TWI235582B - Apparatus for supporting advanced encryption standard encryption and decryption - Google Patents

Abstract

An apparatus for supporting advanced encryption standard encryption and decryption combines bytes substitution and inverse bytes substitution operations, and includes first and second matrix operation devices, first and second exclusive-OR operation modules, first and second multiplexers, and a table-look-up device. The first multiplexer selects one from the outputs of the first matrix operation device and first exclusive-OR operation module. The second multiplexer selects one from the outputs of the second matrix operation device and second exclusive-OR operation module. The table-look-up device applies a common look-up table so as to save operation resources. In addition, the elements of the encryption apparatus are connected in a way such that the entire critical paths and complexity are reduced, thus improving the speed of the apparatus.

Description

1235582 发明 Description of the invention: [Technical field to which the invention belongs] The present invention relates to an encryption and decryption device, and more particularly to an encryption and decryption device that supports the Advanced Encryption Standard (AES). [Previous technology] As e-commerce and online transactions have developed vigorously in recent years, the requirements for data encryption have become more stringent. Following the Data Encryption Standard (DES), the Advanced Encryption Standard has been developed. , AES) password system to make the confidentiality of the information even higher. On the other hand, the AES cryptosystem is a symmetric encryption system, that is, the same key is used for encryption and decryption. The length of the key can be 128 bits, 192 bits, or 256 bits. (Plaintext) and cipher text (Cipher text) can only be 128-bit. For the sake of convenience, the following text will use 128-bit length as an example for the plaintext, ciphertext, and key. Algorithm of AES cryptosystem when performing encryption operation:

AddRoundKey for round 2 to Nr-1 KeyExpansion SubBytes Shi ftRows MixColuraes AddRoundKey end for

SubBytes ShiftRows 1235582

AddRoundKey first executes the steps of "Adding a Recurring Key" (hereinafter referred to as AddRoundKey). At this time, the system will mutually exclude the plaintext with the first secondary key (the secondary key is a key generated through a specific operation, hereinafter referred to as SubKey). OR (X0R) is output after the operation, and enters the following loop; for the sake of explanation, the data after the mutual exclusion or operation of the plaintext and the first SubKey is called encrypted input data. The number of loops is set to Nr-1, and the size of Nr is set in accordance with AES regulations. The "KeyExpansion" (hereinafter referred to as "KeyExpansion") operation in the loop will generate the next SubKey based on the previous SubKey, that is, the second time the first SubKey is generated when the loop is executed for the first time. SubKey, when the second loop is executed, a third SubKey will be generated based on the second SubKey, and so on. The encrypted input data is then subjected to "sub-bit operations" (hereinafter referred to as SubBytes), "column transfer operations" (hereinafter referred to as ShiftRows), and "row mixed operations" (hereinafter referred to as MixColumes), and then the current SubKey (because it has been executed KeyExpansion, so this time is the second SubKey) to perform an exclusive OR operation, and perform the above steps again until the end of the loop. After the loop is over, the system will perform operations such as SubBytes, ShiftRows, and AddRoundKey to complete the encryption step. The following will continue to describe the algorithm used in the decryption operation. Algorithm of AES cryptosystem when performing decryption operation:

AddRoundKey for roundel to Nr-1 InvKeyExpansion InvShiftRows InvSubBytes AddRoundKey InvMixColumes end for 1235582

InvShi ftRows

InvSubBytes

AddRoundKey Basically, the decryption algorithm is the inverse operation during encryption. First, the system will execute the steps of InvAddRoundKey, and output the ciphertext and the last one, such as the tenth SubKey, after performing a bit mutex or (X0R) operation, and enter the following loop; for the sake of explanation, for the time being, The ciphertext and the tenth mutually exclusive or calculated data of the SubKey are called decrypted input data. It should be noted that, due to the characteristics of mutual exclusion or operation, the operation of InvAddRoundKey is the same as AddRoundKey. Therefore, in the following description, the two will no longer be separated and will be collectively referred to as AddRoundKey. When performing a loop, the "inverse key change" (hereinafter referred to as "InvKeyExpansion") operation in the loop will generate the previous SubKey based on the next SubKey, that is, the first time the loop is executed according to the tenth SubKey The ninth SubKey is generated, and the eighth SubKey is generated according to the ninth SubKey during the second loop, and so on. The decrypted input data is then subjected to "inverse sub-bit operations" (hereinafter referred to as InvSubBytes), "inverse column transfer operations" (hereinafter referred to as InvShiftRows), and "retrograde mixed operations" (hereinafter referred to as InvMixColumes), and then the current SubKey (cause InvKeyExpansion has been executed, so at this time, the ninth SubKey) is mutually exclusive ORed, and the above steps are performed again until the end of the loop. After the loop is over, the system will perform operations such as InvSubBytes, InvShiftRows, and AddRoundKey to complete the decryption step. As mentioned above, there are five main data processing steps in the process of encryption and decryption, which are AddRoundKey, KeyExpansion, SubBytes, ShiftRows, and MixColumes. These processing procedures will be described below-it should be noted that due to the above information The processing steps are intertwined. The output data (out) of the previous step is the input data (in) of the next step. To simplify the diagram and facilitate the description, see 1235582. The input data and output data will not be defined separately. Name; In addition, all the plus signs (+) in the following represent mutually exclusive OR operations, not pure addition operations, and will not be repeated hereafter. The data type of the plaintext, ciphertext, and secondary key is a 4x4 matrix. Each element in the matrix is 8 bits. Therefore, all three are 128-bit data length. Please refer to Figure 1, which shows the data processing situation of AddRoundKey. Obviously, this step is to obtain the output data (out) after the mutual exclusion or operation of the input data (in) and the secondary key. The calculation can continue to be processed on the output data. It can be known from the principle of mutual exclusion or basic operation that after mutually exclusive or operation of the output data and the secondary key, the input data can be pushed back. Please refer to Figure 2 for the data processing situation of ShiftRows. This step is to regularly shift each column of input data (such as the output data after AddRoundKey operation) by several bits, such as shifting the first row to the right by 0B (Byte), and the second row. Shift 1B to the right, shift the third column to the right 2B, shift the fourth column to the right 3B, and then output the result. If this is done during encryption, the InvShiftRows performed during decryption must be reversed, that is, the first column is shifted to the left by 0B, the second column is shifted to the left by 1B, and the third column is shifted to the left. Shift 2B, shift the fourth column to the left by 3B. Please refer to Figure 3, which shows the data processing situation of MixColumns / InvMixColumns. The execution method of MixColumns is to multiply each row in the input data (for example, the output data after ShiftRows operation) to obtain the output data; otherwise, if the output data is subjected to an inverse matrix operation, it will be reversed back. Rotate the data, that is, the matrix used to execute InvMixColumns and MixColumns is the inverse of each other. Please refer to Figure 4, which shows the situation in the SubBytes / InvSubBytes asset department. The main computing unit in SubBytes is called S-Box. The input data (in the figure is marked as X in Formula 1) and the output data (1235582 in Canton 1 is labeled as out for each SB0x), that is, Y) in the formula 1 is all data of lbyte (8bits), 1 y = Μ * multiplicative_inverse (x) + c · (1)

f Thai 1X

II M

11 cu11 1x 11 n-JU n-JU 1X 11 1x 1X nnju ghwu c 「v1i li 11 11 11 o OJU Ί * -11 1X li il c-. Nlu 11 11 11 1i 11 ο o 11 li 1-x 1x T1 o τ—H lx I- < ii nlu CUJ of *-*! 丄 1X 1X Π—u [η0 1-i 11 c

τ I -1 II where multiplicative-inverse is a very complex function, so most of the methods are directly solved by look-up table method, so there will be y = Table-A (x) Looking at the table data, Table-A is the sub-bit table in the figure, which is also the S-BOX table in the AES standard. Similarly, it is required to have an inverse s-Box to complete the InvSubBytes function, so another table x = Table-B (y) is required, and Table-B is the inverse bit table in the diagram, which is also the AES standard. inv-S-B0X table. However, these two watches are bound to occupy a large amount of hardware space, which is quite uneconomical in use. As mentioned above, in addition to the different execution processes of traditional encryption and decryption processing steps, the inverse function is also a problem, especially the following

