WO2002058036A1

WO2002058036A1 - Encryption circuit

Info

Publication number: WO2002058036A1
Application number: PCT/JP2001/000399
Authority: WO
Inventors: Naoya Torii; Takayuki Hasebe; Souichi Okada; Tomohiro Hayashi; Chikahiro Deguchi; Yumi Fujiwara
Original assignee: Fujitsu Limited
Priority date: 2001-01-22
Filing date: 2001-01-22
Publication date: 2002-07-25
Also published as: WO2002058037A1

Abstract

A circuit for executing the algorithm of SC 2000, i.e. a common key block cipher having key length of 128/192/256 bits and processing block of 128 bits, at high rate with a compact hardware. A data scramble circuit comprises a first I function processing circuit, a processing block comprising a second I function processing circuit, a first R function processing circuit, a second R function processing circuit, and a third I function processing circuit, a B function processing circuit, and a fourth I function processing circuit, wherein the processing block and the B function processing circuit constitute a clock lock loop.

Description

Description Cryptographic circuit (Technical field)

The present invention relates to a data scramble circuit used for a cryptographic device, an extended key generation circuit for generating an extended key used in a destruction circuit, and a data scramble circuit and an encryption circuit including the extended key generation circuit.

(Background technology)

Data Encryption Standard (DES) is known as a common key cryptosystem widely used at present. DES is a standard set by the National Institute of Standards Technology (NIST) of the United States government in 1977, with 64 bits input / output and a key length of 64 bits (of which 8 bits are parity bits). It is a block cipher with a key length of 56 bits).

DES is an algorithm that repeats a nonlinear function process called an F function 16 times. For this reason, an encryption circuit for processing the encryption / decryption by DES is, as shown in, for example, Japanese Patent Application Laid-Open No. 2000-77585, a technique that repeatedly performs the F function. This can be realized with a synchronous loop configuration.

When a ciphertext encrypted by DES is decrypted by the brute force method of a cryptographic key, even if the key length is 64 bits (56 bits), it is assumed that it is within the range of the computational security evaluation. It was thought years ago. However, with the improvement in computer performance, it has become difficult to secure sufficient computational security even with a key length of 64 bits (56 bits). For this reason, a multi-stage DES that uses a plurality of encryption keys and repeats the process a plurality of times is used. For example, triple DESS, which repeats the process three times using two or three encryption keys, is generally used in many cases.

Movement to standardize AES with a key length of 128/192/256 bits and a processing block of 128 bits as a next generation symmetric key cryptography that replaces DES The AES as a US standard is consolidating. The applicant of the present application has been able to maintain high security with such AES-compliant specifications (key length of 128/192/256 bits, processing block of 128 bits) and perform high-speed processing. An algorithm SC2000 for realizing the algorithm was announced, and as an arithmetic unit and an arithmetic method used for this SC200, Japanese Patent Application No. 2000-0—2124482, this SC2000 It is proposed in Japanese Patent Application No. 2000-0—212814 as an extended key generation device used for.

This SC 2000 is an algorithm that repeatedly performs some basic functions like DES.If each function processing circuit is configured by hardware, it is configured to execute a loop circuit by executing a loop circuit. Can be configured. However, unlike the encryption scheme of SC20000, which is different from the encryption scheme composed of only the F function in DES, it is possible to simply configure one function processing circuit in one synchronous loop. Since it is not possible, how to arrange the various function processing circuits so that the function processing by the various function processing circuits can be performed efficiently in the synchronous loop is a major issue in hardware implementation.

The present invention executes the algorithm of SC2000, which is a common key block cipher with a key length of 128/192/256 bits and a processing block of 128 bits, using high-speed and compact hardware. It is an object to provide a circuit configuration that performs

(Disclosure of the Invention)

In order to solve the above-described problem, a de-task ripple circuit according to the present invention includes an I function for calculating an exclusive OR of a plurality of extended keys generated from an encryption key and data, and a data bit. Data scrambling is performed using the B function and the R function, which encrypts the key, and encrypts a common key block cipher with a key length of 128 bits / 192 bits / 256 bits and a processing block of 128 bits. / A data scramble circuit that performs decryption, processes the I function, processes the B function, I function, R function, R function, and I function in that order. In order to perform processing in the order of the function and the I function, an I function processing circuit that processes the I function, a B function processing circuit that processes the B function, O A de-task ripple circuit that implements an R function processing circuit that processes the R function.

