RU2206961C2 - Method for iterative block encryption of binary data - Google Patents

Abstract

FIELD: electric communications and computer engineering. SUBSTANCE: proposed cryptographic method for data encryption includes generation of private key in the form of aggregate of sub-keys, division of data block into m≥2 sub-blocks B₁,B₂,...,B_m, and conversion of sub-blocks; sub-block B_j, where 1≤j≤m, is converted by converting at least one sub-key with aid of controlled operation depending on block B_h, where 1≤j≤m′ and h≠j, and superposing converted sub-key onto block B_j using two- position operation for the purpose. EFFECT: enhanced encryption speed. 3 cl, 2 dwg

Description

 The invention relates to the field of telecommunications and computer technology, and more particularly to the field of cryptographic methods and devices for encrypting messages (information).

In the aggregate of the features of the proposed method, the following terms are used:
- the cipher is a set of elementary steps for converting input data using a secret key;
- the secret key is binary information known only to a legitimate user;
- subkey - part of the secret key;
- encryption is the process of converting information that depends on the secret key and converts the source text into ciphertext (cryptogram), which is a pseudorandom sequence of characters from which obtaining information without knowing the secret key is practically impossible;
- decryption is the reverse process of encryption; decryption provides recovery of information from the cryptogram with the knowledge of the secret key;
- a binary vector is a sequence of zero and one bits, for example (101101011);
- Hamming weight of a binary vector is an integer function whose value is equal to the number of units in a binary vector;
- cryptanalysis - a method of calculating a secret key to obtain unauthorized access to encrypted information;
- cryptographic strength is a measure of the reliability of encrypted information protection and represents the complexity, measured in the number of elementary operations that must be performed to recover information from a cryptogram with knowledge of the conversion algorithm, but without knowledge of the secret key;
- a single operation is an operation performed on a binary vector; the binary vector generated at the output of a unary operation depends only on the input binary vector; examples of single operations are cyclic shift operations;
- double operation is an operation performed on two operands; the result of some given two-place operation depends on the value of each operand; examples of double operations are the operations of addition, subtraction, multiplication, etc .;
- the operand is a binary vector over which a two-place or one-place operation is performed;
- a controlled two-place operation is an operation performed on two operands under the control of some binary vector called the control code; the result of some controlled two-place operation with a fixed control code depends on the value of each operand, and for fixed values of the operands, on the value of the control vector; Examples of the implementation of controlled double operations are described in the patent of the Russian Federation N 2140716 [Moldovyan A.A., Moldovyan N.A., Moldovyan P.A. The method of cryptographic conversion of digital data blocks // BI N 30 from 10.27.1999]; in the formulas, the controlled two-place operation will be denoted by the entry Z: = Q _V (A, B), where A, B are the operands, V is the control code, Z is the binary vector resulting from the execution of the controlled two-place operation Q _V ;
- control code (or control binary vector) - a set of single and zero signals at the control input of a managed operating unit;
- modification of a controlled two-seater operation - a two-seater operation corresponding to the conversion of two operands with a fixed value of the control code;
- controlled permutation is an operation consisting in the permutation of the bits of the operand depending on the value of the control code; examples of the implementation of controlled permutations are described in patent N 2140714 [Alekseev L.E., Belkin T.G., Moldovyan A.A., Moldovyan N.A. The method of iterative encryption of data blocks // BI N 30 of 10.27.1999] and in the article [Guts ND, Izotov BV, Moldovyan N. A. Controlled permutations with a symmetric structure in block ciphers // Information security issues, 2000, N 4, p. 57-64]; in the formulas, the controlled permutation will be denoted by the record P _V , and the transformation of the operand A by performing a controlled permutation on it, by the record A: = P _V (A), where V is the control code; controlled permutation is a special case of controlled single operation;
- modification of controlled permutation - a fixed permutation of the bits of the operand corresponding to a given fixed value of the control code;
is an inverse controlled two-place operation (with respect to some given controlled two-place operation, Q is such a controlled two-place operation (denoted as Q ^-1 ), which for any given value of the control code V and any given value of the operand B satisfies the condition A = Q _V ^{- 1} , if Z = Q _V (A., B); options for implementing two mutually inverse controlled double-seat operations are described in [Guts ND, Moldovyan AA, Moldovyan N. A. Flexible, hardware-oriented ciphers based on managed adders // Information security issues , 2000, N 1, pp. 8-15];
- the reversed controlled two-place operation Q * is such a controlled two-place operation that is controlled by a special invert bit e; different values of e specify two different variants of the controlled two-seater operation, and these variants are mutually inverse; for example, if, for e = 0, the operation Q * _{[e = 0]} is performed, and for e = 1, the operation Q * _{[e = 1]} , then for these controlled two-place operations the relation Q * _{[e = 1]} = Q * _{[e = 0]} ^-1 ; an implementation option of a reversed controlled two-seater operation is described in [Guts N. D., Moldovyan A.A., Moldovyan N.A. Flexible hardware-oriented ciphers based on managed adders // Issues of information security, 2000, N 1, p.8-15];
- the concatenation operation is the operation of combining several binary vectors, as a result of which a new binary vector is formed, including all the bits of each of the combined binary vectors, and the relative position of the bits corresponding to the original binary vectors does not change; for example, the concatenation of binary vectors W ₁ = (101101011) and W ₂ = (011101010) is written as W ₁ \ W ₂ = (101101011011101010).