InvSubBytes is a function of two lookup tables. Under the design requirements of high efficiency, it will use a large amount of memory space (2 * 16 * 256 * 8 steps); In addition, 1 (: 〇1_5 and InvMixColunms two function content is If the multiplication of a matrix cannot be

Effective integration is bound to consume considerable computing resources. It is a module that needs to be considered and redesigned. [Summary of the Invention] In view of this, the purpose of the present invention is to provide an integrated circuit module capable of supporting advanced encryption and decryption devices, and selectively perform sub-bit operations 1235582 and inverse sub-bit operations. (SubBytes / InvSubBytes operaton), using shared correspondence table data to save computing resources while performing calculations. With a simplified circuit structure, it can meet the requirements of both the reduction of overall critical paths and low complexity. So that the speed of this computing module can be improved. Another object of the present invention is to provide a round module capable of supporting advanced encryption standards, integrating sub-bit operations and inverse sub-bit operations, ShiftRows / InvShiftRows ) Operations, and line blending / reverse blending operations are equivalent to the same module, which is used to selectively perform a round operation of encryption and decryption (a round); by using this loop operation module, the encryption and decryption device of the advanced encryption standard The hardware implementation can meet the requirements of high computing speed and low complexity. According to the above-mentioned object of the invention, the present invention provides an integrated subbytes / invsubbytes (InvSubBytes) computing device capable of supporting Advanced Encryption Standard (AES), which is used for an input data code. After performing sub-bit and inverse-bit operations selectively, outputting a desired output data code, the integrated sub-bit / inverse-bit computing device includes: a first matrix operator for responding to the input data The code performs a first matrix operation, and outputs the result of the first matrix operation. A first exclusive-OR operation module is used to perform a first mutually exclusive OR operation on the input data code, and Output the result of the first mutex or operation; a first multiplexer, connected to the first matrix operator and the first mutex or operation module, the first multiplexer is based on a selection signal, Choose an output from the result of the first matrix operation and the result of the first mutex or operation to use as the output data code of the first multiplexer; a table lookup computing device, and the first multiplexer Device to connect Based on the output data code of the first multiplexer, a table lookup data code is output after performing a table lookup operation; a second matrix operator is used to perform a second matrix operation on the table lookup data code and output 1235582 The result of this second matrix operation; __ The second mutex or operation module is used to perform the second lookup data code—the second mutex or operation, and output the result of the second mutex or operation. Two multiplexers, which are pure with the second matrix operation module and the second mutually exclusive or carrier module. The second multiplexer is based on the selection signal from the result of the second matrix operation and the second mutual operation. The result of the exclusive OR operation is selected or outputted as the output data code of the second multiplexer. Among them, the output data code of the second multiplexer is the desired output data code. The integrated sub-bit / inverse bit-computing device performs sub-bit operations when the selection signal represents the need for encryption. The first multiplexer selects the result of the first mutex or operation. The second multiplexer selects the result of this second mutex or operation. When the selection signal indicates that decryption is required, the integrated sub-bit / inverse bit-computing device performs inverse-bit operations. The first multiplexer selects the result of the first matrix operation, and the second multi-bit The worker selects the result of the second matrix operation. According to another object of the present invention, the present invention proposes a round module capable of supporting an advanced encryption standard, which is used to selectively perform an encryption / decryption operation based on an input data code and a key to generate an output. Data code, this loop computing module includes: a mutex or gate, used to mutually exclusive or calculate the input data code with the current key to generate the mutex or gate output code; a first multiplexer Coupled with this mutex or gate, the first multiplexer has a first input terminal and a second input terminal. The first input terminal is used to receive a data code to be decrypted and the second input terminal is used to Receive the output code of the mutex or gate, wherein the first multiplexer outputs the first multiplexer between the data code to be decrypted and the output code of the mutex or gate according to a selection signal Output code; one-bit / inverse-bit computing device, connected to this first multiplexer 'to perform sub-bit / inverse-bit operation on the output code of this first multiplexer and output a substitute Operation output code; ShiftRows / inverse column The 1235582 (InvShiftRows) computing device is coupled to this bit / inverse bit computing device to perform a column shift / inverse column shift operation on this substitute operation output code and output a shift operation output code; The second multiplexer is connected to this mutually exclusive OR gate and the column shift / inverse column shift computing device. The second multiplexer has a first input terminal and a second input terminal. The first input terminal Is used to receive the output code of the mutex or gate and the first input terminal is used to receive the output code of the transfer operation, wherein the second multiplexer is output from the mutex or gate according to the selection signal Choose one of the code and this shift operation output code to output the output code of this second multiplexer; a line of hybrid / reverse line hybrid computing device is coupled to this second multiplexer to use this second multiplexer The output code of the processor performs a line blending / reverse blending operation and outputs a blending output code; a third multiplexer is coupled to the second multiplexer and the line blending / reverse line hybrid computing device, and the third multiplexer The device has a first input terminal and a second input terminal. The first input terminal is The second multiplexer receives the output code of the first multiplexer and the second input terminal receives the mixed operation output code. The third multiplexer is based on an encryption and decryption determination signal from the second multiplexer. The output code and the mixed operation output code are output alternately, and the output code of this second multiplexer is the data code to be decrypted; a fourth multiplexer, this third multiplexer, and this row The transfer / inverse transfer computing device is coupled. The fourth multiplexer has a first input terminal and a second input terminal. The first input terminal is used to receive the transfer operation output code and the second input. The terminal is used to receive the data code to be decrypted, wherein the fourth multiplexer is to switch between the operation output code and the data code to be decrypted according to the selection signal and output the output of the fourth multiplexer Code; and a fifth multiplexer coupled to this fourth multiplexer and this mutually exclusive or gate, this fifth multiplexer has a first input terminal and a second input terminal, the first input terminal is Used to receive the output code of the fourth multiplexer and the second input terminal is used to receive the mutex or The output code, in which the fifth multiplexer is output based on a round-of-judgment signal from the output code of the fourth multiplexer and the output code of the mutex or gate. The output code of the multiplexer 12 1235582; among them, the output code of the fifth multiplexer is the output data code for this. This time bit / inverse bit operation device includes a first matrix operator for performing a first matrix operation on the output code of the first multiplexer and outputting the result of the first matrix operation; A first exclusive-OR operation module, configured to perform a first exclusive-exclusive OR operation on the output code of the first multiplexer, and output the result of the first exclusive-exclusive OR operation; a first A selector coupled to the first matrix operator and the first mutex or operation module. The first selector is based on the selection signal, and the result of the first matrix operation and the first mutex or The result of the operation selects one of the two outputs as the output code of the first selector; a table lookup computing device is coupled to the first selector to perform a check based on the output code of the first selector After the table calculation, a table lookup data code is output; a second matrix operator is used to perform a second matrix operation on the table lookup data code and output the result of the second matrix operation; a second mutually exclusive or operation mode Group for performing a second interaction on this table lookup data code OR operation, and output the result of the second mutually exclusive OR operation; and a second selector coupled to the second matrix operator and the second mutual exclusion OR operation module, the second selector is based on this The selection signal is output from one of the result of the second matrix operation and the result of the second mutually exclusive OR operation as the alternative operation output code. According to another object of the invention, the present invention provides an encryption / decryption device of an advanced encryption standard for selectively performing an encryption or decryption operation of the advanced encryption standard on an input data code to output an output data code. The device includes: a loop computing device, coupled to this key storage device, for writing a loop operation that is required to perform encryption and decryption selectively, according to the input code and one input to one of the loop computing devices. The key is used to output an output code of a cyclic operation; a key replacement operation device is coupled to this cyclic operation device, and is used to selectively generate one of encryption and decryption, the golden input required for the cyclic operation, The key this time is based on the input of one of the known secondary keys of the key-change operation device. This is waiting for 13 AJU 11 1i 11 11 11 nl ^ 1X IX il 1i 11 11 11 11 11 o 1X 1X τ <-* i * o f- * 1X, ▲ 1 丄 nlu o '1 1i 1i 11 Au 1i 11 11 IX Au 11 11 11 1i Aw 1i 1i 1i 1i

