WO1991018460A1

WO1991018460A1 - Process for the blockwise coding of digital data

Info

Publication number: WO1991018460A1
Application number: PCT/DE1991/000413
Authority: WO
Inventors: Rolf Trautner
Original assignee: Rolf Trautner
Priority date: 1990-05-19
Filing date: 1991-05-18
Publication date: 1991-11-28
Also published as: DE4016203A1

Abstract

The process is for the blockwise coding of digital or digitised analog data. At a moment j, the plain text is read into a first operation register as a binary data block (T)(j) of L bits and then converted there into an intermediate text C¿1?(j) by means of a temporary code S¿1?(j) and a reversible function F. The intermediate text C¿1?(j) is then transferred in parallel to a second operation register in which it is converted into an intermediate text C¿2?(j) by means of a temporary code S¿2?(j) and the reversible function F. After a total of R such conversion steps there exists the intermediate text C¿R?(j) representing the code text C(j) at moment j, whereby the transfer of the individual intermediate texts from one operation register to the next takes place simultaneously in parallel in accordance with the systolic algorithm. The conversion of the data block in operation register k takes place in several steps, whereby the number of steps is set and the individual steps are formed by rapid elementary operations. The sequence of the elementary operations is determined by a variable permutation Pi¿k?(j) which forms part of the code S¿k?(j) and is so formed that each of the conversion steps is completed precisely once.

Description

Process for the block-wise encryption of digital data

The invention relates to a method for block-by-block encryption of digital data or digitized analog data, in which, at a point in time j, the plaintext to be encrypted is read in as a binary data block T- ^{1 * 1} from L bit into a first operation register and subsequently therein by means of a temporary key sj- ^{, *)} and a reversible function F is converted to an intermediate text C - * - ^* ', whereupon the intermediate text cj ^** - ^ is transferred in parallel to a second operation register in which the Intermediate text C. 'is converted to an intermediate text c]' by means of a temporary key S ^ * - ^** 'and the reversible function F, so that, after a total of such conversion steps, the ciphertext c'- ^{* 1} ' at time j represents the ciphertext

Intermediate text

'arises, with the transfer of the individual intermediate texts from one into the subsequent operation register taking place simultaneously in accordance with the systolic algorithm.

Such an encryption method without the systolic algorithm is known as the DES method and has been described, for example, by J. Seberry et al. in "Cryptography: An Introduction to Computer Security", Prentice Hall.

A disadvantage of this known method, however, is the insufficiently high processing speed required in today's cryptographic applications and common data transmission speeds.

The invention has for its object to improve a method of the type mentioned in such a way that even those currently in use Synchronous encryption is possible for data transmission speeds in the range of 140 Mbit / sec, whereby at the same time an increase in data security is achieved with only a small additional outlay on hardware and, in addition, the possibility should be created to implement either time-optimized or hardware-optimized operation.

This object is achieved according to the invention in that the conversion of the data block in the operation register k takes place in several conversion steps, the number of conversion steps being fixed and the individual conversion steps being formed by fast-running elementary operations, the order of which is determined either by a variable permutation Pi who are part of

Key S-? and is formed in such a way that each of the conversion steps is carried out exactly once, or is selected from the available elementary operations K of such elementary operations depending on the key, repetitions of the same elementary operations being permissible.

The progress achieved by the invention consists essentially in the fact that once by using Elementary operations exceptionally high

Processing speeds can be achieved, since almost only a single clock cycle is required for this, on the other hand in that the order of the elementary operations is kept variable depending on key bits, which on the one hand results in extremely inexpensive hardware expenditure and also high encryption complexity.

The process is represented in two variants. In variant 1, ten elementary positions are used using key bits, each elementary position being used exactly once within a round, the sequence being determined by a permutation dependent on the key.

Since the permutation is variable and depends on the time j and the permutation is recalculated as a recursive function for each time j, there are a total of 10 for each operation register and each time j! different permutations are available. With a number of R operation registers, it can therefore be used at any time

* _R a new one can be selected from (10!) Different images. Even at R = 4 you get an additional safety factor of (10!) 4> 1.73 * 1026, whereby an extraordinarily small additional hardware expenditure of about 20% is required.