 Known methods for block data encryption, see, for example, the DES cipher [B. Schneier. Applied Cryptography. Second Eddition. - New York: John Wiley & Sons, Inc., 1966, p. 270-277]. In this method, the encryption of data blocks is performed by generating a secret key, dividing the converted data block into two subunits L and R and alternately changing the latter by performing the bitwise addition operation modulo 2 (which we denote by знаком) over the subunit L and the binary vector that is formed as the output value of some function E from the value of the sub-block R. After this, the sub-blocks are rearranged. Function E in the specified method is implemented by performing permutation and substitution operations performed on subunit R.

 However, the known analogue method uses a small secret key (56 bits), which makes it vulnerable to cryptanalysis based on key selection. The latter is associated with the high computing power of modern computers. Another well-known method of iterative block encryption of binary data is a method implemented in the RC5 cipher [B.Schneier. Applied Cryptography. Second Eddition. - New York: John Wiley & Sons, Inc., 1966, p. 344-346]. This method includes generating a secret key in the form of a set of subkeys, breaking the binary code of the information data blocks and encrypting them by breaking the data block into subblocks A and B, and alternately converting the subblocks.

Subblocks are converted by performing single and double operations on them. As two-place operations, the modulo 2 ³² (+) addition operations and the bitwise addition modulo 2 operation are used. The cyclic left shift operation is used as the unary operation, the number of bits by which the converted subunit is shifted depends on the value of the other subunit, which determines dependence of the cyclic shift operation at the current step of converting a subblock on the initial value of the input data block. Double operation is performed on a sub-block and a sub-block, as well as on two sub-blocks.

 Characteristic of the RC5 method is the use of a cyclic shift operation, depending on the value of the input block. A subunit, for example subunit B, is converted by superimposing subunit A onto subunit B using the bitwise addition operation modulo 2, i.e. the bitwise addition operation is performed modulo 2 over the subblocks A and B and the value obtained after performing this operation is assigned to the subblock B. This is written as the ratio B: = B⊕A, where the “: =” sign denotes the assignment operation.

After that, the operation of cyclic shift to the left by the number of bits equal to the value of the subunit A: B: = B <<< A is performed on subblock B. Then, over the subblock B and one of the subkeys S, the summation operation is performed modulo 2 ⁿ , where n is the length of the subblock in bits: B: = (B + S) mod 2 ⁿ . After that, subunit A is similarly converted. Several such steps are taken to convert both subunits. The disadvantage of the RC5 cipher is the lack of resistance to differential cryptanalysis.