Here, after processing the I function, the processing block that performs processing in the order of the B function, the I function, the R function, the R function, and the I function is processed n times, and then the processing is performed in the order of the B function and the I function. It can be configured to implement all I function processing circuits, B function processing circuits and R function processing circuits. In addition, a B-function processing circuit, an I-function processing circuit, an R-function processing circuit, an R-function processing circuit, and a cook synchronous loop connected in the order of the I-function processing circuit are configured, and an I-function processing circuit, a clock synchronous loop, It is possible to adopt a configuration in which the B function processing circuit and the I function processing circuit are connected in this order. Further, in the present invention, data is obtained by using an I function for calculating an exclusive OR of a plurality of extended keys generated from an encryption key and data, and a B function and an R function for mixing data bits. De-task rumple circuit that performs task rumpling and performs encryption / decryption of a common key block cipher with a key length of 128/192/256 bits and a processing block of 128 bits. After processing the I function and the B function, the processing block that performs processing in the order of the I function, the R function, the R function, the I function, and the B function is processed n times, and then the processing of the I function is performed. Next, we propose a data scramble circuit that implements an I function processing circuit that processes the I function, a B function processing circuit that processes the B function, and an R function processing circuit that processes the R function. Here, a clock synchronous loop connected in the order of the I function processing circuit, the R function processing circuit, the R function processing circuit, the I function processing circuit, and the B function processing circuit is configured, and the I function processing circuit, the B function processing circuit, A configuration in which a clock synchronous loop and an I function processing circuit are connected in this order can be provided. A first I function processing circuit; a second I function processing circuit; a first R function processing circuit; (2) a processing block to which the R function processing circuit and the third I function processing circuit are sequentially connected; a selector for selectively outputting an output of the first I function processing circuit and an output of the processing block; A B function processing circuit connected thereto; a register for latching an output of the B function processing circuit at each clock cycle and inputting the output to the processing block; and a fourth I function processing circuit connected to the output of the register. A clock synchronous loop can be configured by the block and the B function processing circuit. Further, in the present invention, data is obtained by using an I function for calculating an exclusive OR of a plurality of extended keys generated from an encryption key and data, and a B function and an R function for mixing data bits. A detask rumble circuit that performs evening scramble and performs encryption / decryption of a common key block cipher with a key length of 128 bits x 192/256 bits and a processing block of 128 bits. Then, after processing in the order of the I function, the B function, and the I function, the processing block that performs the processing in the order of the R function, the R function, the I function, the B function, and the I function is processed n times. It can be configured to implement an I function processing circuit for processing functions, a B function processing circuit for processing B functions, and an R function processing circuit for processing R functions. A first processing block to which an I function processing circuit, a B function processing circuit, and a second I function processing circuit are sequentially connected; and a first R A second processing block to which a number processing circuit and a second R function processing circuit are sequentially connected; and selectively input either input data or an output of the second R function processing circuit to the first I function processing circuit. And a selector for performing the operation. Further, in the present invention, a de-task is performed using an I function for calculating an exclusive OR of a plurality of extended keys generated from an encryption key and data, and a B function and an R function for mixing data bits. A data scramble circuit that performs a ramp, performs encryption of a common key block encryption with a key length of 1 28/192/256 bits and a processing block of 128 bits, and performs Z decryption. The first processing block that performs processing in the order of the function, the B function, and the I function, and the second processing block that performs processing in the order of the R function and the R function are alternately performed multiple times. In order to perform processing, a configuration is proposed in which an I function processing circuit for processing an I function, a B function processing circuit for processing a B function, and an R function processing circuit for processing an R function are implemented.