In variant 2, the number N is kept open to the elementary operations, the elementary operations are run through K times, a result being selected for each run depending on a key, and an elementary operation being able to be selected several times. With the freely selectable parameters R = number of rounds, N = number of elementary operations, K = number of repetitions, we speak of (R, N, K) design. Here is

1 <R, 2 <N, 1 <K, 16 <R.K, 64 <2logN «R-» K The decisive parameters here are R and K, which control the time and hardware expenditure. If you choose K = 1, you get 1-stroke encryption. So z. B. the

-9 (64, 2, 1) design optimized for time and delivers one at 5 _* 10 sec / cycle with a word length of 64 bits

Encryption rate of 1 ^ 28 * 10 bit / sec. On the other hand, if you choose R = 1, you get a particularly favorable one

Hardware expenditure. The (1, 2, 64) design is hardware-optimal (useful for the telephone). However, a mixed choice of parameters is also possible, with very favorable, if not individually optimal, properties for

Time and hardware expenditure can be achieved. In version 2, the invention provides that in order to carry out an elementary operation, the data block in the operation register k is subdivided into 1 subblocks, whereupon each of the subblocks is subjected to a substitution and a transposition takes place before and / or after the substitution Data block works. The division into sub-blocks, each of which is, for example, four bits wide, enables PROMs to be used to carry out the substitution. However, since the substitution only affects the respective bits of the sub-block, and not the entire data block, an additional transposition is required, which however relates to the entire data block. This transposition can easily be carried out during the transfer to the register performing the elementary operation or during the retransfer.

For time-optimized operation, an increase in hardware expenditure can be provided, so that the data is processed in a more parallel manner as a result. For hardware-optimized operation, on the other hand, in order to achieve the same security during encryption, the individual operations have to be repeated more frequently. However, there is also a given one Rate of the data to be encrypted, the possibility, adapted to the time requirements, to drive the hardware expenditure only to such an extent that mixed operation between the time-optimized or hardware-optimized mode of operation results.

At the beginning of a data transmission, the method provides that the keys .s', S ^ ', ..., S (, 1)' are specified as the start key at the first point in time and for a fixed number of

Times are taken over unchanged. The set of

Starting keys must be known to both participants together and can be distributed using a modern public key procedure. The possible advantages of a chosen one

Plaintext attack (which involves the attacker

Encryption device is available) compared to a known

Plain text attacks (in which the attacker has clear and associated cipher text) can be ruled out by generally preceding a preliminary phase of approx. 1 sec, in which a (non-influenceable) physical white noise is transmitted in encrypted form and only then to transmitting text is encrypted. It can be advantageous here that the start keys for 2R times are adopted unchanged.

In a preferred procedure according to the invention, the keys following the start key are formed as recursive functions from the return of a certain intermediate text. This has the advantage that it is generally not possible to access the intermediate texts that generate the following keys from the outside.

It can also be provided that the return of the intermediate text takes place with a time delay via intermediate registers. The time shift is necessary because of the time shift due to the systolic algorithm: the receiver can only have decrypted after 2R time units and is then in possession of all associated intermediate texts.

In a particularly expedient embodiment of the invention it is provided that the keys following the start key act as recursive functions

^{SJ) βf} k ^(S k ^J_1) ' ^C R / 2 ^{2R)) be} ^ ch et. In principle, the number of elementary operations to be carried out in an operation register can be chosen freely. In version 1, the invention provides that a total of ten conversion steps take place in each of the operation registers, ten different elementary operations being used for this.

It has proven to be advantageous that for each of the conversion steps the data block is first transferred to its own sub-register, the elementary operation is carried out there, and the data block is then transferred back to the operation register, with version 1 the elementary operations still being carried out by special subkeys of the temporary key SP '. depend. It is further advantageous if the operation register transfers the data block to all sub-registers for each conversion step, the data block in all sub-registers is subjected to the respective elementary operation, and then the operation register takes over the data block of the sub-register determined by a further subkey.

The following elementary operations are planned for version 1: A first elementary operation can consist of an addition, the output block y = (y.) L_ — 1 being calculated for the input block x = (x.) Ri — ι and the partial key a = (alpha.) T _Q -ι — 1 by y. = x. + alpha. mod 2 = x. © alpha.

