KR20050019086A - Advanced encryption standard(aes) hardware cryptographic engine - Google Patents

Abstract

The present invention provides an encryption method and related tools in the Rijndael-AES encryption standard. In one embodiment, the decryption round key w [i] is generated one round from the last Nk round key stored from the previous encryption key scheduling operation. This reduces latency and memory requirements. AES key generation and cipher operation itself S- boxes for (41 _{3 0-41)} may be carried out plural times at different path with different power signatures, decision path to a different byte-random selection (39 _{0-39 3} , 41 _{0 to} 4 1 ₃ ) will be replaced. The premix operation 73 occurs concurrently with the generation of the first round key (72, 83), and the dummy circuit (FIG. 13) having substantially the same timing as the actual premix circuit adds power consumption noise to the premix. .

Description

ADVANCED ENCRYPTION STANDARD (AES) HARDWARE CRYPTOGRAPHIC ENGINE}

The present invention relates to a cryptographic method and apparatus, and more particularly to a special symmetric key block cipher algorithm and associated hardware or software implementation known as Rijndael or AES (Advanced Encryption Standard). It relates to the round key generation of the algorithm in both the encryption and decryption directions, and also to block differential power analysis attacks against the implementation hardware or software that attempts to find the cipher key. It's about technology.

The National Institute of Standards and Technology (NIST) of the US Department of Commerce is Rijndael symmetric key block of the Advanced Encryption Standard (AES) as defined in the Federal Information Processing Standards Publication 197 (FIPS 197) of November 26, 2001. A subset of cipher algorithms was adopted. The AES algorithm encrypts and decrypts data in 128-bit blocks using 128, 192, and 256 bit encryption keys. The Rijndael algorithm can also handle 192 and 256 bit blocks, supporting any intermediate or potentially larger key lengths and block sizes using operations defined between any of those key lengths and block sizes. .

The algorithm repeats a number of nearly identical rounds depending on the key length and block size. To complete the encryption or decryption operation, AES128 uses 10 rounds, AES192 uses 12 rounds, and AES256 uses 14 rounds. More generally, for the key length Nk of the 32-bit word and the block size Nb of the 32-bit word, the number of rounds Nr of the Rijndael algorithm is currently designated Nr = max (Nk, Nb) + 6.

The invention disclosed herein is applicable to any of Rijndael key lengths and block sizes, including the 128-bit block size designated for AES, and can also be applied to any mode of operation. It will be appreciated that the remainder of this patent specification will refer to preferred AES embodiments, and that extensions to any other Rijndael block size are also implied.

NIST Special Publication 800-38A (December 2001) entitled "Recommendation for Block Cipher Modes of Operation: Methods and Techniques" by Morris Dworkin for NIST for use with arbitrary subsymmetric key block cipher algorithms such as AES. Five confidentiality modes of operations approved by are specified. Another possible mode of operation is also waiting for NIST approval. The invention disclosed herein is applicable to any of the modes of operation.

In AES, three major steps during each round: (a) the text block is modified, (b) the round key is generated, and (c) the modified text block and the round key are the starting text block for the next round. Steps are added together using XOR operation to provide. With two exceptions, the text block is modified in the same way at each round (S-box substitution, row shifting, column mixing). The first exception is the initial round key, where the plaintext message block is filled with the first Nb word from the cipher key itself, and a pre key mix operation (round 0), bit by bit XORed. If Nb = 4 for AES, this free key mix operation provides the start text for round one. The second exception is raised in the final round, where the column mixing operation is omitted. S-box substitution, low shifting, and column mixing operations for rounds are described in the aforementioned FIPS 197 document.

The set of round keys (key schedule) is generated from the initial cipher using a key expansion routine. In AES, the length of the round key is always the same as the block size (128 bits = 4 words) regardless of the length of the original cipher key (128, 192 or 256 bits). The words of the cipher keys are used in the preceding round as long as they last, and each successive round key word becomes a function of the preceding round key word. The calculation of the round key by the key expansion routine is somewhat different for each cipher key length, in that the same basic steps (S-box replacement, byte rotation, and XOR with round constants) are in each case While in use, these basic steps occur at different frequencies for different key lengths.