τ I-1 1X 1235582 deciphers the secondary key; and a key storage device, which is coupled to this loop computing device and this time key replacement computing device, for temporary storage and distribution of the secondary key, so that The key replacement computing device and the loop computing device perform loop computing. In addition, this cyclic operation device includes a primary bit / inverse bit operation device, and its structure is as described above. In addition, the key storage device receives the cyclic operation output code and the key output by the key replacement operation device; the known secondary key of the key replacement operation device and the input by the cyclic operation device The code is output by this key storage device. The gold record storage device temporarily stores the input data code, allocates and temporarily stores the gold record, receives the output of the loop computing device and the key replacement computing device for cyclical bad luck, and outputs the output data code. In order to make the above-mentioned objects, features, and advantages of the present invention more comprehensible, a preferred embodiment is hereinafter described in detail with reference to the accompanying drawings. [Embodiment] Embodiment 1 Embodiment 1 mainly integrates SubBytes operation and InvSubBytes operation, and realizes it by using appropriate hardware. Before explaining, let's review the formula (1) again: y = Μ * multiplicative "nverse (x) + c · (1) If two separate tables are used for encryption and decryption, it will take a lot of hard work. Body space, so we continue to derive from equation (1):

14 1235582 χ = multiplicative_inverse—1 (Μ — * (y + c)) · (2) Because multiplicative__inverse () and multiplicative_inverse_1 () are equal, equation (2) can be rewritten as: x = mul tipi icat ive a inverse (M-1 * (y + c)) · (3) After deriving from the inverse matrix operation, we get: Μ · = Μ · 1 =

(4) / 01010010 \ 00101001 10010100 01001010 00100101 10010010 01001001 Ι \ ΐοιοοιοο / 1 So formula (3) can be written as: x = multipi icative—inverse (M '* (y + c)) · (5) Equation 1) and Equation (5) We find that two equations can share the same correspondence table (ie, multipl icative_inverse〇), so we can integrate S-box and inverse S-box to reduce hardware requirements. Please refer to FIG. 5A, which shows a block diagram of an integrated sub-bit / inverse-bit computing device that uses the same correspondence table to implement an Advanced Encryption Standard (AES). As shown in the figure, the integrated sub-bit / inverse sub-bit computing device 500A includes a matrix operator 510, a multiplexer 520, a multiplication inverse operation device 530, a matrix operator 540, and a multiplexer 550, in which the multiplication is reversed The computing device 530 may perform the operation of data = inultiplicativejnverse (addr), which is generally implemented by using a table lookup method, that is, outputting the table lookup data according to the input data. The matrix operator 510 is responsible for performing (in + c) * M, and the matrix operator 540 is responsible for performing data * M + c. The types of the matrix μ and M-1 are as described above. When the SubBytes operation needs to be performed, the selection signal ec is set to a certain value, 15 1235582, such as 1, to indicate that an encryption operation is required. At this time, the input data in is fed into the multiplication inverse computing device 530 via the multiplexer 520. After the table lookup, the inverse computing device 530 outputs the table lookup data data (ie, multiplicative_inverse (in)). Then the matrix operator 540 performs an out = data * M + c operation on the table lookup data, and the result is selected and output by the multiplexer 550; thus, the SubBytes operation is completed.

On the other hand, when the InvSubBytes operation needs to be performed, the selection signal ec is set to another fixed value, such as 0, to indicate that a decryption action is required. At this time, the input data in is fed into the matrix operator 510 to perform the (in + c) * Mf operation, and the result of the operation is fed into the multiplication inverse operation device 530 through the multiplexer 520 to look up the table. Finally, it is output via the multiplexer 550; thus, the InvSubBytes operation is completed. Obviously, the integrated sub-bit / inverse bit-computing device 500A has the functions of S-box and inverse S-box at the same time, but only one table is needed.

The hardware requirements of the Subbytes and InvSubBytes functions have been reduced to 57%, which is a very significant improvement. Next, we can make some improvements to the multiplexer 550 path at the right end of Figure 5A. The first step is to output the previous stage below the input of this multiplexer 550.

For the direct connection part, you can insert a computing module X = multiplicative_inverse (M ”* (y + c 丨 丨)) (5.1) where y is input and X is output,

/ 1 0000000 \

01000000 00100000 00010000 00001000 00000100 00000010 0000000 1/1 but does not affect the calculation result of Figure 5A. Next we define a new calculation module: 16 1235582 x = multiplicative-inverse (M (e) * (y + c (e) )) (5 · 2) where M (e) = / leeeeOOO \ (0) 0 1 eeee 0 0 e OOleeeeO e 000 1 eeee c (e) = 0 eOOO 1 eee 0 eeOOO 1 ee 0 eeeOOO 1 ee \ eeee0001 / By replacing the multiplexer 550 and matrix operator 540 in the right end of Figure 5A with this computing module, we can get a new Modified Inverse-optional S-box module. The above-mentioned improvement of the circuit structure of FIG. 5A is considered from the perspective of reducing the number of components, and has not significantly reduced the complexity of the critical path and module components. Next, according to the technical idea of the present invention, we further improved the design of the integrated sub-bit / inverse bit-computing device 500A to achieve the result of reducing the complexity of the critical path and module components, and allowing the overall encryption and decryption. The operation speed is increased. First, 'we reverse the order of + c and 1 on the left of Figure 5A, which is (in + c) * M ~ l = in * M_1 + c ^ M-1-in ^ M'1 + c5 where c '= c * M-1; Then, in the AES standard, the + sign represents the x〇R operation of the bit, so: in = in + c, + c, By the above two methods, Figure 5A can The structure of the integrated sub-bit / inverse sub-bit computing device 500B of Figure 5β is changed, but its overall operation and result remain unchanged. Then, we will use the same + c before the multiplexer on the left of Figure 5B to compute Move to the back of the multiplexer, and the bottom right path in Figure 5B, because 17 1235582 data = data ^ M ^ M-1 5 We can insert the * M_1 operation in the bottom right path in Figure 5B, which also does not affect The calculation result, so you can get the integrated sub-bit / inverse bit arithmetic device 500C shown in Figure 5C; Similarly, the two operations behind the multiplexer on the right in Figure 5C are moved to the front of the multiplexer and multiplied. By operating between the inverse operation devices 530, an integrated sub-bit / inverse bit operation device 500D circuit as shown in Fig. 5D can be obtained. Finally, we will center the 5D picture. Three arithmetic output operation of the results shown within the dashed box calculated in advance, and stored at a new lookup table, as shown in the final architecture of FIG. 5E. Figure 5E is an integrated sub-bit / inverse bit-computing device 500E that supports advanced encryption standards, and is used to selectively perform sub-bit and inverse sub-bit operations on an input data code in and output one. The desired output data code out, this integrated sub-bit / inverse-bit computing device 500E includes: a first matrix operator 561, a first exclusive-OR operation module 565, and a first multiplexer 520. Table lookup computing device 590, second matrix computing unit 571, second mutex or computing module 575, and second multiplexer 550. The first matrix operator 561 is configured to perform a first matrix operation on the input data code in, such as the operation in this example, and output a result of the first matrix operation. A first exclusive-OR operation module 565 is configured to perform a first exclusive-exclusive OR operation on the input data code in, such as + c 'operation in this example, and output the first exclusive-exclusive OR operation. The result. A first multiplexer 520 is coupled to the first matrix operator 561 and the first mutex or operation module 565. The first multiplexer 520 is based on the selection signal ec and the result of the first matrix operation since And the output of the first mutex or operation is selected as an output data code of the first multiplexer. The table lookup calculation device 590 is coupled to the first multiplexer 520, and is configured to output a data code according to 1235582 of the first multiplexer, and output a lookup table data code data after performing a table lookup operation. The second matrix operator 571 is configured to perform a second matrix operation on the table lookup data code data, such as the * ΛΓ1 operation in this example, and output the result of the second matrix operation. A second mutex or operation module 575 is used to perform a second mutex or operation on the data for the table lookup data code, such as + c operation in this example, and output the result of the second mutex or operation. The second multiplexer 530 is coupled to the second matrix operation module 571 and the second mutually exclusive OR operation module 575. The second multiplexer 550 is operated from the second matrix according to the selection signal ec. Choose one of the result and the result of the second mutex or operation as the output data code of the second multiplexer; where the output data code of the second multiplexer is the desired output data Code out. The integrated sub-bit / inverse bit computing device 500E performs sub-bit operations when the selection signal ec represents encryption. The first multiplexer 520 selects the first mutually exclusive OR operation. As a result, the second multiplexer 550 selects the result of the second exclusive OR operation. When the selection signal ec indicates that decryption is required, the integrated sub-bit / inverse bit operation device 500E performs an inverse bit operation. The first multiplexer 520 selects a result of the first matrix operation. The second multiplexer 550 selects a result of the second matrix operation. In the first embodiment, the first matrix operation and the second matrix operation are substantially the same, that is, the * M_1 operation. Moreover, the first mutex operation includes an operand, c 'operand, and the value of this operand is based on the first matrix operation (such as NΓ1 operation) and the second mutex operation (such as + c operation) The winner. Furthermore, the look-up table operation module 590 includes a look-up table based on a multiplication inverse operation (mu 11 iρ 1 icat ive inverse operation), the first mutual exclusion or operation, and the first matrix operation The winner. In this example, the lookup table is based on + c ', Mulplicative_inverse (), and * M operations. Finally, we compare the structure of Figure 5E with the original Figure 5A. There are two improvements: 19 1235582: (1) The overall critical paths have been shortened, and the speed of adding circuits can be increased; (2) * M_1 operation is less complex than operation, because the number of element 1 in matrix Γ1 is only 3/5 of that of element 1 in matrix M, so the complexity can also be reduced; combining these two advantages, we can get better than the 5A The architecture of the figure is faster and lower complexity integrated sub-bit / inverse bit computing device 500E. Embodiment 2 Embodiment 2 provides an integrated encryption and decryption algorithm and the implementation on a hardware using a loop operation. The encryption and decryption operation flow is: if (ec == 0) for (i = 0; i <Nr; i ++)