A second elementary operation can consist of a conditional exchange, the output block y = (y.) Being calculated for the input block x = (χ.) ₀ and the subkey b = (beta.) L '/ 2-1, by x 1st and xl. +, _ Yy /. Δ_ can be exchanged if beta. = L.

A third elementary operation can consist of a conditional exchange, the output block y = (y-) being calculated for the input block x = (x.) ₀ and the subkey b == (beta.) L '/ 2-1 x 1. and x ± _τ J — 1. — 1. be exchanged if beta. = l.

A fourth elementary operation can consist of a matrix multiplication of two, in which the L-bit block is first split into L / 2 2-bit blocks and then one of the matrix operations on each such block

is applied, the selection of which is controlled by a 2-bit key.

A fifth elementary operation can consist of triple permutations, for which the L-bit block is first split into [L / 3] 3-bit subsets and a permutation is carried out on each subset, the selection being made using a 3-bit key.

A sixth elementary operation can consist of one

4-bit mapping exist, for which the L-bit block is first split into L / 4 4-bit blocks, the element of such a 4-bit block being a number between 0 and

15, d. H. is understood as an element of Z. = | 0, 1, 2, ..., 15t, whereupon 4 bijective images Phi.,

Phi2 ", Phi_3, Phi4. on Z-16- and one of them is applied to a 4-bit block, the selection being made with a 2-bit key.

A seventh elementary operation can consist of a 4-bit cyclic convolution, in which the L-bit block is first split into L / 4 4-bit blocks and then a cyclic convolution y = x * c on each of the blocks 3 y -1. = © / _ - xj. * Cl.-j. mod ■ _* 4. is executed, where c = (c.) has odd parity and one 3-bit key per 4-bit block controls the selection among the parameter vectors c.

An eighth elementary operation can consist of an 8-bit cyclic convolution, in which the L-bit first

Split the block into L / 8 8-bit blocks and then cyclically convolution y = x * c with y • x on each of the blocks. * c. , , "Is executed, where c = (has even parity and a 7-bit

Keys per 8-bit block the choice among

Controls parameter vectors c.

A ninth elementary operation can consist of a cyclical

There is a shift C in which the L-bit block is shifted cyclically by m = k * L / 16 bit, the value k being selected using a “log L / 16 bit key. A tenth elementary operation can consist of one

There are 16-bit variable cyclic shifts, in which the L-bit block is first divided into L / 16 16-bit blocks, then the Hamming weight w (x) is calculated for each of the 16-bit blocks and finally each block by w ( x) positions are shifted cyclically so that * is x.

Finally, there is also the possibility that the conditional exchange already described is replaced by a general conditional exchange, the total block being divided into L / 2 subsets and the elements of the i-th subset being exchanged if beta. = 1 for an L / 2-bit partial key beta = (beta.) '~.

In the following the invention is explained in detail with reference to the drawing; show it:

1 shows a schematic representation of a device for carrying out the method according to the invention,

FIG. 2 shows a likewise schematic detailed illustration of a section of the object according to FIG. 1.

The method described below is used for block-by-block encryption of digital data or digitized analog data, in which at a time j the plain text to be encrypted T ^ ^{** 5 *} 1 is read into a first operation register 1 as a binary data block of L bits and subsequently therein is converted to an intermediate text Cj- ¹ 'by means of a temporary key sj * - ^* - ¹ and a reversible function F. The intermediate text c! ^ 'Is then transferred in parallel to a second operation register 2, in which the intermediate text C ^ * - ^* 'is converted to an intermediate text C ^ by means of a temporary key S. ^{* un <} - * - of the reversible function F. After a total of R such conversion steps, the intermediate text C ^ ^*** 'representing the ciphertext C ^ * ^* - ^{* 1} at time j is formed. The transfer of the individual intermediate texts from the one into the subsequent operation register takes place simultaneously in accordance with the systolic algorithm, so that an increase in the number of operation registers does not affect the average throughput time, but only causes a higher time shift. The data block in the operation register k is converted in several conversion steps, the number of conversion steps being fixed and the individual conversion steps being formed by fast-running elementary operations. The order of these elementary operations is determined by a variable permutation Pi, which is part of the key sP and is formed in such a way that each of the conversion steps is carried out exactly once. The elementary operations can be implemented very quickly in terms of hardware, so that they are usually completed after a cycle time. The keys s ^ ¹ , S ^ ¹ *, ..., S ^ ¹ ^ are specified as the start key at the first point in time and must be known to both participants by a public key procedure, for example. These start keys are used for a set number of times. Points of time, such as for 2R points of time, adopted unchanged.

