance before being realized as a program.

Here, each polynomial in the polynomial mapping is not a polynomial ring GF (2) [x ₁ , ... x _n ], but GF (2) [x ₁ , ... x _n ] / (x ₁ ² −x ₁ , ... x _n ² − x _n ) Here, _{GF (2) [x 1,} ... x n] rather than the former _{GF (2) [x 1,} ... x n] is regarded as the original residue ring of, and the ring GF (2) [x ₁ ,… X _n ], the polynomials of GF (2) [x ₁ ,… x _n ] containing elements of the ideal (x ₁ ² − x ₁ ,… x _n ² −x _n ) are to be regarded as equivalent. By considering the remainder ring, each monomial of each polynomial map F ₁ ,... F _L does not include x _i ^m (m is an integer of 2 or more), so “the program size of the S-box processing program 120 is reduced. "Because x _i ^m (m is an integer greater than or equal to 2) is not calculated, the substitution calculation to the polynomial mapping is faster than the original polynomial ring."

  Next, the repetition determining unit 205 substitutes 1 for i (step 302).

  The iterative determination unit 205 determines whether i is equal to or less than the number L of polynomial maps (step 303).

  As a result of step 303, if i ≦ L is satisfied (step 303 → Yes), the process goes to step 304. If i ≦ L does not hold (step 303 → No), go to step 310.

The polynomial mapping affiliation determination unit 206 determines whether or not the polynomial mapping F _i is a reversible affine polynomial mapping (F _i εAff (k, n)) (step 304). If F _i εAff (k, n) is satisfied as a result of step 304 (step 304 → Yes), the process goes to step 305. If F _i εAff (k, n) does not hold (step 304 → No), the process goes to step 306.

Affine polynomial mapping calculation unit 201 by the method shown in FIG. 7, the j (j = 1, ... n ) relative to, F _j (a ₁ with the input and output registers 208 surplus registers 207, ... a _n ) Is calculated and substituted for a _j (step 305).

The polynomial mapping affiliation determination unit 206 determines whether or not the polynomial mapping F _i is a basic polynomial mapping (F _i εE (k, n)) (step 306). As a result of Step 306, when F _i εE (k, n) is satisfied (Step 306 → Yes), the process goes to Step 307. If F _i εE (k, n) is not satisfied (step 306 → No), the process goes to step 308.

Basic polynomial mapping calculation unit 202, by the method shown in FIG. 5, the j (j = 1, ... n ) relative to, F _j (a ₁ with surplus register 207 and output register 208, ... a _n ) Is calculated and substituted for a _j (step 307).

triangular polynomial mapping calculation unit 203 by the method shown in FIG. 6, the j (j = 1, ... n ) relative to, F _j (a ₁ with the input and output registers 208 surplus registers 207, ... a _n ) Is calculated and substituted for a _j (step 308). Assignment operations for each a _j are performed in parallel.

  The repetition determination unit 205 substitutes i + 1 for i (step 309).

The CPU 144 outputs n-bit data a ₁ and a _n (step 310).

As described above, n bit data a ₁ output from the CPU 144, ... a _n can be calculated using one of the registers and output registers 208 of the surplus register 207. The reason for this is as described in the description of FIGS.

  In the present embodiment, it has been shown that reversible affine polynomial mapping, basic polynomial mapping, and triangular polynomial mapping can be calculated by one extra register and input / output register. The calculation may be performed using the surplus register and the input / output register.

  In general, a method of expressing a polynomial map in the form of a combination of an affine polynomial map, a basic polynomial map, and a triangular polynomial map is not unique, but any combination may be used.

(Effects of the first embodiment)
As described above, according to the S-box calculation method of the first embodiment, it is possible to calculate an S-box using one surplus register and an input / output register. That is, according to the present embodiment, software implementation of common key cryptography using a small number of surplus registers is possible regardless of any cryptographic algorithm.
(Second embodiment)
Next, a second embodiment according to the present invention will be described with reference to FIGS. In the first embodiment, the S-box calculation method using a small number of surplus registers and input / output registers in the software implementation of common common key cryptography such as block cipher, stream cipher, and cryptographic hash function has been described. However, in the second embodiment, a method for calculating an S-box using a small number of surplus registers and input / output registers for a specific common key encryption algorithm will be described.

  In the present embodiment, description will be made using a pseudo-random number generator Enocoro-128v2 for stream cipher as a specific common key encryption algorithm. The pseudorandom number generator Enocoro-128v2 is described in Non-Patent Document 6, for example.