 The closest in its technical essence to the claimed method of iterative block encryption of binary data is the method described in the patent of the Russian Federation N 2140710 [Maslovsky VM, Moldovyan AA, Moldovyan NA The method of block encryption of discrete data // IPC 6 N 04 L 9/00, BI N 30, 10.27.99]. The prototype method includes generating an encryption key in the form of a set of subkeys, splitting the input binary data block into two subunits A and B, which are alternately converted by performing several rounds of conversion (iterations). One round of conversion is to complete the following conversion steps.

1. On the first sub-block (sub-block A) the control code V ₁ is generated.

2. Above the first subkey K ', a permutation operation is performed: K': = P _V1 (K ').

 3. The converted subkey K 'is superimposed using the bitwise addition operation modulo two on the second subunit (subunit B): B: = В⊕К'.

4. Then, subblock B is superimposed onto subblock A using the addition operation modulo 2 ³² (+): A: = A + B.

5. By subunit B, the control code V ₂ is generated.

6. Over the second subkey K ", the permutation operation is performed: K"': = P _V2 (K'').

 7. The converted subkey K "is superimposed on the subunit A: A: = А⊕К".

 8. Then subunit A is superimposed on subunit B: B: = B + A.

 However, the prototype method has drawbacks, namely, the permutation operation defines a conversion of the subkeys that does not change the Hamming weight from the latter, in particular, the parity of the subkey bits does not change, therefore, to obtain high resistance of the encryption conversion to linear cryptanalysis, a large number of conversion operations are required, which reduces encryption speed.

 The basis of the invention is the task of developing an iterative block encryption of binary data, in which the conversion of the subkeys using operations depending on the converted data is carried out in such a way that the controlled operation performed on the subkey changes the Hamming weight from it, which will reduce the number of operations performed when encrypting a data block while maintaining high cryptographic strength, thereby increasing the encryption speed.

The problem is achieved in that in the method of iterative block encryption of binary data, which consists in generating a secret key in the form of a set of subkeys, dividing the data block into m≥2 subunits B ₁ , B ₂ ,. .., In _m and the alternate conversion of the subblocks, and the conversion of the subblock B _j , where 1≤j≤m, is carried out by performing at least one subkey of a controlled operation depending on the subblock B _h , where 1≤h≤m and h ≠ j, and overlays with the help of the two-place operation of the converted subkey on the sub-block B _j , new according to the invention is that as a controlled operation, a controlled two-place operation is used.

 Thanks to this solution, it is possible to reduce the number of operations used when encrypting a data block while maintaining high resistance to linear cryptanalysis, which increases the encryption speed.

 New is the fact that a controlled two-place operation is performed on two subkeys at the same time.

 Thanks to this solution, the resistance to cryptanalysis based on random hardware errors is increased.

In addition, it is new that a controlled two-place operation is performed simultaneously on the subkey and sub-block B _g , where 1≤g≤m and g ≠ j.

 Thanks to this solution, an additional increase in resistance to cryptanalysis based on random hardware errors is provided.

 Below the essence of the claimed invention is explained in more detail by examples of its implementation with reference to the accompanying drawings (figures 1, 2).

A generalized scheme of iterative encryption of data blocks based on the proposed method is presented figa, where
Q is the operating unit, performing a controlled two-seater operation, the modification of which is set by the value of the control code V = A supplied to the control input of the operating unit Q;
A and B are subblocks of the converted data block;
"⊕" is a bitwise addition operation modulo two.

X is an operation unit indicating the operation used to generate the control code V, depending on subunit A; for example, X may indicate an assignment operation (ie, V: = A) or a procedure for applying a subkey W _r to sub-block A (ie, V: = А⊕W _r );
F is the second operand used when performing a controlled two-place operation on a subkey; as F, a data sub-block A or an additional subkey can be used.