Inv—Opt—keyexpansion (key, 1); // inverse key for (1 = 0; i < = Nr; i ++) {addroundkey; if (i == Nr) break;

Inv—Opt—keyexpansion (key, ec); if (ec == l) {Inv—Opt_subbytes (ec);

Inv_Opt_shi ftrows (ec); if (i < (Nr-l)) Inv—Opt—mixcolumns (ec);} else {if (i > 0) Inv—Opt—mixcolumns (ec); Inv_Opt_subbytes (ec);

Inv—Opt_shi ftrows (ec); 1235582 Among them, Nr is the number of rounds (number of rounds), when performing 128-bit AES encryption and decryption, the value of Nr is 10; when performing 192-bit and 256-bit When AES encryption and decryption, Nr is 12 and 14 respectively. Next, please refer to FIG. 9, which illustrates a cyclic computing device capable of supporting an advanced encryption standard according to the second embodiment of the present invention to support the encryption and decryption calculation process of the above-mentioned advanced encryption standard. The loop computing device 900 includes a mutually exclusive OR gate 90, a sub-bit / inverse bit-bit computing device 95, a column shift / inverse column shift computing device 97, a row blending / inverse blending computing device 99, and several multiplexers 910 , 920, 930, 940, and 950, in which the implementation method of the sub-bit / inverse sub-bit computing device 95 is as shown in FIG. 5E. When an encryption operation is required, the selection signal ec is set to 1 to change the operation configuration of the loop computing device 900 to perform an encryption operation. First, the input data code in (plaintext at this time) and a SubKey are fed into a mutex OR gate 90 to perform the AddRoundKey operation and then output the result. Then, via the multiplexer 910, the result of this AddRoundKey operation is fed to the sub-bit / inverse bit-bit operation device 95 to perform sub-bit operations. Then, the result of the sub-bit operation is fed to a column transfer / inverse column transfer operation device 97 to perform a column transfer operation. After that, the result of the column transfer operation is fed to the row blending / inverse row blending operation device 99 via the multiplexer 920 to perform the row blending operation. The data before and after the mixed operation are fed to the input terminal (0) and input terminal (1) of the multiplexer 930 respectively. The multiplexer 930 selects one of the two input data and outputs it according to the "encryption and decryption determination signal". . The encryption / decryption determination signal corresponds to the above-mentioned encryption / decryption algorithm. For 128-bit AES encryption / decryption, Nr is 10, and this signal can be generated according to the following judgment formula or implemented by circuit : ~ ((Ec & (i = 4'd9)) | (~ ec & (i == 4'd0))) So when the encryption and decryption judgment letter is 1, the multiplexer 930 will mix the lines / reverse 21 1235582 The output data of the different device 99 is output ®. When Tianjia decrypts it, the multiplexer 930 judges the rounds of the multiplexer 920 to confirm the investment. For convenience of explanation, See, hereby the output data of the multiplexer 930 is referred to as the to-be-resolved λ〇 ^ solution in ... 93. As shown in the figure, the data to be decrypted 93 is fed into the multiplexer 910 at the same time, and the input terminal (1) of the multiplexer 940 and the multiplexer 940, at this time the multiplexer 940 can : a: Luoshan s, output to the input terminal (0) of the multiplexer 950. The input terminal of the multiplexer 95G does not receive the output data of the mutex or gate 9 (), and the multiplexer 950 is based on " Judgment signal for each round "select from two input data-output. The round-trip judgment signal is generated by judging whether the number of loop operations has reached Nr. In this example, it can be recorded as (i = 4, dl0). Therefore, when the determination signal of the round is 0, the multiplexer 950 will output the output data of the multiplex state 940, and the output data of the multiplexer 940 will be fed into the loop computing device 900 as the next loop operation (next r). und) input> material code (in). In addition, via Inv_Opt_keyexpansion (key, ec), Key Expansion operation is performed to generate the next SubKey. According to the loop design of the above algorithm, the cyclic nose device 900 repeats the above AddRoundKey

SubBytes, ShiftRows, MixColumns, etc., perform a series of loop operations until i == 4'd9, the multiplexer 930 directly outputs the output data of the multiplexer 920 via the multiplexer 940, multiplexer 950, and As the next input data code in; and then i == 4'dl0, this input data code in and SubKey perform the AddRoundKey operation and are directly output by the multiplexer 950. The encryption process ends, and the result of this output is Ask for the cipher. When a decryption operation is required, the selection signal ec is set to 0 to change the operation configuration of the loop computing device 900 to perform a decryption operation. First, the input data in (in this case, the ciphertext) is fed into the mutex with the SubKey or the gate 90 performs the AddRoundKey operation and then outputs the result. Then, via the multiplexer 920, the result of the AddRoundKey operation is fed to the row mixing / reverse mixing operation device 99 to perform the reverse mixing operation. The data before and after the backward hybrid operation are fed to the other input terminals (0) 22 1235582 and input terminals (1) of the multiplexer, and the multiplexer 930 selects from the two input data according to the encryption and decryption judgment signals. An output, in which the type of the encryption / decryption determination signal is as described above. When the encryption / decryption determination signal is 1, the multiplexer 930 outputs the output data of the line blending / reverse mixing operation device 99; when the encryption / decryption determination signal is 0, the multiplexer 930 outputs the output of the multiplexer 920 Data output. The output of the multiplexer 920 is the data to be decrypted 93. The data to be decrypted 93 can be fed into the sub-bit / inverse bit-operation device 95 through the multiplexer 910 to perform inverse-bit operations, and then perform inverse-bit operations The resulting results are fed into a column shift / inverse column shift computing device 97 to perform a reverse column shift operation and output the results via a multiplexer 940. On the other hand, the multiplexer 950 can select one of the two input data according to the round end judgment signal. When the round end judgment signal is 0, the multiplexer 950 will output the output data of the multiplexer 940. The output data of the multiplexer 940 will be fed into the loop computing device 900 as the input data code (in) of the next round operation. In addition, via Inv_0pt_keyexpansion (key, ec), a Key Expansion operation is performed to generate the next SubKey. According to the loop design of the above algorithm, the loop computing device 900 repeats the above steps of AddRoundKey, InvMixColumns, InvSubBytes, and InvShiftRows, and performs a series of loop operations until i == 4'd9. The output data of the multiplexer 920 is fed into the sub-bit / inverse bit-bit computing device 95 through the multiplexer 910, and the result is then fed into the column shift / inverse-bit shift computing device 97 and is calculated. And the multiplexer 950 to output it as the next input data code in; then i == 4'dl0, this input data in and SubKey are directly output by the multiplexer 950 after the AddRoundKey operation is performed, and the decryption process ends, where , The result of this output is the plaintext requested. Embodiment 3 Based on the above-mentioned loop computing device, we propose the architecture of the AES plus 23 1235582 decryption device according to the present invention to selectively perform the AES encryption or decryption action. Referring to FIG. 10, this AES encryption and decryption device 100, including the secondary key change, loss, μ-like setting 800, loop computing device 900 and key storage device 1100. The key = = = = 1100 includes three memory devices 1110, U20, and 1130. For example, '9 α and w are registers, which are used to store the Data, Key, and ackup key, respectively. Figure 10 shows. Among them, din represents the input, oblique code, and dout 疋 represents the output data code. The gold storage device 1100 is coupled to the loop computing device 900 and the secondary gold wheel altering μ device 800 for temporary storage and distribution of the secondary key, so that the ^ i scale alternate transporting different device 800 and the loop computing device 900 can cycle Operation. The key storage device 1100 provides the input data code in of the loop computing device 900, and receives and temporarily stores the output data code output by the counting device 900 in the memory device 1 丨 10; the gold record storage device 1100 is also used to provide times The key change operation device receives 800 rounds, and the output data code output by the two-person key change operation device 800 is recorded in the recording device 1120. Among them, the output of the gold record change operation device reward is output; the material code is 0Ut. , That is, the subkey, will be fed to the key 俨 of the loop computing device 900 as the secondary key of the loop computing device 900. When f needs to perform the encryption operation, the selection signal eC is set to 1 to change the operation configuration of the Xie Society Device 1000 to perform the encryption operation. In addition, it can be seen from the previous examples: Example 1 and Example 2 that the sub-bit / inverse bit of the loop computing device _ and the loop computing device _ * Xindanyi 1 yuu… device 95 also changes its operating configuration To be added: 4 cycle% transport different device _ the beginning of the end, that is, used to enter the current encrypted password of the loop. 111 stands for plaintext ’and dooUt passes through the hall encryption and decryption device 1000