Here, a first processing block in which a first I function processing circuit, a B function processing circuit, and a second I function processing circuit are sequentially connected; and a first R function processing circuit and a second R function processing circuit are connected. A second processing block; an output selector for selectively outputting one of an output of the first processing block and an output of the second processing block; and one of an input data and an output of the output selector And an input-side selector for selectively inputting to the first I function processing circuit. Further, in the present invention, data is obtained by using an I function for calculating an exclusive OR of a plurality of extended keys generated from an encryption key and data, and a B function and an R function for mixing data bits. A data scramble circuit that performs task rumble and performs encryption / decryption of a common key block cipher with a key length of 1/128/192/256 bits and a processing block of 128 bits. In order to process the I function in order to process the first processing block that performs processing in the order of I function, B function, and I function, and the second processing block that performs R function processing in a predetermined order, , An I function processing circuit, a B function processing circuit for processing a B function, and an R function processing circuit for processing an R function. A first processing block in which a first I function processing circuit, a B function processing circuit, and a second I function processing circuit are sequentially connected; a second processing block including a first R function processing circuit; An output selector for selectively outputting either the output of the block or the output of the second processing block; and selectively inputting either the input data or the output of the output selector to the first I function processing circuit And an input-side selector for performing the operation.

The B function processing circuit includes an input data conversion unit that converts the input data of 32 bits X4 into input data of 4 bits X32, and 32 4 bits connected to the input data conversion unit. A configuration including a cut S box and an output data conversion unit for converting a 4-bit x 32 output data output from each 4-bit S box into a 32-bit X 4 output data And Further, the R function processing circuit mixes two input data bits out of the 32 bits X 4 input data to output 32 bits X 2 output data; The output data of the F function processing circuit may be configured to include the remaining two of the input data and two XOR circuits for performing an exclusive OR operation. The F function processing circuit includes an input data conversion unit that converts input data of 32 bits X 2 into a plurality of input data having an unequal number of bits, and a plurality of S boxes connected to the input data conversion unit. And an output data conversion unit that converts the output from the S box into 32 bits x 2 output data. Further, the plurality of SboXs are composed of two 6-bit SboXs and four 5-bit SboXs, and the input data conversion unit converts the 32-bit X2 input data into six bits. It can be configured to convert the input data into input X2 and 5-bit X4. Also, in the present invention, an intermediate key generation circuit for generating an intermediate key from an encryption key; an expanded key generation circuit for generating a plurality of expanded keys from the intermediate key generated from the intermediate key generation circuit; Key length 1 28/19 2/2 including a data scramble circuit that performs data scramble using I function for calculating exclusive OR with the key, B function and R function for mixing data bits 56-bit, processing block 12-bit This is an encryption circuit that performs encryption / decryption of an 8-bit common key block cipher.The intermediate key generation circuit is used before the data scramble processing of the data scramble circuit. The intermediate key generation process is executed, and the extended key generation circuit proposes a cryptographic circuit configured to generate an extended key in parallel with the de-task ramping process of the data scramble circuit. Here, the intermediate key generation circuit uses the order parameter set corresponding to the order radix. An intermediate key used in the extended key generation processing of the extended key generation circuit can be configured to be sequentially generated based on the meter table and the index parameter overnight table set in accordance with the index radix. The intermediate key generation circuit includes an input data conversion unit that divides the encryption key into 32 bit units, an addition circuit that adds a predetermined value to the input data from the input data conversion unit, and an input data conversion unit that outputs the input data from the input data conversion unit. A multiplying circuit for multiplying the input data by a predetermined value; and an XOR circuit for calculating an exclusive OR of an output value of the adding circuit and an output value of the multiplying circuit. A configuration may further be provided with a storage means for storing the obtained set value. Further, the intermediate key generation circuit performs data scrambling based on the order parameter table set according to the order radix and the index parameter table set according to the index radix. The number of intermediate keys corresponding to the type of the order and the type of the index is generated when performing the key expansion. The expanded key generation circuit is provided by the number of tables set in the index parameter template. It can be configured to generate an expanded key from an intermediate key that is selectively input according to the parameters and the index parameter table. In order to selectively input the expanded key generated by the expanded key generation circuit to the data scramble circuit, an expanded key output selector provided with the number of expanded keys required in one cycle in the data scramble circuit, and an expanded key Storage means for storing the expanded key selection control table of the output selector. According to the present invention, there is provided an extended key generation circuit for generating an extended key to be input to the de-task function circuit as described above, wherein the second extended key group input to the second I function processing circuit is: We propose an extended key generation circuit that generates with the first extended key group input to the first I function processing circuit or the third I function processing circuit before the cycle. (Brief description of drawings)

FIG. 1 is a block diagram showing a schematic configuration of the present invention.

