KR100362170B1 - Apparatus of encryption for round key generating and encryption processing - Google Patents

Abstract

The present invention relates to an encryption device for round key generation and encryption processing, in order to improve the processing speed of the system through high-speed encryption processing in a system requiring data encryption / decryption and to minimize the load on the system by the decryption operation. In a system that requires data encryption / decryption, receiving an encryption key / decryption key and a control variable from a first external source and providing an initial key input and a use password selection value to a round key generation means Round key generation control means for receiving a round key result from the round key generation means and providing an encryption / decryption round key; A round for generating a round key result by receiving an initial key input and a use password selection value from the round key generation control means and performing a round key generation round, and providing the generated round key result to the round key generation control means. Key generation means; A round key, an initial plain text, and a cipher selection value are provided to a cipher processing means by receiving a plain text / password from a second outside, a control variable from the first outside, and a cipher / decryption round key from the round key generation control means. Encryption processing control means for receiving the encryption / decryption processing result from the encryption processing means and outputting the encrypted text / plain text; And inputting a round key, an initial plain text, and a used password selection value as the first round input from the encryption processing control means, repeating the encryption processing round to generate an encryption / decryption processing result, and generating the generated encryption / decryption processing result into the encryption processing. It includes encryption processing means for outputting to the control means, and is used for a system requiring data encryption / decryption.

Description

Apparatus of encryption for round key generating and encryption processing}

The present invention relates to an encryption device for round key generation and encryption processing for high-speed encryption processing. In particular, the 128-bit seed (SEED) encryption and 64-bit data encryption standard (DES) of a domestic standard, which is a kind of symmetric key block encryption algorithm. : Hardware structure that handles two-key triple-DES (Triple-DES) cipher, a variation of Data Encryption Standard), and it is a cipher processing round structure that can perform two encryption algorithms at high speed.

At present, the development of information systems and the rapid expansion of communication networks have raised awareness of the importance of information protection. In addition, methods for securing information are being researched, and information protection methods using encryption are widely used.

In the present invention, a triple-DES cipher with enhanced safety of national standards SEED and DES is used.

SEED and DES ciphers are block cipher algorithms that use symmetric keys to process plain text in block units. SEED ciphers use 128-bit input / output and keys and consist of 16 rounds.

Triple-DES encryption is a structure that repeats encryption and decryption based on DES in 64-bit I / O and 2-key (128-bit) manner.

When encryption is applied to an information system, high-speed encryption is essential because cryptographic processing is applied as an additional process of system operation and affects the speed of the system. In addition, in order to minimize the load of the encryption and decryption operation on the system in real-time communication or high-speed communication network, the encryption system also needs a high-speed encryption processing of 100Mbps or more. Therefore, for real time processing or high speed communication, implementation in hardware is required.

Most block cipher algorithms are designed with a "Feistel" structure. That is, the 2N bit plaintext blocks L ₀ and R ₀ each consisting of N bits L ₀ and R ₀ blocks perform R rounds and are converted into ciphertexts L _R and R _R. This repeating structure is called a modulo round consisting of an input block (L _i , R _i ), an output block (L _{i + 1} , R _{i + 1} ), and a round function. This round uses L _i = R _i-1 and R _i = R _i-1 as inputs of the round key, K _i (1 <i <R) and plaintext / password, generated by key scheduling from the encryption key. Output the round result of f (R _i-1 , K _i ). Where f (R _i-1 , K _i ) is a round function.

In the two ciphers that are handled, the SEED cipher is a 128-bit plaintext and cipher key, and is a cipher that repeats 16 rounds. Cryptographic processing is performed according to the round function with 64-bit round keys generated by key scheduling as input. The round function consists of a G-function consisting of four s-boxes and a 32-bit modular addition. On the other hand, in the case of the 2-key triple-DES cipher, DES is the basic structure but the structure is repeated three times in the order of cipher / decryption / cipher, so that 64-bit plaintext, cipher key, and decryption key are input. It is a password that repeats 48 rounds. Cryptographic processing and round functions are the same as in traditional DES. The block cipher algorithm uses an operation method of an electronic codebook (ECB), cipher block chaining (CBC), cipher feedback (CFB), and output feedback (OFB) to enhance security.

