KR100377173B1 - Encryption device using data encryption standard algorithm - Google Patents

Abstract

The present invention relates to an encryption apparatus using a data standard encryption algorithm of a data encryption apparatus, wherein the encryption apparatus performs initial substitution of at least one N-bit (N is an even natural number) plaintext data block and bisects the data initially substituted. Initial substitution means for outputting at least one first and second initial substitution data; A transform unit for receiving the first and second initial substitution data and performing product transformation of i rounds (i is a natural number) of the first and second initial substitution data to output i round product transformed data; And an inverse initial replacement means for receiving the i-round multiply transformed data to perform inverse initial replacement, wherein the deformation unit includes at least one product deformation unit. The encryption apparatus according to the present invention eliminates the registers storing redundant intermediate variables, reducing the area occupied by the chip during integration and reducing the clock cycles of storing intermediate variables in registers, thereby reducing the clock cycles required to calculate the entire 16 rounds by 8.5. It reduces the clock cycles to minimize power consumption and has a pipelined structure, thereby improving throughput.

Description

Encryption device using data encryption standard algorithm

The present invention relates to an encryption method and apparatus, and more particularly, to an encryption apparatus using a data encryption standard algorithm.

In general, the Data Encryption Standard (DES) algorithm is the most widely used encryption method and its importance is increasing as the use of networking increases. In particular, it is widely used in secure Internet applications, remote access servers, cable modems and satellite modems.

DES is basically a 64-bit block cipher with inputs and outputs of 64-bit blocks. 56 bits of the 64-bit key block are used for encryption and decryption, and the remaining 8 bits are parity. Used for inspection. That is, it is an encryption method that outputs a 64-bit cipher text block by inputting a 64-bit plain text block and a 56-bit key.

Important techniques for realizing DES include substitution (P-Box), substitution (S-Box), and key schedules for generating subkeys.

The inner part of the data encryption unit is configured to perform 16 rounds of repetitive operations and is composed of an initial substitution (IP) of an input unit and an inverse initial substitution (IP ^-1 ) of an output unit.

1 is a block diagram illustrating a prior art DES algorithm.

Referring to FIG. 1, the algorithm of the encryption apparatus according to the related art first includes an initial substitution unit 110 which performs initial permutation (IP) of a 64-bit plain text block, and then a substitution unit 110. 16-bit Product Transformation and Left, divided into two 32-bit blocks, stored in the left register (L ₀ ) and the right register (R ₀ ), and performed by the cipher function f. A transform unit 120 that performs 16 rounds of block transformation by exchanging the register L _i and the right register R _i every round, and an inverse initial substitution (IP) after 16 rounds of transformation is completed. ^The reverse initial exchanger 130 outputs an encrypted cipher text (Cipher Text) through ^-1 ).

The product transformation in the transformation unit 120 uses the subkey K _i generated by the key scheduler to store data stored in the right register R _i among the 32-bit blocks divided by the initial replacement unit 110. by input with consists of the cipher function unit (f) (121) for performing cryptographic operations, the results of the cipher function f as the exclusive-OR operation unit 122 to the exclusive-OR with the left register (L _i).

32-bit data of the exclusive OR operation 122 is stored in the right register (R _{i + 1} ) for the next round of operations, and 32-bit data stored in the right register (R _i ) is stored in the left register (L _i ) of the next round. ₊₁ ) is swapped and stored. This round of operation is repeated to perform 16 rounds.

When the 64-bit plain text block passed through the initial substitution unit 110 is divided into two and input into the left register (L ₀ ) and the right register (R ₀ ), each round of 16 times is represented by the following equation (1) and (2). It is possible.

Li = Ri-1 i = 1,2, ...... 16

f (Ri-1, Ki) i = 1,2, ...... 16

2 is a block diagram illustrating a key scheduler that generates a subkey.

Referring to FIG. 2, the key scheduler includes a permutation selection unit (PC1) 200 that receives and substitutes a 56-bit key, and a 56-bit block substituted by the permutation selection unit 200. Is divided into two 28-bit blocks and stored in variables C ₀ and D ₀ , and then the left register C _i (211) and the right register are used to generate a 48-bit auxiliary key for the operation of the cipher function during the 16-round multiply operation. The data stored in D _i (212) is shifted left or right by one or two digits by the left shifter (213, 214) to the left variable C _{i + 1} and the right variable D _{i + 1} of the next round. substituted for storing outputs the basic operation unit 210, and each of every round receives from the left register C _i, and the right register D _i shift of the input block data of 28 bits of the 48-bit secondary key (Subkey) K _i for selecting section ( PC2: Permutation Choice 2) (220).