In the simple manner of decryption, individual cryptographic conversions can be reversed and performed in the reverse order of encryption. The form of key schedules for encryption and decryption operations remain the same, but apply in reverse order. Therefore, the first round key for decryption is the same as the last round key of encryption, the second decryption round key is the same as the second round key at the end of encryption, and the remaining round keys have the same aspect.

One common approach to key scheduling is to pre-compute all of the round keys required for the communication session and store them as a key table in memory so that they can be retrieved when required for each round. This approach has a large initial latency period while the set of round keys is being calculated, but with a faster subsequent execution of the crypto round. Moreover, the decryption round in this case is as fast as the encryption round. However, this approach assumes that there is sufficient memory capacity available to store the entire key schedule and that the initial latency period is acceptable.

Another approach used in some hardware systems involves "on-the-fly" key scheduling, where round keys are generated one by one when needed. Since this approach does not preprocess the entire key schedule, the initial latency period is prevented at least in cryptographic forward (encryption), and the memory requirements for the round key are substantially reduced. This is particularly useful for devices that need to perform encryption and have memory and processing restrictions. However, in crypto reverse (decryption), the round key is required in reverse. That is, the first round key for decryption is the same as the last round key of encryption. Moreover, the round key becomes a function of the previous round key. Because the "on-the-fly" key generator must recalculate all preceding round keys for each round until the round key for the current decryption round is reached, the existing "on-the-" The key expansion method of the fly "method has a large latency in the decryption direction, especially in the front decryption round. If possible, improved key generation routines for backwards are required to reduce this latency.

When ciphers such as AES are employed in actual applications, these ciphers must first be implemented as hardware or software. The attacker will try to find some weaknesses in the implementation, rather than trying to figure out the mathematical weaknesses of the cipher itself. This will be done through external monitoring of the cryptographic system during operation of the cryptographic system to obtain leaked information about internal operations useful for determining the cipher key. Examples of instrumental attacks in crypto systems are timing and power analysis attacks that look for any key-dependent variation in execution time or power consumption patterns. Known countermeasures against various tool attacks generally include intervening resistor chip packaging, physical shielding to block signal emission, filtering of inputs and outputs, computer processing techniques to equalize or randomize the timing of operations, Methods of making an instruction sequence independent of a cipher key or from one execution to the next, and adding hardware noise to the power consumption pattern. For example, US Pat. No. 6,327,661 to Kocher et al. Discloses a countermeasure that incorporates unpredictable (random or pseudo-random) information into cryptographic processing. However, keep in mind that not all of these possible defenses are applicable to every situation. For example, the processing and memory constraints of smart cards with embedded cryptographic engines limit which of the many available countermeasures can be used. Additional tool countermeasures are desired for smart cards and other processor or memory constrained applications, especially during the most vulnerable periods when plaintext is processed first.

Encryption and decryption are essentially time-consuming operations. Many conversions and replacements of data bits, bytes, and words required to convert a plaintext block into ciphertext, and vice versa, require time for processing. As the block size and the number of rounds increase, the problem tends to get worse if the processing power of the hardware does not increase correspondingly. If you want to stay secure, any time savings available in any tool will be beneficial.

An object of the present invention is to provide an on-the-fly scheduling method and related hardware or software capable of efficiently generating AES / Rijndael round keys in the reverse direction (decoding direction).

Another object of the present invention is to provide a hardware implementation of AES / Rijndael ciphers that provides countermeasures against power analysis attacks during the initial phase of encryption, in particular during the pre-key-mix phase of the cipher (round 0).

Another object of the present invention is to provide an AES / Rijndael implementation that reduces the total number of clock cycles required to process the cipher.

1 is a diagram showing a table of S-box replacement values for an input byte XY specified for an AES / Rijndael encrypted cipher.

2 is a diagram illustrating a table of XOR operation results for hexadecimal operator pairs.

FIG. 3 is a table showing an example of a prior art key extension taken from FIPS-197 for a 128-bit cipher key in the encryption direction.

4 is a table showing an example of key expansion implemented by the present invention for the same 128-bit cipher key as in FIG. 3 in the reverse direction (decryption direction).

FIG. 5 is a diagram illustrating a table showing an example of a key extension of the prior art taken from FIPS-197 for a 192-bit cipher key in the encryption direction.

FIG. 6 is a table showing an example of key expansion implemented by the present invention for the same 192-bit cipher key as in FIG. 5 in the reverse direction (decryption direction).