As described above, when encryption is applied to a system requiring data encryption / decryption, high-speed encryption is essential because encryption processing is not only applied to additional processing of the system operation but also affects the processing speed of the system. In addition, in order to minimize the load of the encryption and decryption operation on the system in real-time communication or high-speed communication network, the encryption system also needs a high-speed encryption processing of 100Mbps or more. Therefore, for real time processing or high speed communication, implementation in hardware is required.

This is because the SEED cipher has a 16 round repeating structure, whereas the triple-DES is a 48 round repeating structure with two ciphers and one decryption process. Therefore, since these ciphers are repeatedly executed in the same round, the cipher cipher rounding structure is essential for high speed cipher processing, realization chip area reduction, enhanced cipher safety, and the like.

The present invention has been proposed to meet the requirements as described above, in order to improve the processing speed of the system through a high-speed encryption processing in a system requiring data encryption / decryption and to minimize the load on the system decryption operation It is an object of the present invention to provide an encryption device for round key generation and encryption processing.

1 is a block diagram of an embodiment of an encryption apparatus for round key generation and encryption processing according to the present invention.

Figure 2 is a detailed configuration diagram of one embodiment of the round key generation circuit of Figure 1 according to the present invention.

3 is a detailed block diagram of an embodiment of the triple-DES round key generation circuit of FIG. 2 according to the present invention;

Figure 4 is a detailed configuration diagram of an embodiment of the encryption processing circuit of Figure 1 according to the present invention.

5 is a detailed block diagram of an embodiment of the triple-DES encryption round of FIG. 4 according to the present invention.

* Explanation of symbols for the main parts of the drawings

1: Round for generating a key 2: Round for encryption processing

In order to achieve the above object, the present invention provides a device for encryption processing in a system that requires data encryption / decryption, wherein an encryption key / decryption key and a control variable are received from a first source and initialized to a round key generating means. Round key generation control means for providing a key input and a use password selection value, and receiving a round key result from the round key generation means to provide an encryption / decryption round key; A round for generating a round key result by receiving an initial key input and a use password selection value from the round key generation control means and performing a round key generation round, and providing the generated round key result to the round key generation control means. Key generation means; A round key, an initial plain text, and a cipher selection value are provided to a cipher processing means by receiving a plain text / password from a second outside, a control variable from the first outside, and a cipher / decryption round key from the round key generation control means. Encryption processing control means for receiving the encryption / decryption processing result from the encryption processing means and outputting the encrypted text / plain text; And inputting a round key, an initial plain text, and a used password selection value as the first round input from the encryption processing control means, repeating the encryption processing round to generate an encryption / decryption processing result, and generating the generated encryption / decryption processing result into the encryption processing. Characterized in that it comprises a cryptographic processing means for output to the control means.

The present invention relates to a round structure for fast cryptographic processing in the implementation of a block cipher algorithm in hardware. Here, the block cipher algorithm used is a two-key triple-DES (triple-DES) cipher that transforms a domestic standard 128-bit SEED cipher and a 64-bit DES that is an international data encryption standard. In addition, the encryption / decryption of the block cipher algorithm is performed by repeating the round, and the execution process consists of the round key generation and the encryption / decryption process.

In the case of SEED encryption, 16 rounds of key generation and encryption / decryption processes are performed to encrypt the plain text entered, while in the case of triple-DES encryption, 16 rounds of encryption and decryption round key generation and 48 rounds of encryption are performed. Encrypt with encryption / decryption process.

In cryptographic processing systems that require data encryption / decryption, cryptographic processing is not only applied as an additional processing of system operation, but also high speed cryptographic processing is essential because it affects the processing speed of the system. Also, in order to minimize the load of the encryption / decryption operation on the system in real-time communication or high-speed communication network, the encryption system also needs high-speed encryption of 100Mbps or more. Therefore, for real time processing or high speed communication, implementation in hardware is required.

To this end, the round structure for the high-speed encryption processing of the present invention, the plain text / cipher text, encryption key / decryption key, the control variable input from the external processor, the encryption / decryption result is processed by the external processor control Means for outputting.