During 16 rounds, C _i and D _i are shifted by 28 digits so that C ₀ and C ₁₆ and D ₀ and D ₁₆ are the same data.

3 is a block diagram of a typical DES core architecture.

Referring to FIG. 3, the cipher function f includes an expansion permutation 300 which copies some of the 32-bit inputs R (i-1) stored in the right register and replaces them with 48 bits. The exclusive logical OR operation unit 310 for exclusively ORing the substitution result of 300 with the 48-bit auxiliary key generated by the key scheduler in each round, and the 48-bit block computed by the exclusive OR operation unit 310 in 32-bit order. The S-Box replacement unit 320 replacing the block and the P-Box replacement unit 330 generating a 32-bit block by substituting the substituted 32-bit block of the S-Box replacement unit 320 again. The 32-bit block, which has passed through the P-Box replacement unit 330, is exclusively logically combined with the 32-bit block (L (i-1)) stored in the left register, and R ( i). On the other hand, the 32-bit block R (i-1) stored in the right register is stored as L (i) in the left register of the next round.

4 is a detailed block diagram of the S-Box replacement unit 320 shown in FIG.

Referring to FIG. 4, the S-Box replacement unit 320 is composed of eight S-Boxes that receive an input of 48 bits and generate an output of 32 bits. That is, 48-bit data is divided into eight 6-bit data and input to eight S-Boxes. These eight S-Boxes reduce 48 bits to 32 bits by sending eight 4-bit outputs. The S-Box replacement unit 320 is replaced by a table look-up method and requires a storage device such as a program augmented logic array (PLA) or a ROM. Since 4 bits are output for 6-bit input, each S-Box needs 64 × 4 storage capacity and 8 × 64 × 4 storage devices because it consists of 8 S-Boxes as a whole. Therefore, the area occupied by the chip is relatively large.

In the conventional encryption apparatus described above, 16 bits are always clocked when DES encryption of plain text by swapping 32-bit data blocks stored in the right register and storing them in the left register when performing the product transformation in the transform unit 120. The cycle takes a problem.

The present invention has been made to solve the above problems of the prior art, to provide an encryption device that improves the throughput by reducing the area occupied by the chip at the time of integration, minimizing power consumption. There is this.

1 is a block diagram illustrating a prior art DES algorithm;

2 is a block diagram for explaining a key scheduler for generating a subkey;

3 is a block diagram of a typical DES core architecture,

4 is a detailed block diagram of the S-Box replacement unit 320 shown in FIG.

5 is a block diagram of an DES algorithm removing a swapping data path;

6 illustrates intermediate calculation results of the DES algorithm;

7 is a block diagram of an encryption apparatus according to an embodiment of the present invention;

8 is a timing diagram showing an operation procedure of the DES algorithm of the present invention;

9 is a timing diagram showing a pipeline operation procedure of the DES algorithm of the present invention;

10 is a block diagram of an encryption apparatus according to another embodiment of the present invention;

FIG. 11 is a timing diagram showing a pipeline operation sequence of the DES algorithm shown in FIG. 10; FIG.

Explanation of symbols on the main parts of the drawings

710: first left register 720: first right register

730: second left register 740: second right register

750 to 753: Cypher function f 760 to 763: Exclusive AND operation unit

In order to achieve the above object, the encryption apparatus of the present invention performs initial substitution of at least one N-bit (N is an even natural number) plaintext data block, thereby dividing the initially substituted data into at least one first and second ones. Initial substitution means for outputting initial substitution data; A transform unit for receiving the first and second initial substitution data and performing product transformation of i rounds (i is a natural number) of the first and second initial substitution data to output i round product transformed data; And an inverse initial replacement means for receiving the i-round multimodified data to perform inverse initial substitution, wherein the transformation unit includes at least one product transformation unit, wherein the product transformation unit includes the first initial substitution data. At least one left register for storing; At least one right register for storing the second initial substitution data; At least one first product transformation means for performing product transformation of the data stored in the right register and storing the result in the left register according to a first clock; And at least one second product transformation means for performing product transformation of the data stored in the left register and storing the data in the right register according to a second clock which is an inversion signal of the first clock.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the technical idea of the present invention. do.