FIG. 2 is a circuit diagram showing the data scramble circuit of the first embodiment.

FIG. 3 is a circuit diagram showing the intermediate key generation circuit of the first embodiment.

FIG. 4 is a circuit diagram illustrating an extended key generation circuit according to the first embodiment.

FIG. 5 is a circuit diagram illustrating an extended key generation circuit according to the second embodiment.

FIG. 6 is a circuit diagram showing a detask rumble circuit according to the second embodiment.

FIG. 7 is a circuit diagram showing a modification of the data scramble circuit of the second embodiment.

FIG. 8 is a circuit diagram illustrating an intermediate key generation circuit according to the third embodiment.

FIG. 9 is a circuit diagram illustrating an extended key generation circuit according to the fourth embodiment.

FIG. 10 is a circuit diagram illustrating an output circuit of the extended key generation circuit according to the fourth embodiment. FIG. 11 is a circuit diagram showing a B function processing circuit.

FIG. 12 is a circuit diagram showing an R function processing circuit.

FIG. 13 is a circuit diagram showing an F function processing circuit.

FIG. 14 is a circuit diagram showing another data scramble circuit according to the first embodiment.

¾)

FIG. 15 is a circuit diagram showing a data scramble circuit according to the fifth embodiment.

FIG. 16 is a circuit diagram illustrating a data scramble circuit according to the sixth embodiment.

FIG. 17 is a circuit diagram showing a de-task ripple circuit according to the seventh embodiment.

FIG. 18 is a circuit diagram showing an M function processing circuit.

FIG. 19 is an explanatory diagram of processing in the M function processing circuit.

(Best mode for carrying out the invention)

(Basic configuration)

FIG. 1 shows the basic configuration of the encryption circuit according to the present invention.

The encryption circuit 1 is composed of a destruction circuit 2 and an encryption key processing circuit 3. The encryption key processing circuit 3 generates an intermediate key based on the input encryption key, and a plurality of expansion keys based on the intermediate key generated by the intermediate key generation circuit 4. An extended key generation circuit 5 for generating a large key is provided. The data scramble circuit 2 includes a plurality of types of function processing circuits inside, performs respective function processing based on the plurality of expanded keys generated by the expanded key generation circuit 5, and converts the input plaintext into ciphertext. O Encrypt and output, or decrypt the input ciphertext and output plaintext o

The data scramble circuit 2 includes an I function processing circuit for calculating an exclusive OR of the expanded key generated by the expanded key generation circuit 5 and the data, a B function processing circuit for mixing data bits, and an R function processing. And a plurality of circuits, for example, configured to perform function processing on IB-RRIB-IRRIBIRRIBIRRIBIRRIBI-RRIBIKRIB-ICJ. At this time, the processing block length of the data input to the data scramble circuit 2 is 128 bits, which is divided into 32 bits × 4 to perform processing.

On the basis of this, the extended key generation circuit 5 is configured to generate as many extended keys as necessary for each I function processing and to sequentially input these to the detask ramble circuit 2. For example, if the number of times of the I function processing in the data scramble circuit 2 is 16 as described above, four 32 bit expanded keys must be generated and input to the data scramble circuit 2. Is repeated to generate a total of 56 expanded keys. Before the expanded key generation processing in the expanded key generation circuit 5, the intermediate key generation processing by the intermediate key generation circuit 4 is executed. The intermediate key generation circuit 4 converts the input encryption key into a plurality of 32-bit data, performs a non-linear function processing on each of them, adds a predetermined value to the input data overnight, and adds the input data to the input data. It is configured to multiply by a predetermined value, calculate exclusive OR of each calculation result, and further perform nonlinear function processing 処理.