To perform the decryption operation, let the selection signal α be. In order to perform the decryption operation, the AES is complemented by the operation of the encryption and decryption device 1000. At this time, din represents the secret 24 1235582 text, and dmit is the plain text decrypted by the AES encryption and decryption device ι000. Because the order of the subkeys used for encryption or decryption is just the reverse, it is necessary to make a backup of the subkeys before the encryption and decryption starts, so that the encryption and decryption can be performed smoothly. The backup rules for subkey are shown in Table (1). When the action to be performed (encryption or decryption) is the same as the previous action, perform Reg: Key < = Reg: KeyU; otherwise, perform Reg: KeyU < = Reg: Key. The change of the subkey in each round operation in the key register is shown in Table (2), where AES-128 is taken as an example. In this way, after each encryption and decryption is completed, sub_keyO and sub_keylO will exist in two key registers. The next time you want to encrypt or decrypt, you can easily select the required sub key. Table (1): Subkey backup rules start (Key transfer process) Current_ec == previous_ec Reg: Key < = Reg: KeyU Current_ec! = Previous_ec Reg: KeyU < = Reg: Key Table (2): In each round operation (round), the sub key changes in the key resigter. Encryption and decryption loop operation Reg: Key Reg: KeyU Reg: Key Reg: KeyU start (key backup) sub_key_0 sub_key_0 sub_key_10 sub_key_l0 1 sub_key ”sub_key_〇sub-key—9 sub_key ”0 2 sub_key_ 2 sub_key _ ^ _ sub_key_8 sub_key” 0 3 sub_key_3 sub_key_〇sub_key__7 sub_key ”0 4 sub_key_4 sub_key_0 sub_key One 6 sub one key '' 0 25 1235582 5 sub_key-5 sub_key one 0 sub_key_5 sub_key_10 6 sub_key-6 6 sub_key_0 sub_key_4 sub_key_10 7 sub one key one 7 sub_key one 0 sub_key_3 sub_key one 10 8 sub one key one 8 sub_key_0 sub_key_2 sub_key_10 9 sub_key_9 sub_key_0 sub_key_l sub_key_10 10, (end) sub_key_10 sub_key_0 sub_key_0 sub_key_10 Next, we will refer to the row blending / reverse blending computing device 99 in Figure 9, and The secondary key replacement operation device 800 proposes a feasible implementation manner. In this example, the line mixing (MixColumns) operation and the inverse mixing (InvMixColumns) operation are integrated and the appropriate hardware is used to implement the line mixing / inverse mixing operation device. In the operation of MixColumns and InvMixColumns, the main operation of the two functions is · outx = [2 3 1 1] * [abcd] T (6) outy = [14 11 13 9] * [abcd] T (7) Mathematically we do the following disassembly: outx = 2 (a + b) + b + (c + d) (8) outy = 4 (2 (a + b) + 2 (c + d) + (a + c)) +2 (a + b) + b + (c + d) · (9) The calculation process of equations (8) and (9) is shown in Table (3). Find outx, and then add 5 steps to get outy, so the hardware of the previous 5 steps can be shared. The designed hardware is shown in Figure 6. The overlapping parts of the two functions are integrated. Reduce unnecessary hardware waste. Step operation method 1 wl = a + b 26 1235582 2 w2 = a + c 3 w3 two c + d 4 w4 = 2 * wl 5 outx = b + w3 + w4 6 w5 = 2 * w3 7 w6 = w2 + w4 + w5 8 w7 = 2 * w6 9 w8 = 2 * w7 10 outy = w8 + outx Table (3)

Please refer to FIG. 6, which illustrates a block diagram of an integrated line hybrid / reverse line hybrid computing device supporting an advanced encryption standard according to the present invention. As shown in the figure, the integrated line hybrid / retrograde hybrid computing device 600 includes a plurality of mutually exclusive or gates and multipliers. The mutually exclusive or gates are used to mutually exclusive or calculate two input data and output. Input data is multiplied by 2 and output. To simplify the description, the operation of the integrated line hybrid / reverse line hybrid computing device 600 is described below.

The operation of MixColumns and InvMixColumns is a matrix multiplication operation for each row of data in the input data. If the data type of the input data is a 4x4 matrix, there will be 4 element data in each row of data. For the sake of convenience, these four element data can be labeled as data (a), data (b), data (c), and data (d) in sequence, and respectively correspond to a, b, c, and d in the drawing. Please also refer to table (3) at the same time, first explain the calculation steps of MixCo 1 umns. · Step 1 can use the mutex or gate 61 to mutually exclusive or calculate the data (a) and the data (b), and then the data W1 27 1235582 = ^ To be realized. Step 2 can be implemented by using the mutex or gate 62 to output the data (2) after the mutex or operation :: is mutually exclusive. Step = OR gate 63 performs mutual exclusion or operation on data ⑹ and data 再 and then outputs it to realize. Step 4 can be implemented by using the multiplier 621 to multiply the mutually exclusive or extracted data W1 and then output the data W4. In Step 5, Niu Beibei can first use the mutex or gate 64 to mutually exclusive or calculate with the data W3 and then use the mu = or gate 65 to combine the output of the mutex or gate 64 with the output of the multiplier 621输出 Mutual exclusion or output after operation, where the output data of the mutex or gate 65 is the result of the integrated mixing operation of the i / hybrid / retrograde hybrid operation device for the row data. The following describes the data processing steps when performing the InvMixColumns operation: The first five steps of the I_ixCol_s operation are the same as the MixC0__ operation. Step 6 The output data of the mutex or gate 63 can be multiplied by a multiplier 622. Multiply the data by W5 Out to achieve. In step 7, the data 或 and the data W5 are mutually exclusive or calculated by using the mutex or gate 66, and then the mutually exclusive or idle 66 is used to mutually rotate the data of the mutex or interval 66 with the output data W4 of the multiplier 621 The data W6 is output after the exclusive OR operation. Step 8 can be achieved by multiplying the mutually exclusive or indirect π output data W6 by 2 and then outputting the data W7; step 9 can be performed by using the multiplier 624 to multiply the output data of the multiplier 623 by W7 $ 2. Output. In step 10, the output of the mutex or gate 65 and the data W8 are mutually exclusive or calculated by using the mutex or gate 68. The output data of the mutex or ㈣8 is an integrated line hybrid / reverse line hybrid computing device 6 〇〇 The results of backward blending operations on row data. It should be noted that, since the first five steps can be shared by MixClumns and InvMixColunms, unnecessary hardware waste can be greatly reduced. This example is to provide a sub-golden record change operation device, which can be entered according to 28 I 3535