5 is a block diagram of an DES algorithm with a swapped data path removed.

Referring to FIG. 5, the DES algorithm implementing method of the present invention includes an initial substitution unit 500 which first performs replacement of a 64-bit plaintext block by initial substitution, and then a 64-bit output from the initial substitution unit 500. The data block is divided into two 32-bit blocks and stored in the left register (L ₀ ) and the right register (R ₀ ), and the 16th round product transformation performed by the cipher function f and the left register (L _i ) and the right register (R _i ) Is a transform unit 510 which performs block transformation for storing the next round in the left register (L _{i + 1} ) and the right register (R _{i + 1} ); IP ^-1 ) includes a reverse initial replacement unit 520 for outputting an encrypted cipher text.

The product transformation in the transformation unit 510 is performed by encrypting the data stored in the right register R _i among the 32-bit blocks divided by the initial replacement unit 500 together with the auxiliary key K _i generated by the key scheduler. the cipher function part (f) (511) for performing, consists results of cipher function f as the exclusive-OR operation unit 512 to the exclusive-OR with the left register (L _i).

Removing the data path exchanged in the block diagram of the existing DES algorithm is shown in FIG. In other words, if you change the position of the left register (L _i ) and the right register (R _i ) in odd-numbered rounds and change the direction of the corresponding data path (the direction of the cipher function f and the exclusive OR operation), the data paths that cross each other Disappear. Referring to the values of the left register (L _i ) (i = 1, 2... 16) in FIG. 5, it can be seen that the value is the same as the value of the right register (R _i-1 ) of the previous round.

6 is a diagram illustrating intermediate calculation results of the DES algorithm.

Referring to FIG. 6, the calculated values starting from the initial values L ₀ and R ₀ of the left and right registers are passed through the cipher function f 511 and the exclusive OR operation unit 512. DES value is calculated as shown are L _1, L ₂ .... L ₁₆ and R _1, R ₂ .... R ₁₆ inde L _i = R _i-1 Since the DES from a given L ₀ and R ₀ The core values newly calculated by Core are R ₁ , R ₂ .... R ₁₆ . The final result is output of R ₁₅ and R ₁₆ as L ₁₆ and R ₁₆ .

Substituting Equation 1 into Equation 2 and assuming that R _i-1 = L _i , the calculation process of the DES core can be represented by Equation 3 below.

f (Ri-1, Ki) i = 1,2 .... 16, Ri-1 = Li

Figure 7 is a block diagram implementing four rounds of the DES algorithm of the present invention.

Referring to FIG. 7, the DES algorithm of the present invention uses a first block (CLK1) for a ₀ block, which is one of 64-bit plaintext blocks that have undergone initial substitution, divided into two 32-bit blocks. After storing in the left register (A0) 710 and storing the other b _o blocks in the first right register (B0) 720 using the second clock (CLK2), the auxiliary key generated from the key scheduler ( K _(i) ) is input to encrypt the 32-bit data from the first right register B0 720 by the cipher function f 750, and remove the 32-bit data modified by the cipher function f. An exclusive OR operation is performed by the 32 bits of the left register A0 710 and the exclusive OR operation unit 760. In addition, the 32-bit data of the exclusive OR operation unit 760 is stored in the second left register A1 730 using the first clock CLK1, and the auxiliary key K _{(i + 1)} is received. The 32-bit data stored in the second left register (A1) 730 is transformed through the cipher function f (751), and the modified 32-bit data is converted into 32 of the first right register (B0) 720. An exclusive OR operation is performed by the bit and exclusive OR operation unit 761. These two rounds are repeated to form four rounds, and 32 bits of the first left register (A0) 710 of the last round become the block b ₁₅ of the 32 bits and the exclusive OR operation unit 763 of the last round. the output is a 32-bit block ₁₆ b of the 32 bits.

The second clock CLK2 is an inversion of the first clock CLK1 and may be regarded as being delayed by half of the period of the first clock CLK1. When the first clock CLK1 rises, new values are stored in the left registers A0 and A1, and when the first clock CLK1 descends, new values are stored in the right registers B0 and B1.

8 is a timing diagram showing the operation procedure of the DES algorithm according to the present invention.