The round structure for the fast encryption processing of the present invention performs two encryption algorithms, and in the case of the triple-DES encryption for the fast encryption processing, one round of execution generates a round key for encryption and decryption and performs 12 rounds. In this configuration, encryption / decryption is performed. Such a configuration can encrypt or decrypt data at high speed in an encryption processing system, a data storage / management system, and an information protection system.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is an overall configuration diagram of an encryption device for round key generation and encryption processing according to the present invention, in which "11" is a round key generation circuit controller, "12" is a round key generation circuit, and "13". Denotes an encryption processing circuit controller, and " 14 "

As shown in Fig. 1, the encryption apparatus for round key generation and encryption processing according to the present invention includes a round key generation round 1 and an encryption processing round 2, and the round key generation round. (1) receives an encryption key / decryption key and control variables (selection of use password, operation mode and encryption / decryption operation), and provides an initial key input and use password selection value to the round key generation circuit 12, A round key generation circuit controller 11 which receives the round key result of the key generation circuit 12 and provides the encryption / decryption round key to the encryption processing circuit controller 13, and inputs an initial key input and a password selection value to be used. The round key generation circuit 12 provides a round key generation circuit 12 that provides the round key generation circuit controller 11 with the round key generation result generated by the execution of the round key generation round. Round key for decoding, By inputting plain text / password and control variable, it provides round key, initial plain text, and use password selection value to the encryption processing circuit 14, and receives the encryption / decryption processing result of the encryption processing circuit 14. An encryption processing circuit controller 13 for outputting, and an encryption processing circuit 14 for outputting the encryption / decryption processing result generated by repeating the encryption processing round as the first round input with the round key, the initial plain text, and the use password selection value. It is provided.

A high-speed encryption apparatus having a round key generation round 1 and an encryption processing round 2 according to the present invention has a plain / cryptogram and an encryption key / decryption key as inputs, and the round key and Output ciphertext / plaintext. At this time, the repeated round is composed of a round key generation round (1) and the encryption processing round (2).

The round 1 for round key generation is composed of a round key generation circuit controller 11 and a round key generation circuit 12.

The round key generation circuit controller 11 inputs an encryption key / decryption key and a control variable (use password, operation mode and encryption / decryption operation selection) as inputs, and selects an initial key input and use password to be used in the round key generation circuit 12. Supply a value.

The round key generation circuit 12 repeats the round with the supplied initial key input as the input of the first repetition round, and supplies the generated round key result to the round key generation circuit controller 11.

After all rounds of repetitive processing are completed, the round key generation circuit controller 11 supplies the encryption / decryption round keys to the encryption processing round 2.

On the other hand, the configuration of the encryption processing round 2 is composed of an encryption processing circuit controller 13 and an encryption processing circuit 14.

The encryption processing circuit controller 13 inputs the encryption / decryption round key outputted from the round 1 for round key generation, the plain text / encryption text, and the control variable as inputs to the encryption processing circuit 14 for the round key, the initial plain text. , Supply password selection value.

The encryption processing circuit 14 performs the first round of encryption / decryption by inputting the round key and the initial plain text value, and supplies the final encryption / decryption processing result to the encryption processing circuit controller 13 to receive the final encryption / decryption. Output ciphertext / plaintext which is the result of decryption processing.

FIG. 2 is a detailed configuration diagram of the round key generation circuit of FIG. 1 according to the present invention, in which “21” is a first multiplexer, “22” is a first demultiplexer, and “23” is a SEED round key. A generation circuit, "24" represents a triple-DES round key generation circuit, and "25" represents a second multiplexer, respectively.

As shown in FIG. 2, the round key generation circuit 12 includes a first multiplexer 21, a first demultiplexer 22, a SEED round key generation circuit 23, and a triple-DES round key generation circuit 24. And a second multiplexer 25 to generate a round key for use in encryption / decryption processing.

When the initial key input and the use password selection value are input to the round key generation circuit 12, the first multiplexer 21 selects the initial key input and the round key feedback result and outputs the result to the first demultiplexer 22.

The first demultiplexer 22 inputs the initial key into the round key generation circuit 23 or 24 of the corresponding cipher according to the use cipher selection value. The SEED round key generation circuit 23 or the triple-DES round key generation circuit 24 is operated using this initial key as an input, and the result is output to the second multiplexer 25.

The second multiplexer 25 feeds the round key back to the first multiplexer 21 when the password selection value is a SEED cipher so as to repeat the round.

The SEED round key generation circuit 23 is composed of a single round and repeats structure, and uses a round function used for key scheduling of SEED encryption.