For example, in order to generate 56 expanded keys in the expanded key generation circuit 5, an input data converted from a cryptographic key into 32 bits X8 is generated, and each input data is generated. Μ After performing the function processing, input the odd-numbered input data to the addition circuit that adds the predetermined value, and input the even-numbered input data to the multiplication circuit that multiplies the predetermined value. Thereafter, the output of the adjacent addition circuit and the output of the multiplication circuit are input to the XOR circuit to calculate an exclusive OR, and the output value of the XOR circuit is subjected to Μ-function processing to generate an intermediate key. Do. Predetermined value to be added by one adder and multiplication by one multiplier By preparing multiple fixed values, it becomes possible to obtain multiple intermediate keys from each XOR circuit. Here, when the encryption key is converted into 32 bits × 8 input data and an intermediate key of 32 bits × 4 is created by four circuit rows, a predetermined value in the addition circuit and a predetermined value in the multiplication circuit are used. By preparing three multiplication values, an intermediate key of 32 bits X 4 X 3 can be obtained. The extended key generation circuit 5 can appropriately select the 32-bit X4 X3 intermediate key based on the key scheduling to generate 56 extended keys.

(First Embodiment)

FIG. 2 shows a data scramble circuit employed in the first embodiment.

As described above, in the SC2000 encryption, the I function for calculating the exclusive OR of the expanded key and the data and the B function and the R function for mixing the data bits are performed several times in a predetermined order. For example, if the encryption key is 128 bits, the function processing is performed in the order of IBIRR-IBIRRIBIRRIBIRRIBIR-IM-BI-IMM-BI-IMi-IBI. In order to perform such function processing, in the detask ripple circuit 20 of the first embodiment, the I function processing circuit 21, the B function processing circuit 22, and the R function processing circuit 23 Are connected in series.

In this data scramble circuit 20, encryption / decryption is performed in 128-bit block units, and furthermore, input data is processed in four systems that process in 32-bit units. To obtain 32 bits X 4 output data. For this reason, the data scrambling circuit 20 has 32 bits X4 input data buses a, b, c, d and 32 bits x 4 output data buses e, f, g, h. .

When the encryption key is 128 bits, as shown in FIG. 2, after the I function processing circuit 21, the B function processing circuit 22, the I function processing circuit 21, the R function processing circuit 23, Six processing blocks 24 each composed of an R function processing circuit 23 and an I function processing circuit 21 are connected, and then a B function processing circuit 22 and an I function processing circuit 21 are connected in this order. When the encryption key is 192-bit / 256-bit, as shown in FIG. 14, after the I function processing circuit 21, the B function processing circuit 22 and the I function processing Processing block 24 composed of circuit 21, R function processing circuit 23, R function processing circuit 23, and I function processing circuit 21 7 and then connect the B function processing circuit 22 and the I function processing circuit 21 in order.In the data scramble circuit 20 shown in Fig. 2, the number of I function processing circuits 21 is 14, and each I function processing circuit As for the number of extended keys used in the circuit 21, 56 extended keys are required if a 32-bit extended key is used for each of the four systems. In the descramble scramble circuit 20 shown in FIG. 14, the number of I function processing circuits 21 is 16 and the number of expanded keys used in each I function processing circuit 21 is 32 for every four systems. If a pit expansion key is used, 64 expansion keys are required. <B function processing circuit>

The B function processing circuit 22 can have a circuit configuration as shown in FIG. The B function processing circuit 22 includes an input data conversion unit 61 that converts 32-bit X4 input data into 4-bit x32 input data, 32 4-bit S boxes 62 that perform nonlinear processing, and a 4-bit X box. An output data conversion unit 63 for converting 32 output data into 32-bit x 4 output data is provided.

4. Bit Sbox62 performs non-linear processing to convert the input (ai, bi, ci, di) into (Ai, Bi, Ci, Di) as shown in Fig. 11 (b). o <R function processing circuit>

The R function processing circuit 23 can have a circuit configuration as shown in FIG. The R function processing circuit 23 has a 32-bit X4 output data (e, f, g, h) for a 32-bit X4 input data (a, b, c, d). It is. Among the input data (a, b, c, d), the F function processing circuit 73 to which the input data c and d are input, and one of the 32-bit X 2 output data of the F function processing circuit 73 and the input data a An XOR circuit 71 that performs an exclusive OR operation with the input data b and an XOR circuit 71 that performs an exclusive OR operation with the input data b of the 32-bit X2 output data of the F function processing circuit 73 Have. The output of the XOR circuit 71 is the output data e, the output of the XOR circuit 72 is the output data f, and the inputs c and d are the outputs g and f, respectively. Become,

The F function processing circuit shown in FIG. 12 can have a circuit configuration as shown in FIG.