Referring to FIG. 8, the 32-bit blocks a ₀ and b ₀ are divided into two 32-bit blocks of 64-bit plaintext blocks that have undergone initial substitution, and the 32-bit blocks a ₀ have a left register (L ₀ ). 32-bit block b ₀ becomes the right register (R ₀ ). The value that the DES core calculates is b ₁ , b ₂ .... b ₁₆ (b _i = R _i ) and the controller schedules the key scheduler to input the modifier key K _i periodically into the cipher function f. The process of calculating the value of the block b _i is as follows.

First, the values a ₀ and b ₀ at t ₀ and t ₁ are stored in the registers A0 and B0 by the first clock CLK1 and the second clock CLK2, respectively. From t _{1 1} b value (b ₁ = a ₀ Start computing f (b ₀ , K ₁ )) and store the value calculated at t ₂ in register A1. At this time, if the value a ₀ input to register A0 is maintained only to t ₂ , it can be used to calculate the value of b _{1 in the} interval t ₁ -t ₂ . This can be solved because the registers A1 and B0 store the new value by the first clock CLK1 and the second clock CLK2 which are inverted from each other. That is, the time for register A1 to store new data is t ₀ , t ₂ , t ₄ .... and the time for new data to be input to register B0 is t ₁ , t ₃ , t ₅ .... Similarly calculated using the second clock (CLK2) to the register B1 from t ₃ because the values b ₀ and t ₂ is stored in register B0 at t ₁ is maintained at a value b ₁ yi t ₂ -t ₃ period stored in the register A1 B ₂ values (b ₂ = b ₀ f (b ₁ , K ₂ ) can be stored. In this manner, when the first clock CLK1 rises, the values b ₃ , b ₇ , b ₁₁ , and b ₁₅ calculated at t ₄ , t ₈ , t ₁₂ , and t ₁₆ are stored in the register A0 and t ₆ , At t ₁₀ and t ₁₄ , the new values of b ₅ , b ₉ and b ₁₃ are stored in register A1. In addition, when the second clock CLK2 rises, values of b ₄ , b ₈ , b ₁₂ , and b ₁₆ are stored in t ₅ , t ₉ , t ₁₃ , and t ₁₇ in register B0, and b ₆ and b in register B1. The values ₁₀ and b ₁₄ are stored at t ₇ , t ₁₁ and t ₁₅ .

In general, the DES core takes 16 clock cycles because it repeats 16 rounds of operations. However, in the present invention, since two clocks are used to store the registers, a ₀ is stored at t ₀ and b ₁₆ is calculated and output. It will take 8.5 clock cycles.

The cipher function f requires substitution (S-Box) implemented with a storage device such as a ROM or a program augmented logic array (PLA). As shown in FIG. 8, the cipher function f used in the present invention, when encrypting one plaintext, has an access (T) once in the interval t ₁ -t ₂ , t ₂ -t ₃ , t ₃ -t ₄ . If possible. Therefore, it is possible to implement only one by one without having to implement a plurality of eight S-Boxes that occupy a large area. Only the wiring for implementing extended substitution and P-Box substitution, and the exclusive OR operation gates for exclusive OR with each additional key generated for each round are needed. In addition, the present invention minimizes the area increase by not using the left register required to store the 32-bit left variable L _i .

In general, there is more than one input data to be encrypted or decrypted for a given key. For example, the encryption method used in the MCNS cable modem performs encryption in units of MAC frames, so up to 1,518 bytes of plaintext blocks must be encrypted with the same key. That is, the same key scheduler must perform 16 rounds of DES core functions for multiple plaintext blocks. In this case, the processing capacity ratio can be increased by using the pipeline structure of the present invention.

9 is a timing diagram showing a pipeline operation sequence of the DES algorithm of the present invention.

Referring to FIG. 9, a timing diagram illustrating the pipeline operation of the present invention shows that two plaintext blocks can be processed simultaneously for 8.5 clock cycles using the pipeline structure. 8 shows that the plaintext block d _i values can be calculated while calculating the plaintext block b _i values by inputting the new plaintext blocks c ₀ and d ₀ into the registers A0 and B0 at t ₂ and t ₃ in the empty part. . At this time, t ₀ -t ₁ , t ₁ -t ₂ , t ₂ -t ₃ .... Two cipher functions f are executed simultaneously to encrypt the new plaintext blocks b _i and d _{i for} each interval. Therefore, the S-Box constituting the cipher function needs to be implemented one by one. And the number of plaintext blocks that can be processed in a given 8.5 clock cycle can be doubled.

