RU2140712C1 - Method for ciphering binary data blocks - Google Patents

Abstract

FIELD: electrical communications and computer engineering. SUBSTANCE: method involves generation of ciphering keys in the form of combination of sub-keys, division of data block into N 2 sub-blocks, and their sequential conversion by executing double-point operations with sub-block and sub-key. Novelty is that prior to executing double-point operation with i-th sub- block and sub-key the latter undergoes substitution operation depending on i-th sub-block. Novelty is also that substitution operation depending on ciphering key is used as substitution operation depending on i-th sub-block executed with substitution operation sub-key. EFFECT: improved ciphering speed in software implementation. 2 cl, 1 dwg

Description

The invention relates to the field of telecommunications and computer technology, and more particularly to the field of cryptographic methods and devices for encrypting messages (information). In the aggregate of the features of the proposed method, the following terms are used:
- the encryption key is a combination of bits used to encrypt information data signals; the encryption key is a removable cipher element and is used to convert a given message or a given set of messages; the encryption key should be known only to a legitimate user;
- a cipher is a set of elementary steps for converting input data using a cipher key; the cipher can be implemented as a computer program or as a separate electronic device;
- a subkey is a part of the encryption key used in individual elementary steps of encryption;
- a binary vector is a sequence of zero and unit bits, for example 101101011; the specific structure of the binary vector can be interpreted as a binary number, if we assume that the position of each bit corresponds to a binary digit, i.e. a binary vector can be associated with a numerical value, which is determined uniquely by the structure of the binary vector;
- encryption is a process that implements some way of converting data using a cryptographic key, converting data into a cryptogram, which is a pseudo-random sequence of characters from which obtaining information without knowing the encryption key is practically impossible;
- decryption is the opposite of the encryption process; decryption provides information recovery from the cryptogram with knowledge of the encryption key;
- cryptographic strength is a measure of the reliability of information protection and represents the complexity, measured in the number of elementary operations that must be performed to recover information from the cryptogram with knowledge of the conversion algorithm, but without knowledge of the encryption key.

 Known methods for block encryption of binary information, see, for example, the US standard DES [W. Diffie, M.E. Hellman. Security and Immitability: Introduction to Cryptography // TIIER. 1979. T. 67. N. 3. S. 87-89], the encryption method according to US patent N 5222139 of June 22, 1993, the code FEAL-1 and the cryptographic algorithm B-Crypt [S. Maftik. Protection mechanisms in computer networks - M., Mir, 1993. S. 49-52]. In known methods, the encryption of data blocks is performed by forming an encryption key in the form of a set of subkeys, splitting the converted data block into subblocks, and changing the latter one by one using substitution, permutation, and arithmetic operations performed on the current subblock and the current one under the key.

However, the known analogue methods are not sufficiently resistant to the known differential cryptanalysis [T. Berson A. Differential Cryptanalysis Mod 2 ³² with application to MD5 // EUROCRYPT'92. Hungary, May 24-28, 1992. Proceedings. P. 67-68], because for all input data blocks for a given conversion step, the same subkey is used unchanged.

The closest in technical essence to the claimed method of encrypting binary information is the method described in the Russian standard of cryptographic data protection [USSR Standard GOST 28147-89. Information processing systems. Cryptographic protection. Cryptographic Transformation Algorithm]. The prototype method includes generating an encryption key in the form of a sequence of 8 subkeys 32 bits long, splitting the input 64-bit data block into two 32-bit subblocks B ₁ and B _2, and alternately converting the sub-blocks. One step of converting a sub-block, for example, sub-block B ₂ , is to overlay the current subkey Q _i , which is fixed for this step, using the addition operation modulo 2 ³² (+) in accordance with the formula B ₂ : = B ₂ + Q _i , where 1 ≤ i ≤ 8, after which the substitution operation is performed on the new value of the sub-block B ₂ , then the operation of cyclic left shift by eleven bits, i.e. eleven binary digits in the direction of the higher digits, and then the sub-block B _{1 is} superimposed on the obtained value of B ₂ using the bitwise summing operation modulo two (⊕) in accordance with the formula B ₂ : = B ₂ ⊕ B ₁ . The substitution operation is performed as follows. The subblock is divided into 8 binary vectors with a length of 4 bits. Each binary vector is replaced by a binary vector from the lookup table. The 8 4-bit vectors selected from the lookup table are combined into a 32-bit binary vector, which is the output state of the subblock after performing the lookup operation. A total of 32 similar steps are taken to change the sub-blocks, and for all the converted input data blocks, at the fixed step of converting the sub-blocks, the same subkey is used with the same value.