The keys following the start key are then formed as recursive functions from the return of a certain intermediate text. The use of an intermediate text compared to the plain text or the cipher text (both of which are known in a Chosen plain text attack) has the advantage that it is not known because of its internal use only.

It is also provided here that the return of the intermediate text takes place with a time delay via intermediate registers. In particular, the keys following the start key are called recursive functions

calculated.

A total of ten conversion steps take place in each of the operation registers 1, 2, 3, 4, as can be seen from FIG. 2, with ten different steps for this Elementary operations can be used. For each of the conversion steps, the data block is first transferred to its own sub-register 5 and the elementary operation is carried out there. The data block is then retransmitted to the operation register 1, 2, 3, 4, the elementary operations depending on special subkeys of the temporary key S.

For reasons of circuit technology, it is advantageous that the operation register transfers the data block to all sub-registers 5 for each conversion step. There, the data block in all sub-registers 5 is subjected to the respective elementary operation. Subsequently, the operation register 1, 2, 3, 4 takes over only the data block of the sub-register 5, which is determined by the permutation Pi.

The elementary operation of the first sub-register can consist of an addition, the output block y = (y.) L − 1 for the input block x = (x.) L _Q −1 and the subkey a = (alpha.) L ₀ −1

is calculated by y. = χ. + alpha. mod 2 = x. Θ alpha. . The elementary operation of the second

Sub-registers can consist of a conditional exchange, where for the input block x = (χ.) L _Q —1 and the subkey b = (betai.) 'TO ^* ' ~ the output block

Y = (Yi) is calculated by x. and x, _{+ L /} - are exchanged if beta. = l.

The elementary operation of the third sub-register can consist of a conditional exchange, the output block y = (y.) Being calculated for the input block x = (χ.) ₀ t-1 and the subkey b = (beta.) / ~ By x 1st and xJ_J — 1st — 1st be exchanged if beta. = l.

The elementary operation of the fourth sub-register can consist of a 2 matrix multiplication, in which the L-bit block is first split into L / 2 2-bit blocks and then one of the matrix operations on each such block

is applied, the selection of which is controlled by a 2-bit key.

The elementary operation of the fifth sub-register can consist of triple permutations, for which the L-bit block is first split up into [L / 3] 3-bit subsets a permutation is carried out for each subset, the selection being made in each case using a 3-bit key.

The elementary operation of the sixth sub-register can consist of a 4-bit mapping, for which the L-bit block is first split into L / 4 4-bit blocks, the element of such a 4-bit block being a number between 0 and 15 , ie as an element of

1, 2, ..., 15, whereupon 4 bijective illustrations

Phi, Phi_, Phi_, Phi. are considered on Z.- and one of them is applied to a 4-bit block, the selection being made using a 2-bit key.

The elementary operation of the seventh sub-register can consist of a 4-bit cyclic convolution, in which the L-bit block is first split into L / 4 4-bit blocks and then a cyclic convolution y = x * c with ^y i ^■ on each of the blocks - ^{= ®} £ _< C_ X ^x ji ^"c 1i - i mo _d 4 ^{from *} ? ^We will ^execute ^d , where ^b ei

3 ^{• '} * ° c = (c.) _ Has odd parity and a 3-bit

Keys per 4-bit block the choice among

Controls parameter vectors c.

The elementary operation of the eighth sub-register can consist of an 8-bit cyclic convolution the L-bit block is split into L / 8 8-bit blocks and then a cyclic convolution y = x * c with y on each of the blocks. = Φ _d _ is executed, where c = (c.)

it has a 7-bit

Keys per 8-bit block the choice among

Controls parameter vectors c.

The elementary operation of the ninth sub-register can consist of a cyclic shift C, in which the L-bit block is shifted cyclically by m = k * L / 16 bits, the value k being selected using a log L / 16-bit key .