10 is a block diagram of an encryption apparatus according to another embodiment of the present invention.

Referring to FIG. 10, the number of pipeline stages was increased from 4 to 8 by connecting two four-stage pipeline structures consisting of four rounds in series. This structure takes 8.5 clock cycles to process one plaintext block, but the number of plaintext blocks that can be processed simultaneously increases from two to four, thereby doubling the processing capacity ratio.

FIG. 11 is a timing diagram illustrating a pipeline operation sequence of the DES algorithm illustrated in FIG. 10.

Referring to FIG. 11, it can be seen that the plaintext blocks (a _0, b ₀ ), (C ₀ , d ₀ ), (e ₀ , f ₀ ), and (g ₀ , h ₀ ) can be simultaneously calculated. In this case, the number of S-Boxes required is four, and the area can be reduced by implementing four-port S-Box replacement parts. As another embodiment of the present invention, the number of pipeline stages can be increased by 16 by connecting 8 encryption apparatuses shown in FIG. 7 in series. Can be increased. Again, the processing time for one plaintext block is 8.5 clock cycles and can be reduced by implementing 8-port S-Box replacement. When the pipeline structure is not used in the present invention, only two registers A0 and B0 in FIG. 7 need to be used. In this case, it takes 8.5 clock cycles to process one plaintext block.

Although the technical spirit of the present invention has been described in detail according to the above-described preferred embodiment, it should be noted that the above-described embodiment is for the purpose of description and not of limitation. In addition, those skilled in the art will understand that various embodiments are possible within the scope of the technical idea of the present invention.

As described above, the present invention eliminates a data path that is intersected with the present invention. By not storing intermediate variables in duplicate, the present invention can reduce the area by minimizing the number of registers required and by using two inverted clocks, the DES core The power consumption can be minimized by reducing the time it takes to calculate from 16 clock cycles to 8.5 clock cycles. In addition, it is possible to increase processing capacity by increasing the number of plaintext blocks that can be processed at one time using a pipeline structure.

Claims (8)

Initial substitution means for performing initial substitution of at least one N-bit (N is an even natural number) plaintext data block to bisect the initially substituted data to output at least one first and second initial substitution data; A transform unit for receiving the first and second initial substitution data and performing product transformation of i rounds (i is a natural number) of the first and second initial substitution data to output i round product transformed data; And Reverse initial substitution means for performing reverse initial substitution by receiving the i-round multiplying data. Including, The deformation part includes at least one product deformation part, wherein the product deformation part, At least one left register for storing the first initial substitution data; At least one right register for storing the second initial substitution data; At least one first product transformation means for performing product transformation of the data stored in the right register and storing the result in the left register according to a first clock; And At least one second product transformation means for performing product transformation of data stored in the left register and storing the result in the right register according to a second clock which is an inversion signal of the first clock Encryption device comprising a. The method of claim 1, The deformation portion, Demultiplexing means for outputting one of the first initial substitution data and the product transformation data output from the first product transformation means to the left register; And Demultiplexing means for outputting one of the second initial substitution data and the product transformation data output from the second product transformation means to the left register Encryption device further comprising. The method of claim 2, The first product transformation means, A first encryption operation unit configured to perform an encryption operation on data stored in the right register using a first auxiliary key; And A first exclusive OR operation unit configured to perform an exclusive OR operation on data output from the first encryption operation unit and data stored in the left register and output the result to the left register; Including, The second product transformation means, A second encryption operation unit for performing an encryption operation on data stored in the left register using a second auxiliary key; And A second exclusive OR operation unit configured to perform an exclusive OR operation on the data output from the second encryption operation unit and the data stored in the right register and output the result to the right register; Encryption device comprising a. The method of claim 3, And the transformation part comprises two product transformation parts. The method of claim 3, And the transformation unit comprises four product transformation units. The method of claim 3, And the transformation part comprises i / 2 product transformation parts. delete The method of claim 6, The product transformation result is, Ri = Ri-2 f (Ri-1, Ki), Wherein Ri is i round multiply transformed data stored in the right register, i = 1,2, ..., 16, R-1 = L0 means an exclusive OR operation.