The second embodiment differs from the first embodiment in that the polynomial mapping F ₁ ,... Stored in the encryption processing program PROG1 116 in FIG. 1 and the S-box processing program PROG2 (120) in FIG. F _L is a polynomial mapping G ₁ ,... G _L stored in the decoding processing program PROG3 (147) in FIG. 1 and the S-box processing program PROG4 (151) in FIG. In addition, illustration and description of other configurations and processes are omitted. That is, in the first embodiment, a specific encryption algorithm is not specified, and any S-box (but bijection) of any encryption algorithm is composed of an input / output register and one extra register. Although it has been described that calculation is possible, the second embodiment describes, as an example, how to realize the contents described in the first embodiment for a specific encryption algorithm.

  In the second embodiment, the encryption processing program PROG1 (116) in FIG. 1 and the decryption processing program PROG3 (147) in FIG. 1 store a stream cipher Enocoro-128v2.

Further, for the polynomial maps F ₁ ,... F _L stored in the S-box processing program PROG2 (120) of FIG. 1, L = 27, and for each i (1 ≦ i ≦ L), FIG. The polynomial maps F ₁ ,... F ₂₇ stored in the S-box processing program PROG2 120 are as shown in FIG. Further, F _i = G _i for the polynomial maps G ₁ ,... G ₂₇ stored in the S-box processing program PROG4 151 of FIG.

Note that the polynomial map F _2i−1 (1 ≦ i ≦ 14) is a reversible affine polynomial map and the polynomial map F _2i (1 ≦ i ≦ 13) with respect to the polynomial map F ₁ ,... F ₂₇ shown in FIG. Is a triangular polynomial map or a basic polynomial map.

CPU144 is, the polynomial mapping F ₁ according the S-box processing program 120 in FIG. 4, ... read the F _27, n-bit data a ₁ stored in the output register 207, ... a _n, and read of the A process for converting the S-box using the polynomial map F ₁ ,... F ₂₇ will be described.

  This calculation is performed using the flowchart shown in FIG.

Each polynomial map shown in FIG. 4 is one of a basic polynomial map, a triangular polynomial map, or a reversible affine polynomial map. As described in the first embodiment, the method shown in FIGS. in by performing calculations, n-bit data a ₁ stored in the output register 207, ... basic polynomial mapping from a _n, triangular polynomial mapping can calculate the value of reversible affine polynomial mapping.

N-bit data a ₁ output from the CPU 144, ... a _n can be calculated using one of the registers and output registers 208 of the surplus register 207. The reason is the same as in the first embodiment.

  In this embodiment, as in the first embodiment, a reversible affine polynomial map, basic polynomial map, and triangular polynomial map can be calculated with one extra register and input / output register. As with the first embodiment, it may be calculated with two or more surplus registers and input / output registers.

  In general, the method of expressing a polynomial map in the form of a composition of an affine polynomial map, a basic polynomial map, and a triangular polynomial map is not unique, but it is the first implementation that any composition form may be used. It is the same as the form.

(Effect of the second embodiment)
Similar to the first embodiment, according to the S-box calculation method of the second embodiment, it is possible to calculate an S-box using one surplus register and an input / output register. That is, according to the present embodiment, software implementation of the stream cipher Enocoro-128v2 using a small number of surplus registers becomes possible.

In each of the above embodiments, the encryption communication system is described, and the encryption program is described as a block cipher and a stream cipher.
The encryption program may be a hash function program.

101: Data, 114: Computer A, 115: RAM, 116: Encryption processing program PROG1, 117: Secret key Key, 118: Auxiliary information IV, 119: Plain text M, 120: S-box processing program PROG2, 124: Display , 125: keyboard, 126: network, 127: data, 130: input / output interface, 144: CPU, 145: computer B, 146: RAM, 147: decryption processing program PROG3, 148: secret key Key, 149: auxiliary information IV , 150: plaintext M, 151: S-box processing program PROG4, 152: display, 153: keyboard, 156: input / output interface, 157: CPU

Claims (11)