3 is a detailed configuration diagram of an embodiment of the triple-DES round key generation circuit of FIG. 2 according to the present invention, in which "31" represents an encryption round and "32" represents a decryption round, respectively.

As shown in FIG. 3, the triple-DES round key generation circuit 24 is composed of a cipher round 31 and a decryption round 32 to generate a cipher / decryption round key for a triple-DES cipher. do.

The triple-DES round key generation circuit 24 comprises 16 cipher rounds 31 and 16 decryption rounds 32 as a single round.

The use of 16 rounds generates both cryptographic and decryption round keys in a single round process, and the cipher round 31 and decryption round 32 used are the same as those used in key scheduling of the DES cipher.

FIG. 4 is a detailed configuration diagram of an encryption processing circuit of FIG. 1 according to the present invention, in which "41" is a plain text register, "42" is a third multiplexer, "43" is a round input register, " 44 denotes a second demultiplexer, 45 denotes a SEED encryption round, 46 denotes a triple-DES encryption round, 47 denotes a fourth multiplexer, and 48 denotes a round output register.

The encryption processing circuit 14 of FIG. 1 includes a plain text register 41, a third multiplexer 42, a round input register 43, a second demultiplexer 44, a SEED encryption processing round 45, and triple-DES. An encryption round 46, a fourth multiplexer 47, and a round output register 48 are provided to encrypt / decrypt using an initial plain text and a round key.

As shown in FIG. 4, the encryption processing circuit 14 includes a plain text register 41 for storing the initial plain text, a third multiplexer 42 for selectively outputting the output and the round feedback value of the plain text register 41; A round input register 43 for storing a round input for storing an initial plain text input of the SEED encryption round 45 and a triple-DES encryption round 46 and an input of repeated rounds, and a password selection value for use. A second demultiplexer 44 for selecting and supplying each cipher processing round input value and an output and a round key of the second demultiplexer 44 as inputs, and a SEED cipher processing round 45 which is a cipher processing round of the SEED cipher. And a triple-DES encryption processing round 46 which is an encryption processing round of the triple-DES encryption by inputting the output of the second demultiplexer 44 and a round key, and a SEED encryption processing round according to the password selection value. 45) and triple-DES ciphers A fourth multiplexer 47 for selectively outputting the ciphering round result of the reround 46, and an output of the fourth multiplexer 47, and outputting a round feedback value to the third multiplexer 42, and finally And a round output register 48 for outputting round results.

The SEED encryption round 45 is composed of a single round and repeats, and uses a round function used in the encryption round of SEED encryption.

FIG. 5 is a detailed configuration diagram of an embodiment of the triple-DES encryption round of FIG. 4 according to the present invention, in which “51” denotes a encryption round.

As shown in Fig. 5, the triple-DES encryption round 46 performs encryption / decryption processing using the initial plain text and the encryption and decryption round keys through the encryption round 51.

Triple-DES encryption round 46 is composed of four rounds of encryption round 51 consists of a single round, and performs four rounds of encryption rounds 51 by inputting a plain text / password and four round keys. do. At this time, the used encryption processing round 51 is the same as the basic encryption processing round of the DES encryption.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the spirit of the present invention for those skilled in the art to which the present invention pertains, and the above-described embodiments and accompanying It is not limited to the drawing.

As described above, the present invention enables effective round key generation and encryption processing in terms of hardware area and processing speed, and especially in the case of triple-DES in the round key generation process, encryption key and decryption key are simultaneously generated in a single round. By reducing the number of rounds of triple-DES encryption to 1/4 during the encryption process, the processing speed of the encryption / decryption process can be improved, and the high-speed encryption process improves the security of the password. .