Figa corresponds to the execution of one round of encryption. After completing each round of encryption, except the last one, the subunits are rearranged. Decryption is performed according to the same scheme, but when using subkeys in the reverse order. Options for constructing electronic circuits that implement a controlled two-seater operation Q are described in [Guts N.D. and others. Flexible hardware-oriented ciphers based on managed adders // Issues of information security, 2000, N 1, p.8-15]. When decrypting conversions, the subkeys are used in the reverse order, i.e. plug K _r and W _r used on the rth round of encryption, when decrypting, they are used on the (R-r + 1) th round, where R is the number of rounds of encryption. Thus, for the subkeys K ' _r and W' _r used in the rth decryption round, we have the relations K ' _r = K _{R-r + 1} and W' _r = W _{R-r + 1} . After the last (Rth) round of encryption or decryption, the data subunits are not rearranged.

 From the point of view of application in encryption algorithms, managed operations have the advantage that their modifications are selected depending on the variable parameters of the encryption process. Variable parameters can be plug-ins, sub-blocks of the information block, or specially generated values that change with a change in the initial value of the information block. In the general case, the value that controls the two-place operation will be called the control code V. By the formation of the control code V we will mean the formation of signals at the control input of the operating unit that performs the controlled two-place operations.

 In specific examples of the implementation of the inventive method of iterative block encryption of binary data, a controlled permutation operation with a 32-bit input for the converted data and a 96-bit control input, to which the control code is received, is used as a procedure for converting the binary vector F as a procedure for converting the binary vector. permutations. A variant of constructing an operating unit for implementing such a controlled permutation is described in the article [Guts N.D. and others. Controlled permutations with a symmetric structure in block ciphers // Issues of Information Security, 2000, N 4, p. 62-63].

Example 1
This example is illustrated in figb. It corresponds to the encryption of 64-bit data blocks. The encryption key is generated in the form of a set of 16 K ₁ , K ₂ , K ₃ ,. .. A ₁₆ , each of which has a length of 32 bits. The input data block is divided into two 32-bit subunits A and B. The encryption procedure for the input block is described by the following algorithm:
1. Set the counter for the number of rounds r = 1.

2. Convert subkey K _r by superimposing subblock A onto it using a controlled two-seater operation Q, using the value of subblock A as a control code:
K _r : = Q _A (K _r , A).

3. Convert subblock B: B: = B⊕K _r .

 4. If r ≠ 16, then increment the counter r: = r + 1, rearrange subblocks A and B (that is, take binary vector A as binary vector B, and binary vector B as binary vector A) and go to step 2, otherwise STOP.

The cryptogram block C is formed by combining the transformed binary vectors A and B: C = A | B. Decryption of the cryptogram block is performed using the same algorithm, except that when performing steps 2 and 3, the K _17-r subkey is used instead of the K _r subkey.

Example 2
Example 2 is illustrated in figv and corresponds to the encryption of 64-bit data blocks. The encryption key is formed in the form of a set of 16 subkeys K ₁ , K ₂ , K ₃ , ... K ₁₆ , each of which has a length of 32 bits. In each round of conversion, two subkeys are used, namely, in the rth round, the subkeys K _r and W _{r are used} , where W _r = K _{r + 8} for r = 1, 2, ..., 8 and W _r = K _{r- 8} for r = 9, 10, ..., 16. The input data block is divided into two 32-bit subblocks A and B. The encryption procedure for the input block is described by the following algorithm:
1. Set the counter for the number of rounds r = 1.

2. Depending on subunit A, generate control code V:
V: = А⊕W _r
3. Convert subkey To _r by superimposing subkey W _r on it, using a controlled two-place operation Q:
K _r : = Q _V (K _r , W _r ).

4. Convert subblock B: B: = B⊕K _r .

 5. If r ≠ 16, then increment the counter r: = r + 1, rearrange subblocks A and B (that is, take binary vector A as binary vector B, and binary vector B as binary vector A) and go to step 2, otherwise STOP.

The cryptogram block C is formed by combining the transformed binary vectors A and B: C = A | B. The cryptogram block is decrypted using the same algorithm, except that in step 2, the W _17-r subkey is used instead of the W _r subkey, in step 3, the W _17-r and K _17-r subkeys are used instead of the W _r and To _r, respectively, and in step 4, the subkey K _{17-g is used} instead of the subkey K _r .