FIG. 7 is a diagram illustrating a table showing an example of a prior art key extension taken from FIPS-197 for a 256-bit cipher key in the encryption direction.

8 is a table showing an example of key expansion implemented by the present invention for the same 256-bit cipher key as in FIG. 7 in the reverse direction (decryption direction).

9A and 9B are schematic block diagrams illustrating key generator hardware for the present invention.

FIG. 10 is a block diagram schematically illustrating round key conversion hardware for the key generator of FIGS. 9A and 9B.

11 illustrates another embodiment of S-box hardware for a round key translation sequence, wherein the same S-box function is implemented with four distinct passages with different power consumption patterns, and through four S-boxes. It is a figure which shows that a variable path is controlled by the random number generator (LFSR).

FIG. 12 is a diagram illustrating a lookup table for use in the controller of the embodiment of FIG. 11 to convert any of 256 random numbers to 24 path permutation selections.

FIG. 13 is a schematic diagram illustrating a dummy circuit for introducing random power consumption noise during an AES premix (round 0) operation as a countermeasure in a hardware implementation of the present invention.

14 is a schematic block diagram of data and cipher key input paths illustrating the operation of premix operations consistent with on-the-fly key scheduling for the first round.

FIG. 15 is a flow chart for the simultaneous premix / key scheduling operation performed with FIG. 14.

The above objective is to allow the key generator to generate the AES round-keyword w [i] in a "on-the-fly" fashion in the reverse direction as required for use in the decryption operation of the cipher algorithm. Are satisfied by The key generator is preferably implemented as hardware circuitry, but may also be implemented as software if desired. Reverse key generation is achieved by providing a memory for storing the final set of Nk round-key words obtained during key expansion of the cryptographic operation in the forward direction. When the key generator circuit is set up for the decryption operation, the key generator circuit generates the previous round-keyword w [i by XOR logic operation involving the stored round-keywords w [i] and w [i-1]. -Nk] is obtained in an "on-the-fly" fashion, where w [i-1] applies XOR logic operations whenever i mod Nk = 0 and also when Nk> 6 and i mod Nk = 4. First modified by the conversion sequence before doing so. The conversion sequence for w [i-1] is the same in the forward key expansion routine and in the reverse key expansion routine. The conversion sequence involves cyclic byte shifts, S-box byte substitutions, and XOR operations with round constants whenever i mod Nk = 0. The conversion sequence involves only S-box byte replacement when Nk> 6 and i mod Nk = 4.

The object of the present invention is also met by a pre-mix dummy circuit that inserts pseudo-random noise into the overall power signature of the hardware block cryptographic circuit during the initial pre-mix XOR operation of the block cipher algorithm. do. This differential power analysis countermeasure hides power signatures from all XOR gate switching because plaintext is mixed with the cipher key before the first round of cipher encryption. The pre-mix dummy circuit operates only during this initial pre-mix XOR operation and features an amount of propagation delay that substantially matches the amount of propagation delay of the pre-mix subcircuit. The dummy circuit includes a pseudo-random generator and an XOR array. The pseudo-random generator may be a set of linear feedback shift registers, for example. The XOR array has a first input connected to the output of the pseudo-random generator. The second input of the XOR array is connected to receive the same cipher key bits as the pre-mix subcircuit. The output of the XOR array is fed back to the pseudo-random generator. The pseudo-random generator and the XOR array of the dummy circuit may have a word width of bits that matches the bits of the pre-mix subcircuit.

The object of the present invention is also a hardware block cipher configured to perform a cipher algorithm with an initial pre-mix XOR operation that mixes plaintext with a cipher key to generate ciphertext before initiating a sequence of cipher encryption rounds. In the circuit, a pre-mix operation is combined with the first cipher encryption round, thereby satisfying the method by reducing the number of clock cycles required to process the cipher algorithm one by one. The method preprocesses the cipher key to generate a round-keyword for the first cipher encryption round while the plaintext is loading. Pre-mix XOR operations also occur when plaintext is loaded. The first cipher encryption round is performed using the first generated first round-keyword for the loaded pre-mixed plaintext.

The invention is preferably implemented as hardware circuitry, for example a cryptographic engine for a microcontroller or other system circuitry such as for a smart card. Such crypto engines may be on-demand semiconductors (ASICs) designed to perform AES operations, or may be more general purpose processing hardware programmed with firmware to perform AES operations. Cryptographic engines typically share memory with large system circuits. The encryption engine may also be implemented as software.