The elementary operation of the tenth sub-register can consist of a 16-bit variable cyclic shift, in which the L-bit block is first divided into L / 16 16-bit blocks, then the Hamming weight w (x) for each of the 16-bit blocks calculated and finally each block is cyclically shifted by w (x) positions so that

^{y = C} w (x) ^{* x is} '

However, it is also possible for the conditional exchange described for the second or third sub-register to be replaced by a general conditional exchange, the entire block being divided into L / 2 subsets and the elements of the i-th subset are exchanged if beta. = 1 for an L / 2-bit subkey beta = (beta _i ) _Q ^{/ 2 "1} .

The decryption is carried out with the same device as the encryption, in that the encryption text C ^ - ^{1 * 1 is} read into the R-th operation register and there into the intermediate _text C _τ ? is converted. This intermediate text is sent through the individual operation registers in the same way as for the encryption, only in the opposite direction, as a result of which the corresponding intermediate texts and finally the desired plain text are delivered successively. The reverse mapping through the individual conversion steps is described by the same mapping F in the individual operation registers. The inverting effect is achieved by replacing the respective key with an inverse key.

In the case of the 3-permutation, the inversion is carried out by listing the associated inverse permutations in the analog order. If the kth permutation Pi is selected by the key in the encryption, then the inverse permutation Pi7 becomes by the same key in the decryption selected.

In the 4-bit mapping, the inversion takes place in that the inverse maps Phi ^" , Phi ^" , Phi ^" , Phi ^" are listed in the same order and selected by the same key.

In the 4-bit cyclic convolution, the inversion takes place in that the inverse factors c ^" are listed in the same order and selected by the same key.

In the case of cyclical shifting, the inversion is carried out by cyclical shifting by -m = -k * L / 16 bits.

In the 16-bit variable cyclic shift, the inversion is carried out by calculating the Hamming weight of y, i.e. cyclically shifting Cw (.y. And by -w (y) positions, so that ^{x = c} _ _{wv \} * y «Note that w (x) = w (y), although a key does not appear here.

Claims

Claims:

Method for block-by-block encryption of digital data or digitized analog data, in which, at a point in time j, the plaintext to be encrypted is read as a binary data block T ^ - ¹ 'of L bit into a first operation register (1) and then therein by means of a temporary key s * ^*** 'and a reversible function F is converted to an intermediate text C ^ - ^** ', whereupon the intermediate text C. 'is transferred in parallel to a second operation register (2), in which the intermediate text ^ -' by means of a temporary key S ^ ^{and the} reversible function F is converted to an intermediate text C ^, so that after a total of R such conversion steps, the intermediate text C ^ 'representing the ciphertext c ---' at time j is formed, the transmission of the individual intermediate texts from one to the other the following Operation register according to the systolic algorithm takes place simultaneously in parallel, characterized in that the conversion of the data block in the operation register k takes place in one or more conversion steps, the number of conversion steps being fixed and the individual conversion steps being formed by a total of N fast-running elementary operations, either of which Sequence is determined by a variable permutation Pi, which is part of the key SP and is formed such that each of the conversion steps is carried out exactly once, or from those available

Elementary operations K of such elementary operations can be selected depending on the key, repetitions of the same elementary operations being permissible.

2. The method according to claim 1, characterized in that the N available elementary operations are carried out simultaneously, a result being selected by key bits and sent back to the operations register.

3. The method according to claim 1 or 2, characterized in that for performing an elementary operation of the data block in

Operation register k is subdivided into 1 sub-blocks, whereupon each of the sub-blocks is subjected to a substitution and before and / or after the substitution a transposition takes place which affects the entire data block.

4. The method according to any one of claims 1 to 3, characterized in that the key sj ',

S ^ ', ..., S ^' are specified as start keys at the first point in time and are adopted unchanged for a specified number of times.

5. The method according to claim 4, characterized in that the starting key for 2R times are adopted unchanged.

6. The method according to claim 4 or 5, characterized in that the keys following the start key are formed as recursive functions from the return of a certain intermediate text.

7. The method according to claim 6, characterized in that the return of the intermediate text is delayed via intermediate register.

8. The method according to any one of claims 4 to 7, characterized in that the keys following the start key as recursive functions

be calculated.

9. The method according to any one of claims 1 and 4 to 8, characterized in that a total of ten conversion steps take place in each of the operation registers (1, 2, 3, 4), ten different elementary operations being used for this.