 However, the prototype method has drawbacks, namely, with software implementation it does not provide an encryption speed of more than 1 Mbit / s [Andreev N.N. On some areas of research in the field of information security // Collection of materials of the international conference "Information Security". Moscow, April 14-18, 1997. M. 1997. S. 96], which does not allow using it for data encryption in real-time protection tools. This drawback is due to the fact that to ensure resistance to differential cryptanalysis in the prototype method, a large number of substitution operations on 4-bit subblocks of the converted data block are used, for each of which (in software implementation) the microprocessor carries out many elementary instructions, which is due to a mismatch substitutions of this type with the format of data representation in computers.

 The basis of the invention is to develop a method for block encryption of binary information in which the conversion of the input data is carried out in such a way as to reduce the number of elementary conversion operations per one bit of input data, while ensuring high resistance to differential cryptanalysis, thereby increasing the speed encryption in software implementation.

The problem is achieved in that in a method for block encryption of binary information, including generating an encryption key in the form of a set of keys, dividing a data block into N ≥ 2 subblocks and sequentially converting subblocks by performing a two-place operation on a subblock and subconnect, the new according to the invention is that before performing a two-place operation on the i-th subunit and subkey on the subkey, a substitution operation is performed depending on the j-th subunit, where j ≠ i.
Thanks to this solution, the key structure used at a given encryption step depends on the data being converted, and thus, at this conversion step, different modified values of the subkeys are used for various input blocks, which ensures high resistance to differential cryptanalysis while reducing the number of conversion operations performed, which provides an increase in the speed of cryptographic conversion.

 Also new is that, as a substitution operation performed on a subkey that depends on the jth subunit, a substitution operation that depends on the encryption key is used.

 Thanks to this solution, an additional increase in the strength of encryption is ensured while maintaining a high encryption speed.

 Below the essence of the claimed invention is explained in more detail by examples of its implementation with reference to the accompanying drawing.

операцию суммирования по модулю 2ⁿ. Операционный блок S выполняет операцию подстановки над подключами K_2R K_2R-1 в зависимости от управляющего сигнала на управляющей шине, показанной прерывистой жирной линией. Жирные сплошные линии обозначают шину передачи n-битовых сигналов, а жирные пунктирные линии - шину передачи n управляющих сигналов, в качестве которых используются биты преобразуемых подблоков.The invention is illustrated by a generalized scheme of cryptographic conversion of data blocks based on the proposed method, which is presented in the drawing, where S is a block of the substitution operation, depending on the value of one of the converted subunits; A and B are convertible n-bit subunits; K _2R , K _2R-1 - elements of the encryption key (plug in); the sign ⊕ denotes the operation of bitwise summation modulo two, the sign

summation operation modulo 2 ⁿ . The operation unit S performs the substitution operation on the K _2R K _2R-1 subkeys depending on the control signal on the control bus indicated by a dashed bold line. Bold solid lines indicate the transmission bus of n-bit signals, and bold dotted lines indicate the transmission bus of n control signals, which are used as bits of the converted subunits.

 The drawing shows one (Rth) round of encryption. Depending on the specific implementation of the controlled substitution block and the required conversion rate, 8 to 20 or more rounds can be set.