Example 3
Example 3 is illustrated in Fig. 1d and corresponds to the encryption of 64-bit data blocks. The encryption key is formed in the form of a set of 16 subkeys K ₁ , K ₂ , K ₃ , ... K ₁₆ , each of which has a length of 32 bits. In each round of conversion, two subkeys are used, namely, in the rth round, the subkeys K _r and W _{r are used} , where W _r = K _{r + 8} for r = 1, 2, ..., 8 and W _r = K _{r- 8} for r = 9, 10, ..., 16. The input data block is divided into two 32-bit subblocks A and B. The encryption procedure for the input block is described by the following algorithm:
1. Set the counter of the number of rounds r = 1 and the value of the encryption mode parameter z = 0 (encryption).

2. For subunit A, generate control code V ₁ :
V ₁ : = A⊕W _r .

3. Convert subkey To _r by superimposing subkey W _r on it, using a controlled two-place operation Q:
K _r : = Q _V1 (K _r , W _r ).

4. Convert subblock B using a reversible controlled two-place operation Q * _{[e = z]} , using the value of subblock A as a control code:
B: = Q * _{A, [e = z]} (B, K _r ).

 5. If r ≠ 16, then increment the counter r: = r + 1, rearrange subblocks A and B (that is, take binary vector A as binary vector B, and binary vector B as binary vector A) and go to step 2, otherwise STOP.

Decryption of the cryptogram block is carried out using the same algorithm, except that in the first step the value z = 1 is set (decryption mode) and when performing step 2, the subkey W _{17-r is used} instead of the subkey W _r , in step 3 the subkey K is used _17-r and W _17-r instead of the subkeys K _r and W _r, respectively, and in step 4, the subkey K _{17-r is used} instead of the subkey K _r .

Example 4
This example explains the encryption of 96-bit data blocks. The encryption key is formed in the form of 24 subkeys K ₁ , K ₂ K ₃ , ... A ₂₄ , each of which has a length of 32 bits. The input data block is divided into three 32-bit subunits A, B and C. The encryption procedure for the input block is described by the following algorithm:
1. Set the counter for the number of rounds r = 1.

2. Convert the subkey To _3r-2 : To _3r-2 : = Q _C (K _3r-2 , B).

3. Convert subunit A: A: = А⊕K _3r-2 .

4. Convert the subkey K _3r-1 : K _3r-1 : = Q _A (K _3r-1 , C).

5. Convert subblock B: B: = B⊕K _3r-1 .

6. Convert the subkey K _3r : K _3r : = Q _B (K _3r , A).

7. Convert the subunit C: C: = С⊕K _3r .

 8. If r ≠ 8, then increment the counter r: = r + 1 and go to step 2, otherwise STOP.

 This algorithm is presented in the form of a conversion diagram in figa. Decryption procedures corresponding to this example are shown in FIG.

 Due to the use of controlled double-seat operations to convert round subkeys depending on the data being transformed, the Hamming weight for the converted subkeys is not constant, which significantly increases the encryption resistance to linear cryptanalysis. This allows you to reduce the number of conversion operations used and thereby significantly increase the encryption speed.

 The above examples show that the proposed method of cryptographic transformations of binary data blocks is technically feasible and allows us to solve the problem.

Claims (3)

1. A method of iterative block encryption of binary data, which consists in generating a secret key in the form of a set of subkeys, dividing the data block into m≥2 subblocks B ₁ , B ₂ , ..., B _m and converting subblocks, and the transformation of the subblock is B _j , where 1≤j≤m, carried out by converting at least one subkey using a controlled operation depending on the subblock B _h , where 1≤h≤m and h ≠ j, and overlay using the two-place operation of the converted subkey on the subunit B _j characterized in that as a controlled operation and polzujut controlled two-place operation.  2. The method according to claim 1, characterized in that the controlled two-place operation is performed on two subkeys at the same time. 3. The method according to claim 1, characterized in that the controlled two-seater operation is performed simultaneously on the sub-block and sub-block B _q , where 1≤g≤m and g ≠ j.

Images