KR101276683B1 - Method and apparatus for processing f-function in seed encryption system - Google Patents

Abstract

Masking technique is a representative technique that prevents side channel analysis attack at the algorithm level. The random data is added to the original data to be encrypted or XOR (eXclusive OR) operation is performed to collect the collected power waveform or This method makes it difficult to extract secret information through statistical analysis of electromagnetic wave data. In addition, the SEED algorithm is a domestic standard symmetric key encryption algorithm, and is widely used in IC cards and electronic commerce. In the present invention, a masking technique is applied to the F-function of the SEED algorithm to prepare the F-function of the SEED algorithm that is safe from primary power / electromagnetic subchannel analysis attacks.

Subchannel, Masking, SEED, F-Function

Description

F-function processing apparatus and method of SEED encryption system {METHOD AND APPARATUS FOR PROCESSING F-FUNCTION IN SEED ENCRYPTION SYSTEM}

The present invention relates to SEED encryption technology, which is one of symmetric key encryption techniques, and more particularly, to an apparatus and method for processing F-functions of a SEED encryption system suitable for preventing a primary power / electromagnetic subchannel analysis attack.

The present invention is derived from a study conducted as part of the IT growth engine technology development project of the Ministry of Knowledge Economy [2009-F-055-01, the development of source channel prevention technology and safety verification technology].

Side-channel attacks are one of the strongest attacking techniques against encryption algorithms, and these side-channel attacks are becoming a huge threat to security products. In particular, the power / electromagnetic subchannel analysis is an attack method that analyzes secret information (mainly key information) of the encryption algorithm through statistical analysis by collecting power consumption or generated electromagnetic waves when driving the encryption algorithm.

In order to prevent such power / electromagnetic subchannel analysis attacks, various prevention techniques have been proposed. Among them, masking techniques are representative methods for preventing subchannel analysis attacks at the algorithm level. Masking technique extracts secret information through statistical analysis of collected power waveform or electromagnetic wave data by adding random data to the original data to be encrypted or by performing logical operation, for example, eXclusive OR (XOR) operation. It is a way to make it difficult.

However, when constructing a masking F-function in such a conventional masking technique, a procedure for converting an arithmetic masking value, for example, 2 ³² modular addition masking value, into a logical arithmetic masking value, for example, an XOR masking value, may be used. The problem is that you have to use it once.

In the present invention, the F-function of the SEED algorithm, which is used in IC cards or electronic commerce, is a domestic standard symmetric key cryptographic algorithm. SEED encryption system that allows you to design masking F-functions so that you do not have to use a procedure that converts arithmetic masking values, such as 2 ³² modular addition masking values, to logical operation masking values, such as XOR masking values, inside a masking F-function. We want to come up with an F-function processing technique.

According to the F-function processing apparatus of the SEED encryption system for solving the problems of the present invention, an arithmetic masking transformation for converting a logical operation masking value obtained by performing a logical operation on the SEED F-function input value and the random masking value into an arithmetic masking value. And a masking G-function unit configured to provide an arithmetic output by inputting an arithmetic masking value of the arithmetic masking converter.

Here, the SSED F-function input value may be 32-bit data.

The random masking value may be a 32-bit random masking value using 8-bit random data.

In addition, the logical masking value may be a Boolean masking value.

In addition, the boolean masking value may be an eXclusive OR (XOR) masking value.

The arithmetic masking value may be 2 ³² modular addition masking values.

In addition, the masking G-function unit may assign an XOR masking output value as an input of a 2 ⁸ modular addition masking value.

In addition, the masking G-function unit may convert 32-bit arithmetic masking into 8-bit arithmetic masking.

The masking G-function unit may generate a masked S-box table for outputting a second logical masking value by inputting the arithmetic masking value.

According to the F-function processing method of the SEED encryption system for solving the problem of the present invention, the process of converting the logical operation masking value of the logical operation of the SEED F-function input value and the random masking value to an arithmetic masking value, and the conversion The method may include a process of providing an arithmetic output by inputting the arithmetic masking value to be input, and generating a total masking F-function through the converting and assigning.

Here, the SSED F-function input value may be 32-bit data.

The random masking value may be a 32-bit random masking value using 8-bit random data.