The AES / Rijndael algorithm generates a key schedule by performing a key expansion routine on the cipher key. The key extension produces a total of Nb (Nr + 1) words, where the block size Nb = 4 for AES is standard, but may be different for other Rijndael implementations, and the number of rounds Nr is currently [max (Nk , Nb) +6], where Nk is the cipher key size of a 32-bit (4-byte) word. Each round key consists of Nb words, and the resulting key schedule is a linear array of words denoted [w _i ] with i in the range 0 ≦ i ≦ Nb (Nr + 1). For encryption, round key words are required in the forward direction from i = 0 to Nb (Nr + 1). However, for decryption, the round key word is required in the reverse direction starting with i = Nb (Nr + 1).

The pseudo-code for forward key expansion is given in FIPS-197 as follows:

SubWord () is a function that takes a 4-byte input word and applies an S-box table (shown in FIG. 1) to each of the 4 bytes to generate an output word. The byte is represented by xy pairs of 4-bit hexadecimal values 0 through f. Each xy pair produces an output pair from the S-box table. For example, byte {53} would be replaced by replacement bike {ed}. The AES standard (FIPS-197) also specifies an inverse S-box for use with an inverse cipher. The advantage of key scheduling of the present invention is that the round key can be generated in the reverse direction using the same S-box as in the forward direction without the need for a reverse S-box.

The RotWord () function takes the word [a ₀ , a ₁ , a ₂ , a ₃ ] as input, performs cyclic permutation, and takes the word [a ₀ , a ₁ , a ₂ , a ₃ ] Returns.

The round constant word array Rcon [i] contains the values given by [x ^i-1 , {00}, {00}, {00}], where x = {02}, x ^i-1 is an unabbreviated eighth order Power of x in finite field GF (2 ⁸ ) with modular reduction by polynomial m (x) = x ⁸ + x ⁴ + x ³ + x + 1 = {01} {1b} (m Modular reduction by (x) allows the result to be expressed in bytes). For reference, the first ten round constants (starting with i = 1) are:

The XOR (exclusive OR) function table for hexadecimal values 0 through f is shown in FIG. 2 for convenience. Note that the XOR function is a bitwise operation (equivalent to addition modulo 2). For two bytes {a ₇ a ₆ a ₅ a ₄ a ₃ a ₂ a ₁ a ₀ } and {b ₇ b ₆ b ₅ b ₄ b ₃ b ₂ b ₁ b ₀ }, the sum is {c ₇ c ₆ c ₅ c ₄ c ₃ c ₂ c ₁ c ₀ }, where each c _i = a _i XOR b _i . These bytes can be represented in hexadecimal notation in a pair of hexadecimal values. Reverse key expansion routine according to the present invention is to be noted that the nature of the XOR function, i.e. c _i = a _i b _i if the XOR utilizes the property of a _i = c _{i i} XOR b.

From the pseudo-code provided above, it can be seen that the forward key expansion routine begins by filling the first Nk word of the expanded key with the cipher key. Each subsequent word w [i] is equal to the XOR of word w [i-Nk] preceding the previous word w [i-1] by Nk positions. For a word at a position that is a multiple of Nk (ie, for i mod Nk = 0), the transform sequence is applied to w [i-1] before XOR with w [i-Nk]. This conversion sequence is used to perform a precise shift of the bytes in the word (i.e., RotWord ()), then to apply an S-box table search to all four bytes of the word (i.e., the SubWord () function), and then It consists of XOR with the round constant Rcon [i / Nk] for that word. Additionally, for a 256-bit cipher key (Nk = 8) or other large cipher key (Nk> 6) in the Rijndael cipher algorithm, if i-4 is a multiple of Nk (ie when i mod Nk = 4), S The box search function SubWord () is applied to w [i-1] before XOR with w [i-Nk].

3, 5 and 7 provide examples of forward key expansion routines for 128-bit, 192-bit and 256-bit, respectively.