The SubKey determines whether the output is the previous SubKey or the next SubKey. The currently entered SubKey is called a known secondary key, and the SubKey to be output is called a pending secondary key. First, the operation principle will be explained. Please refer to Figure 7A, which shows a schematic diagram of the data processing method of the next subkey output according to the input SubKey. The current SubKey is recorded as SubKey (i), and the next SubKey is recorded as SubKey (i + 1);

SubKey's data type is a 4x4 matrix, so it has 4 sets of row data, ^ [3: 〇] is the row negative (1), k [7: 4] is the row data (2), and: 8] is the row data (3), k [15:12] is a data block, and each line contains 4 elements. If the size of each element is 8 bits, the length of the SubKey is 128 bits. First, the row data (4) of SubKey (i) is converted into special row data 752 by the row data converter 75 and output. The action of hitting the data converter 750 will first make the input data a rotate byte right action. The _th byte will perform an exclusive OR operation with a round constant RCON [i], and then output the result of 4 bytes. In terms of the round constant Rcon [i], 1 is the number of rounds, and different rounds have different values of Rcon 'according to the definition of the AES standard: Rcon [0;] = 1, Rcon [i] = Xtime (Rcon [ i-1]). Then, the special line data 752 and the SubKey (i) line data (1) are mutually exclusive or calculated by the mutual exclusion or gate 71 to obtain the SubKey (i + l) line data (1). Obviously, the row data of SubKey (i) (2) and the row data of SubKey (i + l) (1) can be obtained by performing a mutual exclusion or operation by using a mutex or gate 72. Data (2), row data of SubKey (i) (3) and row data of SubKey (i + l) (2) After the mutex or operation is performed by the mutex or gate 73, the SubKey (i + l) can be obtained. Row data, row data of SubKey (i) (4) and row data of SubKey (i + l) (3) After mutual exclusion or operation by mutual exclusion or gate 74, the row data of SubKey (i + l) can be obtained (4). Please refer to FIG. 7B for a schematic diagram of the data processing method of a SubKey output based on the input SubKey. First of all, the 3 Shan! ^ 7 (丨 +1) row data (3) 29 1235582 and the SubKey (i + l) row data (4) use a mutex or gate 74 to perform a mutex or operation to obtain SubKey (i) (4), and then convert the SubKey (i) row data (4) to the special row data 752 via the bank data converter 750, and then feed it into the exclusive OR gate 71 and link with the SubKey (i + l) row data (1) Perform a mutually exclusive OR operation to obtain the row data (1) of SubKey (i). Obviously, the row data of SubKey (i + l) (1) and the row data of §ubKey (i + i) (2) can be obtained by performing a mutual exclusion or operation by using a mutex or gate 72. Row data (2), Row data (2) of SubKey (i + l) and Row data (3) of SubKey (i + l) (3) After the mutual exclusion or operation is performed by a mutex or gate 73, SubKey (i) can be obtained Row data (3) 〇 Next, please refer to FIG. 8, which shows a block diagram of a secondary key update operation device provided according to the present invention. The secondary key replacement operation device 800 includes a row data converter 750, a plurality of mutually exclusive OR gates, and a plurality of multiplexers. The input data h is the current SubKey (that is, the known secondary key), and the output data 0ut is the previous or next SubKey (that is, the secondary key to be resolved). When the selection signal ec is 丨, the secondary key to be resolved is For the next SubKey, when the selection signal ec is 0, the key to be solved is the previous SubKey. The sub-golden surplus replacement computing device 800 includes mutually exclusive OR gates 71, 72, 73, 74, multiplexers 710, 720, 730, 740, and row data converter 750. Each multiplexer has an input terminal (0) and The input terminal (1) is used to select and output the two components according to the value of the selection signal ec. The connection relationship between the components is shown in the figure. The data of the known secondary key (1) is fed into the mutex OR gate 71 and the input (0) of the multiplexer 710, and the data of the known secondary key (2) is fed into the mutex OR gate 72 With the input terminal (0) of the multiplexer 720, the row data of the known secondary key (3) is fed into the mutex OR gate 73 and the input of the multiplexer 730 ^ (〇), the row of the known secondary key The data (4) refers to the wheel-in end (1) fed into the mutex or gate and multiplexer 740. On the other hand, the output data of the mutex or gate is the row data of the key to be resolved (1) and fed to the input terminal (1) of the multiplexer 710, and the output data of the mutex or gate 72 is the unresolved time. The key data (2) is fed to the input 1235582 of the multiplexer 720 (1). The output data of the mutex or gate 73 is the data of the key to be solved (3) and fed to the multiplexer. The input terminal (1) of 730, the output data of the mutex or gate 74 is the row data (4) of the secondary key to be resolved, and is fed to the input terminal (0) of the multiplexer 740. The following will describe the cases where the secondary key replacement operation device 800 implements KeyExpansion and InvKeyExpansion operations.

KeyExpansion operation (output the next SubKey according to the input SubKey): Let the selection signal ec be 1, the row data of the known secondary key (4) can be converted to the special row data 752 by the row data converter 750 through the multiplexer 740 After the output, then, the special row data 752 and the row data of the known secondary key (1) are mutually exclusive or calculated by the mutual exclusion or gate 71 to obtain the row data of the next SubKey (1). Obviously, the row data (1) of the next SubKey can be fed into the mutex or gate 72 via the multiplexer 710 and mutually exclusive or calculated with the row data (2) of the known secondary key. SubKey's row data (2), the next SubKey's row data (2) can be fed into the mutex or gate 73 via the multiplexer 720 and mutually exclusive or calculated with the row data (3) of the known secondary key The row data (3) of the next SubKey is obtained, and the row data (3) of the next SubKey can be fed into the mutex or gate 74 through the multiplexer 730 and interacted with the row data (4) of the known secondary key. After the exclusive OR operation, the row data of the next SubKey is obtained (4).

InvKeyExpansion operation (based on the input of the SubKey to output a previous SubKey): Let the selection signal ec be 0, and first feed the row data of the known secondary key (3) into the mutex or gate 74 via the multiplexer 730 and compare with The row data of the secondary key (4) are mutually exclusive or calculated to obtain the row data of the previous SubKey (4), and then the row data of the previous SubKey (4) are output by the multiplexer 740 and fed into the row data conversion The converter 750 converts it into special row data 752, feeds it into the mutex OR gate 71, and performs a mutex or operation with the row data (1) of the known secondary key to obtain the row data (1) of the previous SubKey. Obviously 31 1235582 Obviously, the row data (1) of the known secondary key can be fed into the mutex or gate 72 via the multiplexer 710 and be mutually exclusive or calculated with the row data (2) of the known secondary key to Obtain the row data of the previous SubKey (2). The row data of the known secondary key (2) can be fed into the mutex or gate 73 through the multiplexer 720 and performed with the row data of the known subkey (3). Mutual exclusion or operation to get the row data of the previous SubKey (3). The simplified integrated sub-bit / inverse-bit computing device that can support the advanced encryption standard disclosed in the above embodiments of the present invention has the following advantages: When performing SubBytes and InvSubBytes operations, table lookup data can be shared to save computing resources Moreover, because the simplified circuit architecture of the present invention is adopted, the critical path as a whole is shortened, and the complexity of the circuit operation is also low, so the speed can be increased. Therefore, loop computing devices supporting advanced encryption standards and AES encryption and decryption devices can also obtain the above advantages. Furthermore, the loop computing device has integrated MixColumns and InvMixColumns computing hardware to save computing resources. Therefore, on the whole, the computing resources of the AES encryption and decryption device are saved, the circuit complexity is also reduced, and the computing speed can be increased. In summary, although the present invention has been disclosed as above with a preferred embodiment, it is not intended to limit the present invention. Any person skilled in the art can make various changes without departing from the spirit and scope of the present invention. And retouching, so the scope of protection of the present invention shall be determined by the scope of the appended patent application. 32 1235582 [Schematic description] Figure 1 shows the data processing of AddRoundKey. Figure 2 shows the data processing situation of ShiftRows. Figure 3 shows the data processing situation of MixColumns / InvMixColumns. Figure 4 shows the data processing situation of SubBytes / InvSubBytes. FIG. 5A shows a block diagram of an integrated sub-bit / inverse bit-computing device that supports advanced encryption standards. Figures 5B to 5D show the integrated sub-bit / inverse bit-computing device of Figure 5A in accordance with the spirit of the invention. FIG. 5E shows a block diagram of an integrated sub-bit / inverse bit-computing device supporting an advanced encryption standard provided according to the first embodiment of the present invention. FIG. 6 is a block diagram of an integrated line-mixing / reverse-mixing computing device supporting an advanced encryption standard according to the present invention. Figure 7A shows a schematic diagram of the data processing method for the next SubKey based on the input SubKey. Fig. 7B shows a schematic diagram of the data processing method of the last SubKey according to the input SubKey. FIG. 8 is a block diagram of a secondary key update operation device according to the present invention. FIG. 9 is a block diagram of a cyclic operation device supporting an advanced encryption standard according to the second embodiment of the present invention. FIG. 10 illustrates an encryption / decryption device of an advanced encryption standard according to the third embodiment of the present invention. Description of figure numbers 61, 62, 63, 64, 65, 66, 67, 68: Mutual exclusion or gate 71, 72, 73, 74: Mutual exclusion or gate 33 1235582 90: Mutual exclusion or gate 93: Data to be decrypted 95 : Sub-bit / inverse bit-computing device 97: Column shift / Inverse-column-shift computation device 99: Row-mixing / reverse-batch computing device 500A, 500B, 500C, 500D: Integrated sub-bit / inverse Computing device 500E: Integrated subbit / inverse bit computing device 510: Matrix operator 520: Multiplexer 530: Multiplication inverse computing device 540: Matrix operator 550: Multiplexer 561: First matrix operator 565: the first mutex or operation module 571: the second matrix or operation module 575: the second mutex or operation module 590: the table lookup computing device 600 · · integrated line hybrid / reverse line hybrid computing device 621, 622, 623 , 624: multipliers 710, 720, 730, 740: multiplexer 750: row data converter 752: special row data 800: secondary key replacement operation device 900: loop operation device 910, 920, 930, 940, 950: Multiplexer 1000: AES encryption and decryption device 34 1235582 1100: Key storage device 1110, 1120, 1130: Memory device ec: Selection letter