In addition, the logical masking value may be a Boolean masking value.

In addition, the boolean masking value may be an eXclusive OR (XOR) masking value.

The arithmetic masking value may be 2 ³² modular addition masking values.

In addition, the masking G-function unit may assign an XOR masking output value as an input of a 2 ⁸ modular addition masking value.

The method may further include generating the masked S-box table capable of giving the XOR masking output value by inputting the 2 ⁸ modular addition masking value, and converting the 2 ³² modular addition masked value to the 2 ⁸ modular addition masking value. The method may further include converting to an additive masking value.

In addition, the masked S-box table may output a second logical operation masking value by inputting the arithmetic operation masking value.

The method may further include converting 32-bit arithmetic masking to 8-bit arithmetic masking.

According to the F-function processing method of the SEED encryption system for solving the problems of the present invention, the process of selecting a random masking value, and the process of generating a masking S-box table to give a logical operation masking output as an arithmetic masking input Converting 32-bit arithmetic masking to 8-bit arithmetic masking; and generating a masking G-function that gives an arithmetic output to the arithmetic input using the generating and converting operations. And generating a full masking F-function.

According to the present invention, by providing a masking F-function design technology of SEED that can prevent the primary power / electromagnetic side channel analysis attack on SEED, a national standard symmetric key algorithm, the arithmetic masking value inside the masking F-function For example, a masking F-function can be designed so as not to use a procedure of converting a 2 ³² modular addition masking value to a logic masking value, for example, an XOR masking value, to improve implementation efficiency.

In the SEED F-function, as shown in Fig. 1, binary operations, non-linear S-box operations, and 2 ^32- bit modular addition operations (arithmetic) are used. The same three additional algorithms are needed.

(1) MS-box: Masking S-box table with logic operation masking input, for example, XOR masking input as XOR masking output

(2) B2A: Algorithm for converting a logical masking value, such as an XOR Boolean masking value, to an arithmetic masking value, for example, 2 ³² modular addition masking value.

(3) A2B: Algorithm for converting arithmetic masking values, such as 2 ³² modular addition masking values, to logical arithmetic masking values, such as XOR masking values

In the present invention, using 2 ⁸ modular addition masking input and a new masking S-box table, which is an XOR masking output, using only an algorithm (B2A) for converting XOR masking to 2 ³² modular addition masking, and using 2 ³² modular addition masking. The algorithm for converting to XOR masking (A2B) is designed so that it is not necessary inside the masking F-function, that is, designed to use only an arithmetic masking conversion algorithm to increase the efficiency of the masking F-function.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. To fully disclose the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like numbers refer to like elements throughout.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions in the embodiments of the present invention, which may vary depending on the intention of the user, the intention or the custom of the operator. Therefore, the definition should be based on the contents throughout this specification.

Each block of the accompanying block diagrams and combinations of steps of the flowchart may be performed by computer program instructions. These computer program instructions may be mounted on a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment such that instructions executed through the processor of the computer or other programmable data processing equipment may not be included in each block or flowchart of the block diagram. It will create means for performing the functions described in each step. These computer program instructions may be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer readable memory. It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the functions described in each block or flowchart of each step of the block diagram. Computer program instructions may also be mounted on a computer or other programmable data processing equipment, such that a series of operating steps may be performed on the computer or other programmable data processing equipment to create a computer-implemented process to create a computer or other programmable data. Instructions that perform processing equipment may also provide steps for performing the functions described in each block of the block diagram and in each step of the flowchart.

Also, each block or each step may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative embodiments, the functions mentioned in the blocks or steps may occur out of order. For example, the two blocks or steps shown in succession may in fact be executed substantially concurrently or the blocks or steps may sometimes be performed in the reverse order, depending on the functionality involved.

Hereinafter, with reference to the accompanying drawings will be described in detail an embodiment of the present invention.

Figure 2 illustrates a design structure of a masking F-function for explaining the F-function processing apparatus and method of the SEED encryption system according to an embodiment of the present invention.

As illustrated in FIG. 2, the F-function processing apparatus of the SEED encryption system according to the present embodiment includes a logical operator 10, 12, 14, 16, 18, and arithmetic operator 20, 22. Arithmetic masking transform (B2A) 400, 402, masking G-function (MG) 500, 502, 504, arithmetic (MA) 600, 602, 604 can do.