Claims (12)

An apparatus for encryption processing in a system requiring data encryption / decryption, Receives an encryption key / decryption key and a control variable from a first external source and provides an initial key input and a use password selection value to a round key generation means, and receives a round key result from the round key generation means and encrypts / decrypts a round key. Round key generation control means for providing a; A round for generating a round key result by receiving an initial key input and a use password selection value from the round key generation control means and performing a round key generation round, and providing the generated round key result to the round key generation control means. Key generation means; A round key, an initial plain text, and a cipher selection value are provided to a cipher processing means by receiving a plain text / password from a second outside, a control variable from the first outside, and a cipher / decryption round key from the round key generation control means. Encryption processing control means for receiving the encryption / decryption processing result from the encryption processing means and outputting the encrypted text / plain text; And A round key, an initial plain text, and a use password selection value are input from the encryption processing control unit as the first round input, and the encryption / decryption processing result is generated by repeating the encryption processing round, and controlling the generated encryption / decryption processing result. Cryptographic processing means for output by means Encryption apparatus for round key generation and encryption processing comprising a. The method of claim 1, The round key generating means, To generate a round key for use in encryption / decryption processing, A first multiplexer for selectively outputting either an initial key input or a round key feedback result provided from the round key generation control means; A first demultiplexer for providing a first cryptographic initial key or a second cryptographic initial key according to a password selection value using an output of the first multiplexer; First cryptographic round key generating means for generating a first cryptographic round key by inputting the first cryptographic initial key; Second cryptographic round key generating means for generating a second cryptographic and decryption round key by inputting the second cryptographic initial key; And A second multiplexer which provides the round key generated by the first or second round key generating means to the first multiplexer with the round key feedback or outputs a round key result according to a password selection value; Encryption device for round key generation and encryption processing comprising a. The method of claim 2, The second cipher round key generating means, 16 cipher rounding means for generating an encryption round key using the second cipher initial key as input, and 16 cipher generating round key for decryption to generate the cipher / decryption round key of the second cipher. A cryptographic apparatus for round key generation and encryption processing, comprising: a rounding means for decryption, providing a round key for encryption and decryption in a single round. The method according to any one of claims 1 to 3, The encryption processing means, To encrypt / decrypt using initial plain text and round keys, A plain text register for storing an initial plain text inputted from said encryption processing control means; A third multiplexer for selectively outputting one of an output of the plaintext register or a round feedback value output from a round output register; A round input register for storing an input of an initial plaintext and an input of repeated rounds of the first cryptographic rounding means and the second cryptographic rounding means; A second demultiplexer for selectively supplying the output of the round input register in accordance with a use password selection value from the encryption processing control means; First encryption processing rounding means for encrypting with a first cipher as an input of an output of the second demultiplexer and a round key from the cipher processing control means; Second encryption processing rounding means for encrypting with a second cryptographic input, as an input of an output of said second demultiplexer and a round key from said cryptographic processing control means; A fourth multiplexer for selectively supplying an output value of the first or second encryption processing rounding means in accordance with a use password selection value from the encryption processing control means; And The round output register for storing an output of the fourth multiplexer, outputting a next round of input to the third multiplexer, and outputting an encryption / decryption processing result, which is a final round result, to the cryptographic processing control means. Encryption device for round key generation and encryption processing comprising a. The method of claim 4, wherein The first password, An encryption device for round key generation and encryption, characterized in that it is a seed (SEED) cipher consisting of 16 rounds using 128 bits of input and output and a key. The method of claim 5, The second password is, An encryption device for round key generation and encryption processing, characterized in that the two-key (128-bit) triple-DES (Triple-DES) of the 64-bit Data Encryption Standard (DES) which is an international data encryption standard. The method of claim 6, The encryption processing means, And said SEED encryption process and said triple-DES encryption process can be selectively performed. The method of claim 6, The second encryption processing rounding means, A round key generation and encryption processing device comprising a round input and four round keys as inputs, comprising four encryption processing rounds to perform four stages of DES basic encryption processing rounds. The method of claim 6, The first and second encryption processing rounding means, When the first encryption processing rounding means (the SEED cipher round) is composed of two or four rounds, the second encryption processing rounding means (the triple-DES cipher rounds) is composed of eight or sixteen rounds, respectively. Encryption apparatus for the round key generation and encryption processing, characterized in that. The method of claim 6, The first encryption round key generating means, Repeatedly composed of a single round, round key generation and encryption processing apparatus, characterized in that for using the round function used in the key scheduling of the SEED encryption. The method of claim 6, The first encryption processing rounding means, Repeated, consisting of a single round, round key generation and encryption processing apparatus, characterized in that using the round function used in the encryption processing round of the SEED encryption. The method of claim 1, The control variable, Encryption apparatus for round key generation and encryption processing, characterized in that it comprises a use password, an operation mode and a cipher / decryption operation selection value.