35

Claims (1)

1235582 Patent application scope: 1. An integrated SubBytes / InvSubBytes computing device that supports Advanced Encryption Standard (AES), which is used to input a data code. After performing sub-bit and inverse bit operations selectively, outputting a desired output data code, the integrated sub-bit / inverse bit operation device includes: a first matrix operator for responding to the input data The code performs a first matrix operation and outputs the result of the first matrix operation. A first exclusive-OR operation module is configured to perform a first exclusive-exclusive OR operation on the input data code. And output the result of the first mutex or operation; a first multiplexer coupled to the first matrix operator and the first mutex or operation module, the first multiplexer is based on a selection signal Selecting an output from the result of the first matrix operation and the result of the first mutual exclusion or operation as the output data code of the first multiplexer; a table lookup computing device and the first multiplier Coupling, using According to the output data code of the first multiplexer, a table lookup calculation code is output after performing a table lookup calculation; a second matrix operator is coupled to the table lookup calculation device and is used for performing the table lookup data code. A second matrix operation and outputting the result of the second matrix operation; a second mutex or operation module for performing a second mutex or operation on the table lookup data code and outputting the second mutex The result of the OR operation; and a second multiplexer coupled to the second matrix operation module and the second mutually exclusive OR operation module, the second multiplexer is selected from the second matrix according to the selection signal Choose an output between the result of the operation and the result of the second mutex or operation as the output data code of the second multiplexer; where the output data code of the second multiplexer is the desired one Output data code. 2. As described in item 1 of the scope of the patent application, the whole 36 1235582 combined sub-bit / inverse bit-bit operation with encryption can be used to perform sub-bit operations, where the ^^ selection signal represents the need As a result of the operation, the X multiplexer selects the first mutex or operation multiplexer selects the second mutex or operation ... 3. As described in item 丨 of the scope of patent application, ° Integral sub-bit / inverse element transport, # advanced plus "quasi-integer decryption, inverse bit operation, ㈠ = this, select the signal representative The strong result of the operation is needed. The first multiplexer selects the first matrix, and the 5th first multiplexer selects the social effect of the second matrix operation. 4. · As mentioned in the “Patent Scope ^”, the supportable advancement = standard 5 type 7G / inverse bit operation device, the matrix operation is essentially the same. The first-matrix operation and the second moment 5 as in the middle The whole bit / inverse bit operation device capable of supporting the advanced encryption standard described in item 丨, wherein the first mutually exclusive OR operation includes one of the values of the operands based on the first matrix operation and the second Mutual exclusion or operation 6. The integrated sub-bit / reverse bit-bit computing device capable of supporting advanced encryption standards as described in item i of the patent application scope, wherein the table lookup computing module includes a lookup table, and the pair Silky-multiplication inverse operation (_Post Plus-operation), the first mutex or operation, and the first matrix operation. 7 · — a cyclic operation module (^ und module) that supports advanced encryption standards ) Is used to generate an output data code after selective encryption / decryption operation according to an input data code and a key. The loop computing module includes: a mutual exclusion or gate for connecting the input data code with the After the secondary key is mutually exclusive or different, the mutual exclusion or gate loss is generated. Code; a first multiplexer coupled to the mutex or gate, the first multiplexer has a first input end and a second input end, the first input end is used to receive a data code to be decrypted And the first input end is used to receive the output code of the mutex or gate, wherein the 37th 1235582 is outputted: Γ between the data code to be decrypted and the output code of the mutex or gate according to the 4 selection signal. Option—Rotate out the output code of the first multi-server; it will couple the ^ Γ7 " / inverse: underbit arithmetic device to the multi-server, to perform calculations on behalf of: After performing the sub-bit / inverse bit-calculation operation, the output-replacement output code L-element / inverse button operation device includes: performing a first-moment I-transport = transport difference 11 'for the first multiplex 11 Output the "car", and output the result of the first matrix operation; the second exclusive or (exciusive-0R) operation module, which is used to perform the -first-exclusive or operation on the output code; and Output the first-mutual: A first selector is connected to the -matrix operator and the -mutex or f-module, and the 4th-selector is based on the selection signal, the result of the difference from the first matrix and the first -The result of the mutex or operation selects _ output as the output code of the first selector; a table lookup computing device goes to the -selector to use according to the output code of the -selector , Output _ lookup table operation code-lookup table data code; A first matrix operator for performing a second matrix operation on the table lookup data code and outputting a result of the second matrix operation; a second mutex or operation module for the table lookup data code Performing a second mutex or operation and outputting the result of the second mutex or operation; and a second selector coupled to the second matrix operator and the second mutex or nose module, the The second selector selects a round from the result of the second matrix operation and the result of the second mutex or operation according to the selection signal, and then outputs a code for the alternative operation at first; Λ one column transfer (Shif tRows ) / InvShi f tRows (InvShi f tRows) computing device, connected to the child bit / inverse bit computing device, used to input 38 1235582 output code for column shift / inverse column shift A transfer operation output code is output after the conversion operation; a second multiplexer is coupled to the mutually exclusive OR gate and the column transfer / inverse column transfer operation device, and the first multiplexer has a first input terminal And a second input terminal, the first input terminal is used to receive the mutex or gate Output code and the second input end is used to receive the transfer output code, wherein the second multiplexer is between the output code of the mutex or the gate and the output code of the transfer operation according to the selection signal Choose one to output the output code of the second multiplexer; a one-line hybrid / reverse-line hybrid computing device is coupled to the second multiplexer to perform line-mixing / reverse-mixing operation on the output code of the first multiplexer Output a hybrid operation output code; a third multiplexer, which is connected to the second multiplexer and the line hybrid / reverse hybrid operation device; the second multiplexer has a first input terminal and a second Input terminal, the first input terminal is used to receive the output code of two multiplexers and the second input terminal is to receive the mixed operation output code, wherein the third multiplexer is judged based on one encryption and decryption. Number from the output code of the second multiplexer to the output code of the hybrid operation-and the output code of the third multiplexer is the data code to be decrypted; the fourth multiplexer, and The third multiplexer and the row shifting / reverse row shifting device are connected to each other. There is a first input terminal and a second input terminal, the identification terminal is used for receiving the transfer operation output code and the second input terminal is used for the secret data code, wherein the fourth multiplexer is based on the The selection signal is from two, the input * code and the material code to be solved are selected-the output code of the worker; and the multiplexer 2 multiplexer, and the fourth multiplexer and the mutually exclusive or closed Coupling, the fifth receives the fourth; the first and second ends: ―the second input end ', the first input end is used to output the code, 1 in = code and the second input end is used to receive The mutex or the eighth, 4th and 5th multiplexers are based on a round-of-judgment signal from the 39 582 235582 :: the output code of the multiplexer and the round of the mutex as the output code of the fifth multiplexer ; Horse-to-people selection-turn out, with 8, in the example, the second straight five more: the output code of the device is the round out data code. The ring computing module as described in item 7 of the Shenyan patent, wherein, when the branch is advanced by the # standard, w ^ selects the representative when encryption is needed. M == the computing device performs the sub-bit operation, where Mind = knot h Select this second mutex or operation strictly "Ir": The differentiating u that can support the advanced encryption standard as described in item 7 of the patent scope, where when the selection signal represents the need to perform a solution = inverse The sub-bit arithmetic device performs an inverse sub-bit operation, in which the first selector selects the result of the-matrix-differential operation, and the second selector selects the result of the second matrix. ^^ Please refer to the seventh patent range. The cyclic operation module capable of supporting the advanced encryption standard as described in the above item, wherein the first matrix operation is substantially the same as the second matrix operation. 