Under the substitution operation, we understand the operation of replacing the binary value of the signal at the input of the operation unit S with another binary value (set at the output of the operation unit S), which is selected depending on the value at the input of the unit S in accordance with some replacement table. Two substitution options can be implemented:
(1) an n-bit input binary vector is replaced with an n-bit output binary vector, with different output binary vectors corresponding to different output binary vectors;
(2) an n-bit binary vector is replaced by an m-bit binary vector, where m ≥ n, and different input binary vectors can correspond to different or identical output binary vectors.

 Substitution operations of both types can be defined depending on some control signal, i.e. a given binary vector at the input can be replaced by various output binary vectors depending on the value of the control signal, which in the present method uses the value of one of the converted subunits.

где N = 2ⁿ. В данной таблице в нижней строке присутствуют все возможные значения n-битового блока ровно по одному разу, но в произвольном порядке. Очередность расположения чисел в нижней строке определяет конкретный вариант таблицы подстановки, а следовательно, и конкретный вариант операции подстановки, выполняемой с использованием этой таблицы. Выполнение операции подстановки осуществляется следующим образом. Выбирается в верхней строке число, которое равно значению входного блока. Находящееся под этим числом значение в нижней строке берется в качестве выходного блока. Таким образом, таблицу подстановки можно разместить в оперативной памяти ЭВМ как последовательную запись n-битовых компьютерных слов, размещенных в ячейках с адресами w₀, w₁, w₂, ... , w_N-1. В этом случае значение входного двоичного вектора K служит для вычисления адреса w₀ + K слова, которое берется в качестве выходного двоичного вектора. Этот способ представления таблицы подстановки требует использования объема памяти, равного 2ⁿn бит. Выберем количество таблиц подстановки, равное 2^L (объем требуемой памяти составит при этом 2^LNn бит) и разместим таблицы подстановок непрерывно друг за другом. В качестве адреса таблицы с номером v возьмем значение адреса w₀ первого n-битового слова. Пусть адрес таблицы с номером v = 0 есть s. В этом случае адрес таблицы подстановки с любым номером v равен s+vN. Если задан управляющий двоичный вектор, определяющий номер текущей таблицы подстановки v и текущий входной двоичный вектор, то операция подстановки выполняется заменой текущего входного блока на n-битовое слово, расположенное по адресу s + vN + K где K - значение входного двоичного вектора, над которым выполняется текущая операция подстановки. Используя это соотношение легко задать выбор таблицы подстановки с номером v и выполнить подстановку над входным двоичным вектором со значением K. В рассмотренном случае задание зависимости таблиц подстановок от значения управляющего двоичного вектора и выполнение операции подстановки осуществляются микропроцессором очень быстро при выборе соответствующих значений параметров L и n, например, при L=5 и n=8. При указанных параметрах для размещения таблиц подстановки требуется 8 Кбайт оперативной памяти, что является приемлемым, поскольку современные ЭВМ обладают объемом оперативной памяти на многие порядки больше этой величины (от 1 до 64 Мбайт и более).Let us explain the task of the dependence of the substitution operation of the first type on the subblock of the converted data. Let the substitution operations be performed on binary vectors of length n bits, where n is an integer. Then, to determine the substitution operation of size nxn (the designation nxn means that the input for the substitution operation is a data block of size n bits and the output block is also a binary vector of length n bits), a table containing two rows of numbers is required:

where N = 2 ⁿ . In this table, the bottom line contains all the possible values of an n-bit block exactly once, but in an arbitrary order. The order in which the numbers are located in the bottom line determines the specific variant of the lookup table, and therefore the specific version of the lookup operation performed using this table. The substitution operation is as follows. A number is selected on the top line that is equal to the value of the input block. The value under this number in the bottom line is taken as the output block. Thus, the substitution table can be placed in the main memory of a computer as a sequential record of n-bit computer words located in cells with addresses w ₀ , w ₁ , w ₂ , ..., w _N-1 . In this case, the value of the input binary vector K serves to calculate the address w ₀ + K of the word, which is taken as the output binary vector. This way of representing a lookup table requires a memory size of 2 ⁿ n bits. We select the number of lookup tables equal to 2 ^L (the amount of required memory will be 2 ^L Nn bits) and place the lookup tables continuously one after another. As the address of the table with number v, we take the value of the address w _{0 of the} first n-bit word. Let the address of the table with number v = 0 be s. In this case, the address of the lookup table with any number v is s + vN. If a control binary vector is specified that determines the number of the current lookup table v and the current input binary vector, then the lookup operation is performed by replacing the current input block with an n-bit word located at s + vN + K where K is the value of the input binary vector above which The current substitution operation is in progress. Using this relation, it is easy to specify the choice of the lookup table with number v and perform the lookup over the input binary vector with the value K. In the considered case, the dependence of the lookup tables on the value of the control binary vector and the lookup operation are carried out very quickly by the microprocessor when choosing the corresponding values of the parameters L and n , for example, with L = 5 and n = 8. With the specified parameters, 8 Kbytes of RAM is required to place the substitution tables, which is acceptable since modern computers have a RAM volume many orders of magnitude larger than this value (from 1 to 64 MB or more).

Рассмотрим конкретные примеры реализации заявляемого способа блочного шифрования двоичной информации.Let us explain the task of the dependence of the substitution operation of the second type on the subblock of the converted data by the example of 8x32 substitutions specified using a numbered sequence of 32-bit binary vectors {Q _j }, j = 0, 1, 2,. . . , 256. The sequence {Q _j } may be assumed to be known and related to the description of the encryption algorithm. In this case, it can be randomly generated, after which it is written as part of the description of the encryption algorithm. Another option for setting the sequence {Q _j } is its generation according to the pseudo-random law depending on the encryption key. In this case, it is secret, which further increases the cryptographic strength of encryption. The conversion of an 8-bit input binary vector (for example, subkey) K is carried out depending on the control binary vector (for example, the converted sub-block) B as follows:
(1) the number j ₀ = (B + K) mod 256 is calculated; (2) The 8-bit binary vector K is replaced by a 32-bit binary vector

Consider specific examples of the implementation of the proposed method of block encryption of binary information.

Example 1. This example explains the encryption of 64-bit data blocks. The encryption key is formed in the form of 16 plug K ₁ , K ₂ , K ₃ , ... K ₃₂ , each of which has a length of 32 bits. The input data block is divided into two 32-bit subunits A = a ₄ | a ₃ | a ₂ | a ₁ and B = b ₄ | b ₃ | b ₂ | b ₁ , represented as a concatenation of 8-bit subunits a _i and b _i , where i = 1, 2, 3, 4. The encryption of the input block is described by the following algorithm:
1. Set the counter for the number of rounds r = 1.

где

обозначает операцию подстановки над подключом K_8r, зависящую от подблока a₁.2. Convert subblock B to the expression

Where

denotes the substitution operation on the subkey K _8r , depending on the subunit a ₁ .

3. Convert subunit A to the expression
A: = A + B (mod ³² ).

где

обозначает операцию подстановки над подключом K_8r-7, выполняемую в зависимости от подблока b₁.4. Convert subunit A to the expression

Where

denotes the substitution operation on the subkey K _8r-7 , performed depending on the subunit b ₁ .

5. Convert subblock B to the expression
B: = B + A (mod 2 ³² ).

6. Преобразовать подблок A в соответствии с выражением
A:=A+B(mod 2³²).6. Convert subblock B to the expression

6. Convert subunit A to the expression
A: = A + B (mod 2 ³² ).

8. Преобразовать подблок B в соответствии с выражением
B:=B + A (mod 2³²).7. Convert subunit A to the expression

8. Convert subblock B to the expression
B: = B + A (mod 2 ³² ).

10. Преобразовать подблок A в соответствии с выражением
A:=A + B (mod 2³²).9. Convert subblock B to the expression