The reverse key expansion method of the present invention generates the round key in an "on-the-fly" manner in the reverse direction, i.e., round by round. The pseudo-code for reverse key expansion is:

The reverse key expansion routine requires that the last Nk words of the round key from the previous forward expansion can be stored in memory. In reverse order, these last round keywords are the first round keywords for use in an equivalent reverse cipher. Each subsequent word w [i-Nk] generated in the reverse direction (i.e. decreasing i) is the word w [i] leading by the Nk position and its adjacent word w [i, which may be modified as appropriate by the conversion sequence. -1] is the same as XOR. The conditions for applying the conversion sequence, and in fact the conversion sequence itself, are the same as in forward key expansion. The functions SubWord (), RotWord () and XOR, and the round constant word array Rcon [i] are exactly the same as described above for forward key expansion. For words at positions that are multiples of Nk (i.e. for words with i mod Nk = 0), the conversion sequence applied to w [i-1] is a cyclic shift of bytes (i.e., the RotWord () function), It then consists of the application of the S-box table search to all four bytes of the word (i.e. the SubWord () function) and the XOR with the corresponding round key Rcon [i / Nk]. Also, for a 256-bit cipher key (Nk = 8) or other large cipher key (Nk> 6) in the Rijndael reverse cipher, if i-4 is a multiple of Nk (ie, when i mod Nk = 4), S The box search function SubWord () is applied to w [i-1] before XOR with w [i], which produces w [i-Nk].

4, 6, and 8 provide examples of reverse key expansion routines for the same 128-bit, 192-bit, and 256-bit cipher keys from the forward key expansion examples of FIGS. 3, 5, and 7, respectively. . Comparing Figures 3 and 4, it can be seen that the same 44 round keywords w [0] to w [43] required for the round 0 premix in AES and the next 10 rounds are generated (AES block). Since size Nb is a 32-bit word or 256 bits, four round keywords are used per round). In the forward direction, expansion begins with four cipher keywords w [0] through w [3]. In the reverse direction, the last four words w [40] to w [43] previously obtained from the forward key expansion and stored in the memory are used to find the remaining round key words w [39] to w [0] in reverse order. In each direction, the same conversion sequence is applied to every fourth word w [i-1], i.e. when i is a multiple of 4 (= Nk). Comparing the rows of FIG. 3 and FIG. 4 with the same value of i, it is demonstrated that the translation sequence in the reverse direction (FIG. 4) is the same as applied in forward key expansion (FIG. 3). The difference between forward key expansion and reverse key expansion appears in the last two rows of words. w [i-Nk] is used to generate w [i] in the forward direction (FIG. 3) and w [i] is used to generate w [i-Nk] in the reverse direction (FIG. 4) in these two directions. Since the last two columns are reversed, the symmetry of the XOR operation is evident. Similarly, a comparison of Figs. 5 and 6 for the 192-bit cipher key of the same example shows that the reverse key expansion is equivalent to the forward key expansion for round-0 premix and 12 cipher rounds in the reverse and for the equivalent reverse cipher round. It shows generating the same 52 round keywords. Similarly, Figures 7 and 8 demonstrate that the reverse key extension correctly generates 60 round key words in the reverse direction using 8 stored words obtained from the forward extension. Also note that the same SubWord () transform is used in the reverse direction. The reverse S-box table is neither used nor required for the forward key expansion of the present invention.

When Fig. 9a and FIG. 9b, and the key scheduling circuit including Nk words of the input registers (11, _{7, 0-11)} for storing (where a maximum number of 8). For forward encryption, these are the first Nk words of the cipher key. For reverse encryption, these registers are obtained from the previous encryption round and the last Nk round words that were stored in system memory are loaded. And provided to the input register (11 _{0-11 7)} is round key register (15 _{0-15 7)} the word value of their initial via selection multiplexer (13, _{7, 0-13),} a round key registers the loaded word Save it. The output of the round key registers 15 _{0 to} 15 ₇ is represented by rk1 to rk4 and rk1b to rk4b. The output is repeated again via a multiplexer (13 _{0-13 7),} is also input to a pair of multiplexers (17, 18) for processing. Multiplexer 17 receives word w [i-1] to be computed by the conversion sequence if appropriate for index i, while multiplexer 18 selects w [i-Nk] or key expansion backward for key expansion forward. Receive one of w [i]. After passing through the conversion circuit 19 or bypassing the conversion circuit along the word line 20 as selected by the multiplexer 21, two words are input to the XOR gate 23, and the result is KEYSTRAND_NEXT. Becomes the next round keyword that updates the round key register 15 ₀ .