In addition, in FIG. 2, R ₀ (100) and R ₁ (101) are 32-bit random masking data. Such 32-bit random masking data is represented by the following [Equation 1 using r0, r, which are 8-bit random data. ] Can be configured as follows.

Here, "|" means parallel connection of data.

C 200 and D 200 are SEED F-function input values, C '200' and D '202' are SEED F-function output values, respectively. It may consist of bit data.

K ₀ 300 and K ₁ 302 mean the left and right round keys of the SEED F-function, respectively.

As illustrated in FIG. 2, the logical operators 10, 12, 14, 16, and 18 may be applied with, for example, an XOR (eXclusive OR) operator, and the arithmetic operators 20, 22 may be, for example, 2. ³² Modular addition operators could be applied.

The arithmetic masking converter 400 or 402 converts a logical masking value, for example, an XOR masking value, into an arithmetic masking value, for example, 2 ³² modular addition masking values. As a means, for example, the arithmetic masking converter 400 may convert a logical operation value input through the logical operator 12 into an arithmetic masking value.

Such arithmetic masking converter 400 and 402 will be readily appreciated by those skilled in the art that various conventional transformation techniques may be applied.

Masking G-function (MG) 500, 502, 504 is a masking value capable of outputting an arithmetic masking value, for example, a 2 ⁸ modular addition masking value, and outputting a logical operation masking value, for example, an XOR masking value. It generates a table of S-boxes, and outputs a masking G-function that gives arithmetic output as an arithmetic input.

The masking S-box table generation technique at this time is as illustrated in FIG. 3.

As illustrated in FIG. 3, a feature of the masking S-box generation technique is that, unlike a conventional masking S-box having an XOR masking input and an XOR masking output, the XOR masking output value is inputted with 2 ⁸ modular addition masking values. You can create a masked S-box table that can give you

Figure 4 describes the masking G-function (MG), the input of the masking G-function is 2 ³² modular addition masking X ', R, X' = XR mod 2 ³² , the output of the masking G-function is Z '= ZR ₀ , Z = G (X) (where G (X) can mean the output value of the original SEED G-function).

In FIG. 4, C _{32 , 8} (X ′, r) may refer to an algorithm for converting a 2 ³² modular addition masked value to a 2 ⁸ addition masked value of each byte unit.

The C _{32 , 8} (X ', r) function of FIG. 4 may be configured as shown in FIG. 5, and the C _{32 , 8} (X', r) function adds 2 ³² modular addition masking inputs to each byte unit. This algorithm converts masking values.

G- masking function in Figure 4 and then following the same procedure as in SEED G- function using the second masking ³² S- box of Figure 3 from the modular addition masking the input value, an arithmetic operation ⁽²³² modular addition) masking transform It outputs with arithmetic masked value, that is, 2 ³² modular addition masked values using negative (B2A), and has a different structure from the input and output of a general masking G-function that is an XOR masked value. After the G-function, no additional conversion technique is required for input of the arithmetic (2 ³² modular addition) operation unit (MA) 600, that is, 2 ³² modular addition masking to XOR masking to increase the computational efficiency. have.

Meanwhile, in FIG. 2, the arithmetic operators (MA) 600, 6002 and 604 may be applied to, for example, 2 ³² modular adders. Such arithmetic operations (MA) 600, 6002 and 604, in particular, arithmetic operators As illustrated in FIG. 6, the (MA) 600 may perform a 2 ³² modular add operation on the masked input.

In Figure 6, an arithmetic operation unit (MA) (600) 2 ³² modular addition two input masked ^{_{X '= XR 0 mod 2 32}} , Y' 2 32 modular addition mask = YR ₀ mod ^232, to the R to R ₀ You can print out the set value (X + Y) -R mod 2 ³² respectively.

Finally, reference numeral 1000, which describes addition masking removal, describes a procedure for removing an additive masked value because it describes only a masking F-function design method for one round.