A processing device having a CPU and a storage unit is a method of calculating a nonlinear function S-box for encrypting plaintext data or decrypting ciphertext data,
When combined according to a predetermined order, a predetermined number of polynomial mappings representing an S-box whose input and output are n-bit permutations are stored in the storage unit,
When calculating the S-box based on the n-bit data stored in each of the n input / output registers provided in the CPU, and the polynomial mapping stored in the storage unit,
A first step of converting the n-bit data into a first numerical sequence that is an element of an n-dimensional linear space GF (2) ⁿ on a finite field GF (2);
A second numerical value sequence that is converted into a second numerical value sequence by using the register different from the input / output register and the predetermined polynomial mapping from the first numerical value sequence stored in the input / output register. And the steps
A non-linear function S-box calculation method, wherein the second step is performed by a third step of repeating the polynomial mapping a number of times. The first step is, n-bit data a _1, ..., converted from a _n n-dimensional linear space GF (2) ⁿ of the original _{(a 1, ..., a n} ) , the
The second step is for n-dimensional linear space GF (2) ⁿ elements (a ₁ , ..., a _n ) and a predetermined number of polynomial maps F ₁ , ..., F _{L F i (a 1, ...,} a n) to calculate _{the, (a 1, ..., a} n) F i (a 1, ..., a n) to perform conversion to assign,
The third step, between the i is 1 to _{n, F i (a 1,} ..., a n) to calculate _{the, (a 1, ..., a} n) to F _i (a ₁ , ..., a _n ) are substituted, and i is incremented by 1 and the above process is repeated.
The nonlinear function S-box calculation method according to claim 1.   3. The nonlinear function S according to claim 2, wherein the types of polynomial maps stored in the storage unit include at least one of a basic polynomial map, a triangular polynomial map, and a reversible affine polynomial map. -box calculation method.   In the operation of the register in the polynomial mapping, after the operation using the original data, an operation in which the original data is changed by the operation with other data is performed, and the original data that is used in the subsequent operation 2. The nonlinear function S-box calculation method according to claim 1, wherein when there is no register for storing data or an operation result, the data is saved in a surplus register. The register operation in the polynomial map is
(1) Data that uses the original data as it is after mapping is left in the register,
(2) If the original data is not used as it is, although it is changed by the operation with other data, store the operation result in the register where the original data was stored,
(3) Although it is changed by an operation with other data, when the original data is used in another operation, the original data is temporarily saved in a surplus register before the operation with the other data,
(4) If the operation result or intermediate data cannot be stored or added to the register in which the original data was stored, the operation result is temporarily stored in the surplus register,
(5) The non-linear function S-box calculation method according to claim 4, wherein the original data is used in another calculation before being changed by the calculation with other data. An S-box computing device comprising a CPU for encrypting plaintext data or decrypting ciphertext data,
A storage unit for storing a predetermined number of polynomial mappings, which represents an S-box whose input and output are n-bit permutations when synthesized according to a predetermined order;
When calculating the S-box based on the n-bit data stored in each of the n input / output registers provided in the CPU and the polynomial mapping stored in the storage unit, the n-bit A first conversion means for converting data into a first numerical sequence that is an element of an n-dimensional linear space GF (2) ⁿ on a finite field GF (2);
A second numerical sequence that converts the first numerical sequence stored in the input / output register into a second numerical sequence based on a register different from the input / output register and the predetermined polynomial mapping; Conversion means,
An S-box calculation apparatus comprising: a third unit that repeats the second conversion unit a number of times of the polynomial mapping. Said first conversion means, n-bit data a _1, ..., converted from a _n n-dimensional linear space GF (2) ⁿ of the original _{(a 1, ..., a n} ) , the
The second transform means is for n-dimensional linear space GF (2) ⁿ elements (a ₁ , ..., a _n ) and a predetermined number of polynomial maps F ₁ , ..., F _{L F i (a 1, ...,} a n) Te to calculate _{the, (a 1, ..., a} n) F i (a 1, ..., a n) to perform conversion to assign,
It said third means, between the i is 1 to _{n, F i (a 1,} ..., a n) to calculate _{the, (a 1, ..., a} n) to F _i (a ₁ , ..., a _n ) is repeated and the process of increasing i by 1 is repeated.
The S-box calculation apparatus according to claim 6.   8. The S-box calculation apparatus according to claim 7, wherein each polynomial map stored in the storage unit is one of a basic polynomial map, a triangular polynomial map, and a reversible affine polynomial map.   In the operation of the register in the polynomial mapping, after the operation using the original data, an operation in which the original data is changed by the operation with other data is performed, and the original data that is used in the subsequent operation 7. The S-box calculation apparatus according to claim 6, wherein when there is no register for storing data or an operation result, the data is saved in a surplus register. The register operation in the polynomial map is
(1) Data that uses the original data as it is after mapping is left in the register,
(2) If the original data is not used as it is, although it is changed by the operation with other data, store the operation result in the register where the original data was stored,
(3) Although it is changed by an operation with other data, when the original data is used in another operation, the original data is temporarily saved in a surplus register before the operation with the other data,
(4) If the operation result or intermediate data cannot be stored or added to the register in which the original data was stored, the operation result is temporarily stored in the surplus register,
(5) The S-box calculation device according to claim 9, wherein the original data is used in another operation before being changed by the operation with other data.   A storage medium readable by a computer, which stores a program for executing the calculation method of the nonlinear function S-box according to claim 1.

Images