10. The method according to any one of claims 1 to 9, characterized in that for each of the conversion steps, the data block is first transferred to its own sub-register (5), where the elementary operation is carried out, and then the data block is sent to the operation register (1,2,3,4 ) is transferred back, whereby the elementary operations of special partial keys of the temporary Detach key SP.

11. The method according to claim 10, characterized in that the operation register (1,2,3,4) for each conversion step transfers the data block to all sub-registers (5), the data block in all sub-registers (5) is subjected to the respective elementary operation, and then the operation register (1, 2, 3, 4) takes over the data block of the sub-register (5) determined by the permutation Pi.

12. The method according to any one of claims 1 to 11, characterized in that one of the elementary operations consists of an addition, wherein for the input block x = (χ.) ~ And the subkey a = (alpha.) ~ The output block y = (y .) ~ is calculated by y. = χ. + alpha. mod 2 = x. Θ alpha. .

13. The method according to any one of claims 1 to 11, characterized in that one of the elementary operations consists of a conditional exchange, wherein for the input block x = (χ.) ~ And the partial key b = (beta.) _ '~ The output block y = (y.) is calculated by x1. and

be exchanged if beta. = l.

14. The method according to any one of claims 1 to 11, characterized in that one of the elementary operations consists of a conditional exchange, wherein for the input block x = (x.) ~ And the partial key b = (beta.) '^" ~ The output block y == (y.) is calculated by exchanging x 1st and x_JJ — 1st - 1st if beta. = ^* l.

15. The method according to any one of claims 1 to 11, characterized in that one of the elementary operations consists of a 2 matrix multiplication, in which the L-bit block first split into L / 2 2-bit blocks and then one for each such of the matrix operations

G;), (; S). (O Ϊ), (Ϊ;)

is applied, the selection of which is controlled by a 2-bit key.

16. The method according to any one of claims 1 to 11, characterized in that one of the elementary operations There are three permutations for which the L-bit block is first split into [L / 3] 3-bit subsets and a permutation is carried out on each subset, the selection being made using a 3-bit key.

17. The method according to any one of claims 1 to 11, characterized in that one of the elementary operations consists of a 4-bit image, for which the L-bit block is first split into L / 4 4-bit blocks, the element being a such 4-bit blocks as a number between 0 and 15, i.e. H. as an element of Z. =

■ 0, 1, 2, ..., 15V is understood, whereupon 4 bijectives

Figures Phi, Phi ,, Phi _{3 #} hi. Are considered on Z_ ₆ and one of each is applied to a 4-bit block, the selection being made using a 2-bit key.

18. The method according to any one of claims 1 to 11, characterized in that one of the elementary operations consists of a 4-bit cyclic convolution, in which the L-bit block is first split into L / 4 4-bit blocks and then on each of the blocks a cyclic convolution y = x * c with yx -c. , , is executed, where

c = (c.) has 3 odd Pari.tat and ei.n 3-Bιt

Keys per 4-bit block the choice among

Controls parameter vectors c.

19. The method according to any one of claims 1 to 11, characterized in that one of the elementary operations consists of an 8-bit cyclic convolution, in which the L-bit block is first split into L / 8 8-bit blocks and then on each of the blocks a cyclic folding y = x * c with ^y i ^{= Θ} <r-- ^X j '° ij mo _{d 8} ^auS ? ^{e leads} ^d where ^b ei c = (c.) 7 _{Q has} odd Pari.tat and en 7-Bιt

Keys per 8-bit block the choice among

Controls parameter vectors c.

20. The method according to any one of claims 1 to 11, characterized in that one of the elementary operations consists of a cyclic shift C, in which the L-bit block is shifted cyclically by m = kL / 16 bits, the selection of the value k by one

-log L / 16 bit key is done.

21. The method according to any one of claims 1 to 11, characterized in that one of the elementary operations from a 16-bit variable cyclic shift exists, in which the L-bit block is first divided into L / 16 16-bit blocks, then the Haing weight w (x) is calculated for each of the 16-bit blocks and finally each block is cyclically shifted by w (x) positions is such that * is x.

22. The method according to claim 13 or 14, characterized in that the conditional exchange described there is replaced by a general conditional exchange, wherein the entire block is divided into L / 2 subsets and the elements of the i-th subset are exchanged if beta. = l for an L / 2-bit subkey beta = (beta.) _ '~.