As described above, according to the present embodiment, by providing a masking F-function design technique of SEED that can prevent the primary power / electromagnetic side channel analysis attack on SEED, a national standard symmetric key algorithm, Implementation efficiency can be improved by designing a masking F-function so that the procedure of converting an arithmetic masking value, for example, 2 ³² modular addition masking value, into a logical masking value, such as an XOR masking value, is not used at all.

1 is an exemplary diagram of a SEED F-function,

2 is an exemplary diagram illustrating an F-function processing technique of the SEED encryption system according to the present embodiment;

3 is an exemplary diagram illustrating creation of a masking S-box according to the present embodiment;

4 is an exemplary diagram illustrating a masking G-function according to the present embodiment;

5 is an exemplary diagram illustrating the C _{32 , 8} (X ′, r) technique of FIG. 4.

6 is an exemplary diagram for explaining a masking addition algorithm according to the present embodiment.

Claims (20)

An arithmetic masking converter for converting a logical operation masking value obtained by logically calculating a SEED F-function input value and a random masking value into an arithmetic masking value; A masking G-function unit configured to provide an arithmetic output by inputting an arithmetic masking value of the arithmetic masking converter; F-Function Processing Unit for SEED Encryption System. The method of claim 1, The SEED F-function input value is 32-bit data F-Function Processing Unit for SEED Encryption System. The method of claim 1, The random masking value is a 32-bit random masking value using 8-bit random data. F-Function Processing Unit for SEED Encryption System. The method of claim 1, The logical masking value is a Boolean masking value. F-Function Processing Unit for SEED Encryption System. 5. The method of claim 4, The boolean masking value is an eXclusive OR (XOR) masking value. F-Function Processing Unit for SEED Encryption System. The method of claim 1, The arithmetic masking value is 2 ³² modular addition masking value F-Function Processing Unit for SEED Encryption System. The method of claim 1, The masking G-function unit provides an XOR masking output value with an input of 2 ⁸ modular addition masking values. F-Function Processing Unit for SEED Encryption System. The method of claim 1, The masking G-function unit converts 32-bit arithmetic masking into 8-bit arithmetic masking. F-Function Processing Unit for SEED Encryption System. The method of claim 1, The masking G-function unit generates a masked S-box table for outputting a second logical operation masking value by inputting the arithmetic operation masking value. F-Function Processing Unit for SEED Encryption System. Converting a logical operation masking value obtained by logically calculating a SEED F-function input value and a random masking value to an arithmetic masking value, Providing an arithmetic output by inputting the converted arithmetic masking value; Generating the entire masking F-function through the converting and assigning F-function processing method of SEED encryption system. 11. The method of claim 10, The SEED F-function input value is 32-bit data F-function processing method of SEED encryption system. 11. The method of claim 10, The random masking value is a 32-bit random masking value using 8-bit random data. F-function processing method of SEED encryption system. 11. The method of claim 10, The logical masking value is a Boolean masking value. F-function processing method of SEED encryption system. The method of claim 13, The boolean masking value is an eXclusive OR (XOR) masking value. F-function processing method of SEED encryption system. 11. The method of claim 10, The arithmetic masking value is 2 ³² modular addition masking value F-function processing method of SEED encryption system. 11. The method of claim 10, The step of assigning the arithmetic output includes the step of assigning an XOR masking output value as an input to the 2 ⁸ modular addition masking value. F-function processing method of SEED encryption system. 17. The method of claim 16, The method comprises: Generating a masked S-box table capable of giving the XOR masking output value by inputting the 2 ⁸ modular addition masking value; And converting from 2 ³² modular add masked values to the 2 ⁸ modular add masking values. F-function processing method of SEED encryption system. The method of claim 17, The masked S-box table, Outputting a second logical masking value by inputting the arithmetic masking value; F-function processing method of SEED encryption system. 11. The method of claim 10, The method comprises: Further comprising converting 32-bit arithmetic masking to 8-bit arithmetic masking. F-function processing method of SEED encryption system. Selecting a random masking value, Generating a masking S-box table to which arithmetic masking output is given as an arithmetic masking input; Converting 32-bit arithmetic masking to 8-bit arithmetic masking, Generating a masking G-function giving an arithmetic output as an arithmetic input using the generating and converting process; Which involves generating a full masking F-function F-function processing method of SEED encryption system.

Images