0 11 · The cyclic operation that can support the advanced encryption standard as described in item 7 of the scope of patent application A module in which the first mutually exclusive OR operation includes an operand whose value is based on the first matrix operation and the second mutually exclusive OR operation. 12. As described in item 7 of the scope of patent application Supports advanced encryption standards A loop operation module, wherein the table lookup operation module includes a lookup table, the lookup table is based on a multiplication inverse operation (muHipiicative inverse 〇pera1 ^ 〇n), the first mutual exclusion or operation, and the first The result of the matrix operation. 13 · —An encryption and decryption device of the advanced encryption standard is used to selectively perform the encryption or decryption of the advanced encryption standard on an input data code to output an output data code. The encryption and decryption device includes : 1235582 A loop computing device, coupled to the key storage device, is used to programmatically perform one of the loop computing operations required for encryption and decryption, according to the input code and one-time gold input to one of the loop computing devices. The key is used to output an output code of a cyclic operation; a key update operation device is coupled to the cyclic operation device, and is used to selectively generate the secondary key required for the cyclic operation when one of encryption and decryption is generated, wherein The secondary key is a secondary key to be solved based on inputting a known secondary key of the secondary key replacement computing device; and a key storage device and the cycle The computing device and the secondary key change computing device are coupled to temporarily store and distribute the secondary key so that the secondary key change computing device and the loop computing device can perform cyclic operations; wherein the loop computing device includes one time Bit / inverse bit operation device, the sub / inverse bit operation device is used to perform bit / inverse operation based on the input code of the loop operation device and one of the input inputs of the second gold loss operation After the bit operation, a substitute operation output code is output. The sub-bit / inverse bit operation device includes: a first matrix operator for performing a first matrix operation on the operation input code and outputting the first matrix operation; The result of the matrix operation; a first mutually exclusive OR (exclusi ve-OR) operation module for performing a first mutual exclusion or operation on the operation input code and outputting the result of the first mutual exclusion or operation; a A first selector is coupled to the first matrix operator and the first mutex or operation module. The first selector is based on the selection signal, from the result of the first matrix operation and the first mutex. OR result Choose one of the two outputs as the output code of the first selector; a table lookup computing device is coupled to the first selector to perform a table lookup operation based on the output code of the first selector Output a lookup table data code; a second matrix operator for performing a 41st 1235582 two matrix operation on the lookup table data code and output the result of the second matrix operation; a second mutually exclusive OR operation mode A group for performing a second mutex or operation on the table lookup data code and outputting the result of the second mutex or operation; and a second selector, the second matrix operator and the second mutual operation The exclusive OR operation module is coupled, and the second selector selects an output from the result of the second matrix operation and the result of the second mutual exclusion or operation according to the selection signal, as the alternative operation output code. ; Wherein the key storage device receives the cyclic operation output code and the secondary key output by the secondary key replacement operation device; the known secondary key of the secondary key replacement operation device and the cyclic operation device The input code is Output by the key storage device; the key storage device temporarily stores the input data code, allocates and temporarily stores the key, receives the output of the loop computing device and the secondary key replacement computing device for loop computing, and outputs The output data code. 14. The encryption and decryption device of the advanced encryption standard according to item 13 of the scope of the patent application, wherein the secondary key replacement operation device is used to obtain the secondary key to be solved according to the known secondary key, wherein the The known secondary key and the pending secondary key are two adjacent secondary keys, and the known secondary key and the pending secondary key each have a row of data (1), a row of data (2), and a row of data (3) and a row of data (4). The key-changing operation device includes: a row of data converter for converting a row of data into a special row of data and outputting it; a mutex or gate (1) for converting The row data of the known secondary key (1) and the special row data are mutually exclusive or calculated and output, wherein the output data of the mutex or gate (1) is the row data of the secondary key to be solved (1 ); A multiplexer (1), coupled with the mutex or gate (1), the multiplexer (1) has a first input terminal and an input terminal (1), the first input terminal is used for In order to receive the row data (1) of the known secondary 42 1235582 key and the input terminal (1) is used to receive the row data (1) of the secondary key to be solved, the multiple The device (1) selects an output from the row data (1) of the known secondary key and the row data (1) of the secondary key to be resolved according to a selection signal; a mutually exclusive OR gate (2) ' It is used to perform mutual exclusion or operation on the row data (2) of the known secondary key and the output data of the multiplexer (1), where the output data of the mutex or gate (2) is the Data of the second key to be solved (2); Xi Gongzu (2), which is connected to the mutex or gate (2), and the multiplexer (2) has an input terminal and an input terminal, The first input terminal of the multiplexer is used to receive the travel data of the known time money, and the input terminal of the multiple η is used to receive the travel data of the time money to be solved. The security device is based on the selection signal of the row data of the known secondary key (2) and the row data of the secondary key to be resolved (2). Select one of the two outputs; The row data of the known secondary key ⑶ and the output data of the multiplex two (2) are mutually exclusive or calculated, and the output data of the mutual exclusion or gate ⑶ is the row of the secondary key to be solved. Information (3); The mutex or gate (3), the multi-portion has an input port and an input port, and the input port of the multi-sensor device CU is used to receive the travel information of J 2 2 (3) and the multiplexer The input terminal of the device ⑶ is used to connect to the line. The multiplexer ⑶ is based on the selection signal-the remaining data of the poor ⑶ and the line data of the second gold record to be resolved. The gate 'is used to output the mutually exclusive OR operation of the known secondary record and the multiplexed output, where // + of the mutual exclusion or gate is the key of the secondary key to be resolved. Line data (4); and the one-to-two rt on the turn-on side is connected to the mutex or indirectly. The multiplexer has-and an input (1), the input of the multiplexer is used. It is used to access 43 1235582 key row data, and the input terminal of the multiplexer is used to receive the recorded data. 'The multiplexer' is the remaining row data based on the selection signal and the waiter. Decipher the row data of the secondary key: 3 between them and the output data of the multiplexer (4) is the row data. ^ As stated in the patent, the encryption and decryption of the advanced encryption standard described in Item 13 is set to ::,:, when the selection signal represents the need for encryption, the sub-bit / inverse ::::: device performs sub-bit Operation, in which the first selector selects the result of the first-exclusion or operation, and the second selector selects the result of the second mutual exclusion or operation. The advanced encryption standard described in item 13 of the patent scope is requested. Encryption and decryption A. When the selection signal represents the need to perform decryption, the sub-bit / inverse: == line inverse sub-bit operation, where the first selector selects the car difference, 'fruit' the second The selector selects the duo of the second matrix operation. 17. Please apply for the encryption and decryption device of the advanced encryption standard described in the patent _ item 13, wherein the first matrix operation and the second matrix operation are substantially 18. As described in the patent application, the advanced encryption device described in item 13 The -mutex exclusive OR operation includes an -operator, and the value of the operand = is obtained from the first matrix operation and the second mutual exclusion OR operation. 19. The encryption and decryption device of the advanced encryption standard described in item 13 of the scope of the patent application, wherein the look-up table operation module includes-a comparison table, which is based on a multiplication inverse operation (nultiplicative inv⑽ah-η), The first OR operation and the result of the first matrix operation. 44