10. Convert subunit A to the expression
A: = A + B (mod 2 ³² ).

12. Преобразовать подблок B в соответствии с выражением
B:=B+A(mod 2³²).11. Convert subunit A to the expression

12. Convert subblock B to the expression
B: = B + A (mod 2 ³² ).

14. Преобразовать подблок A в соответствии с выражением
A: = A + B (mod 2³²).13. Convert subblock B to the expression

14. Convert subunit A to the expression
A: = A + B (mod 2 ³² ).

16. Преобразовать подблок B соответствии с выражением
B: = B + A (mod 2³²).15. Convert subunit A to the expression

16. Convert subblock B to expression
B: = B + A (mod 2 ³² ).

 17. If r ≠ 4, then increment the counter r: = r + 1 and go to step 2, otherwise STOP.

Аналитически это записывается как

Пример 2. Этот пример полностью повторяет пример 1, за исключением того, что таблица {Q_j}, j = 0, 1, 2,..., 2048, формируется до выполнения процедур шифрования в зависимости от ключа шифрования по псевдослучайному закону. Это можно сделать, например, следующим образом. Взять 1024 64-битовых двоичных вектора, имеющих численные значения 1, 2,..., 1024. Используя ключ шифрования K₁, K₂,...,K₃₂, с помощью алгоритма шифрования RC5 [B.Schneier. Applied Cryptography/John Wiley & Sons, Inc., New York, 1996. P.344-345.] зашифруем указанные 64-битовые двоичные векторы. В результате получим набор 64-битовых блоков данных, имеющих псевдослучайные значения. Разбив каждый 64-битовый блок на два 32-битовых подблока получим псевдослучайную последовательность {Q_j}, j = 0, 1, 2,...,2048.As the lookup table used to perform the lookup operation, Example 1 uses an array of numbered 32-bit binary vectors {Q _j }, j = 0, 1, 2, ..., 2048. To perform substitution, for example, over the subkey K, depending on the subunit a _i , the value of the number j _a is calculated in accordance with the formula j _a = (K + a _i ) mod 2 ¹¹ and the value of K is replaced by the value

Analytically, this is written as

Example 2. This example completely repeats Example 1, except that the table {Q _j }, j = 0, 1, 2, ..., 2048, is formed before performing encryption procedures, depending on the encryption key according to the pseudo-random law. This can be done, for example, as follows. Take 1024 64-bit binary vectors having numerical values 1, 2, ..., 1024. Using the encryption key K ₁ , K ₂ , ..., K ₃₂ , using the RC5 encryption algorithm [B. Schneier. Applied Cryptography / John Wiley & Sons, Inc., New York, 1996. P.344-345.] Encrypt the specified 64-bit binary vectors. As a result, we get a set of 64-bit data blocks having pseudo-random values. Having broken each 64-bit block into two 32-bit subblocks, we obtain the pseudo-random sequence {Q _j }, j = 0, 1, 2, ..., 2048.

 In modern computers, the operation of extracting binary vectors from RAM is carried out for a small number of machine clocks, so the inventive method provides an encryption speed of 10 to 30 Mbps (depending on the specific implementation) for a Pentium / 200 mass microprocessor.

 The above examples show that the proposed method of block encryption of discrete information is technically feasible and allows us to solve the problem.

 The inventive method can be implemented, for example, in the form of computer programs that provide high-speed data encryption.

Claims (1)

1. A method of block encryption of binary information, including the formation of an encryption key in the form of a set of subkeys, dividing a data block into N≥ 2 subblocks, performing a substitution operation and sequentially converting subblocks by performing a two-place operation on a subblock and a subkey, characterized in that the substitution operation is performed on subkey before performing a two-place operation on the i-th subunit, and the substitution operation is performed depending on the j-th subunit, where j ≠ i.
2. The method according to claim 1, characterized in that as the substitution operation performed on the subkey, a substitution operation is used depending on the encryption key.