10 shows a conversion circuit 19 for applying a conversion sequence to the round keyword w [i-1] when appropriate. The word w [i-1] selected by the multiplexer 17 is input as a key cloud (KEYCLOUD) [31: 0], which is branched and rotated by the 4-by-4 byte multiplexer 25. Each byte is input to the one of the S- box (27 _{0-27 4),} which can be embodied as a lookup table or a set of gates. Each S-box prints a byte result. Round constant XOR circuit 29 receives the first byte of the converted word and adds a specific round constant corresponding to i / Nk. Circuit 29 generates index byte i [3: 0] and keysize [1: 0] markers (e.g., 00 for 128-bit keys, 01 for 192-bit keys) to generate the correct round key constants. 10) for a 256-bit key. The converted words are recombined by the multiplexer 31. For Nk = 8, alternate paths from the S-boxes 27 _{0 to} 27 ₄ skip the round constant addition block and correct unrotated order for the case when i mod 8 = 4 (correct un- rotated order) This alternating path combines the converted word temp and the multiplexer 32. The unconverted word w [i-1] bypasses the conversion accompanying path 33. The correct temp word is selected by the multiplexer 35.

Referring to FIG. 11, one countermeasure for blocking a power analysis attack against a key scheduler circuit is shown, where a set of different types of S-box tools are used. For example, the functionality can be done using SRAM, ROM, cloud circuits, and computation circuits, each having a different power signature. There are 4! = 24 different permutations for the four S-boxes. By randomly changing the order in which bytes pass through different boxes, the power signature has 24 different forms that can be taken. In Fig. 11, the word input 37 is branched into bytes provided to different S-boxes 41 _{0 to} 41 ₃ . These bytes are then recombined to produce an S-box converted output word 45. By the set and their replacement set (43 _{0-43 3)} is a random generator 47 and the selection control signal generator 49 to generate the selected channel word permutation and restoration reverse order of the byte select column multiplexer (39 _{3 0-39)} Controlled. The random generator 47 may be a linear feedback shift register (LFSR) with some selected polynomial set that governs the generation. The selection control signal generator 49 operates according to the table shown in FIG. For each LFSR output in the 9-bit range from the random generator 47, a particular one of the 24 possible path permutations is selected, and corresponding select SEL and deselect SEL- ¹ control signals are output. Other path permutations may instead be implemented by changing the function table of the selection control signal generator 49, or by additionally changing the size of the LFSR or other random generator 47 or a particular pseudo-random function. The control signal generator 49 may be implemented as a lookup table.

Referring to FIG. 13, another power and timing analysis countermeasure is a dummy circuit that introduces power noise during premix (round 0) operations. This dummy circuit matches the propagation delay amount to the initial XOR premix array and inserts the pseudo-random noise generated by the set of random generators, preferably the linear feedback shift registers 51 and 53. The multiplexer elements 55-57 match the delay amounts of the corresponding elements of the actual input circuit. The output from the word-width XOR array 59 is not used in the encryption of the actual plaintext, but is fed back to the inputs of the random generators 51 and 53. The output of the XOR matches the nature (also word-width) of the actual XOR array, but has a different input due to random generation. The random generator also receives plaintext input, word by word, in an order in which the dummy signal may have some relationship to the plaintext (but not at all relative to the cipher key), filtering out the dummy signal, To make it more difficult.

14 and 15, a premix operation that combines a plaintext block with a cipher key prior to the first round may be performed even if a round keyword for the first cipher round is generated. The 128-bit plaintext block is received in the input buffer 71. The first 128-bits of the cipher key are likewise received in the input buffer 72. These block size units are processed into 32-bit words and then shifted into the premix XOR array 73 using multiplexer 75. For the last round (or the most round for decryption), the key mix operation is skipped as selected by the multiplexer 77 controlled by the state machine programmed according to the AES algorithm specification. AES round 1 then proceeds to S-box replacement 79, thermal mixing operation 81 and key XOR operation 83 using the round key. Subsequent rounds receive the converted words of the block from the previous round at input 84. The key strand for the key XOR operation on the translated word is derived from the key scheduler described above. The key scheduling operation causes the first round key to be generated during the round 0 premix operation (pre-round) (prestep key_1 to prestep key_4 in FIG. 15), so that subsequent rounds including the first round m will wait. There is no round keyword already available for that round without the need.

According to the present invention, AES / Rijndael round keys can be generated efficiently in the reverse direction (decryption direction), and can be used for power analysis attacks during the first phase of encryption, especially during the pre-key-mix phase (round 0) of encryption. Countermeasures can also be provided, and the total number of clock cycles required to process cryptography can be reduced.

Claims (8)

A key expansion routine is performed according to the Advanced Encryption Standard (AES) -Rijndael's block cipher algorithm to generate a key schedule of Nb (Nr + 1) round-keyword w [i] from a given cipher key of Nk words ( Where Nb is the cipher block size in word units, Nr is the number of rounds employed by the cipher algorithm), and if necessary, the round-keyword w [i] in a "on-the-fly" manner. In the key generator, a method for generating a round-keyword in an "on-the-fly" manner in a reverse direction suitable for the decryption operation of the cipher algorithm, Providing a memory for storing a final set of Nk round-keywords; Performing the key expansion routine in the forward direction during an encryption operation to obtain the final set of Nk round-keywords, and storing the final set of Nk round-keywords in the memory; Setting the key generator to the decryption operation; Obtaining the previous round-keyword w [i-Nk] in an “on-the-fly” manner by an XOR logic operation involving the stored round-keywords w [i] and w [i-1]. Wherein w [i-1] is first modified by the transform sequence before applying the XOR logical operation every time i mod Nk = 0 and also Nk> 6 and i mod Nk = 4, wherein the transform sequence Entails cyclic byte shifts, S-box byte substitutions, and XOR operations with round constants when i mod Nk = 0, and only S-box byte substitutions when Nk> 6 and i mod Nk = 4. And the transform sequence for w [i-1] is the same in the forward and reverse key extension routines and matches the block cipher algorithm of AES-Rijndael. 2. The method of claim 1, wherein the key generator is implemented as hardware circuitry. 3. A plurality of S-boxes are provided for performing the S-box byte replacement, each S-box having the same functionality designated for AES-Rijndael, but characterized by different power consumption signatures. With different hardware implemented, the pseudo-random generator selecting a variable path to a different B-box for the various bytes to be replaced in the key expansion routine. 4. The pseudo-random generator of claim 3, wherein the pseudo-random generator comprises a linear feedback shift register providing an n-bit pseudo-random output and a path selection control signal addressed by the pseudo-random output and corresponding to the pseudo-random output. Round-keyword generation method comprising a search table provided. In a hardware block cryptographic circuit having a pre-mix subcircuit for performing an initial pre-mix XOR operation of a cryptographic block algorithm that mixes cryptographic keys and plaintext prior to initiating a sequence of cryptographic encryption rounds to generate cryptographic text, In a pre-mix dummy circuit for use as a differential power analysis countermeasure, Operating during the initial pre-mix XOR operation, characterized by a propagation delay amount that substantially matches the propagation delay amount of the pre-mix subcircuit, and comprising a pseudo-random generator and an XOR array; A dummy circuit having a first input connected to an output of a pseudo-random generator, a second input connected to receive the same encryption key as the pre-mix subcircuit, and an output fed back to the pseudo-random generator. Pre-mix dummy circuitry inserts pseudo-random noise into the overall power signal of all XOR gate switching of the hardware block cryptographic circuit during the initial pre-mix XOR operation. 6. The pre-mix dummy circuit of claim 5 wherein the pseudo-random generator comprises a set of linear feedback shift registers. 6. The pre-mix dummy circuit of claim 5, wherein the pseudo-random generator and the XOR array of the dummy circuit have a word width of a bit equal to the word width of the pre-mix subcircuit. In a hardware block cipher circuit configured to perform a cipher algorithm with an initial pre-mix XOR operation that mixes a cipher key and a plaintext before initiating a sequence of cipher encryption rounds to generate a ciphertext, the pre-mix operation is performed first. In the method of combining with the cipher encryption round, Preprocessing the cipher key while plaintext is loaded to generate a round-keyword for the first cipher encryption round, wherein the pre-mix XOR operation also occurs while plaintext is loaded; Performing the first cipher encryption round on the loaded and pre-mixed plaintext using the pre-generated first round-keyword Joining method comprising a.