In the F function processing circuit 73, the input data of 32 bits X2 is input to two 6-bit Sbox 74 and four 5-bit SBox 75, respectively. In each of the Sbox 74 and 75, nonlinear processing is performed on each bit, and the output is input to an XOR calculation device 76 using MDS. The XOR calculation device 76 using the MDS executes a predetermined nonlinear process, and outputs its output to the multiplication circuits 77 and 78 and the XOR circuits 79 and 80. The multiplication circuit 77 multiplies the input value by 0x55555555 or 0x33333333. The multiplication circuit 78 multiplies the input value by Oxaaaaaaaa or Oxcccccccc. 0 [¾ The circuit 79 calculates the exclusive OR of the output of the multiplication circuit 77 and the output of the XOR calculation device 76 using the other MDS. The XOR circuit 80 calculates an exclusive OR of the output of the multiplication circuit 78 and the output of the XOR calculation device 76 using the other MDS.

FIGS. 3 and 4 show an example of an encryption key processing circuit 3 for generating an extended key used in such a destruction circuit 20. FIG. FIG. 3 shows an example of the intermediate key generation circuit, and FIG. 4 shows an example of the extended key generation circuit. The intermediate key generation circuit 40 shown in FIG. 3 includes eight M function processing circuits 41, an addition circuit 42 corresponding to odd-numbered M function processing circuits 41, and a multiplication circuit 43 corresponding to even numbered M function processing circuits 41. And an XOR circuit 44 to which the output data of the adjacent addition circuit 42 and multiplication circuit 43 are input in order from the top, and an M function processing circuit 45 for performing a non-linear function process on the output data of the XOR circuit 44. It has.

Each processing circuit is configured to be capable of processing 32-bit data, and the 32-bit X8 input data converted from the encryption key is used to process eight M-functions. Entered in Road 41. If the encryption key is 128 bits, the four data k 0, k 1, k 2, 1 <3 divided from the upper bit every 32 bits, (! 0, k 1 , k 2, k 3, kO, k 1, k 2, k 3) are generated in this order, and each input data is input to the M function processing circuit 41. When the encryption key is 192 bits, six data kO, k1, k2, k3, k4, 1 are similarly divided from the upper bit every 32 bits. From <5, a group of input data arranged in the order of (10, k1, k2, k3, k4, k5, k0, k1) is created, and each input data is processed by the M function processing circuit. Configure to input to 41. Further, when the encryption key is 256 bits, similarly, eight data k 0, k 1, k 2, k 3, k 4, k 5, which are divided from the upper bit every 32 bits From k6 and k7, an input data group arranged in the order of (k0, k1, k2, k3, k4, k5, k6, k7) is created, and each input data is processed by the M function processing circuit 41. It is configured to input to.

The output of the M function processing circuit 41 that is located at the odd-numbered position from the higher order is input to the addition circuit 42. The adder circuit 42 adds one of the predetermined values M (4 i), M (41 + 1), M (4 i +2), and M (4 i +3) to the input data. It is tripled corresponding to the value 0 to 2 of i. The predetermined values M (4i), M (4i + 1), M (4i + 2), and M (4i + 3) are 4i, 4i + 1, 4i + 2, 4+, respectively. 3 is a fixed value processed by an M function that is a non-linear function, and is configured to take three values each corresponding to the value 0 to 2 of the index i.

Of the M function processing circuits 41, the output of the even-numbered one from the higher order is input to the multiplication circuit 43. The multiplication circuit 43 multiplies input data by a predetermined value i + 1, and is tripled in correspondence with the values 0 to 2 of the index i. The value of the index i is equivalent to the index value used for key scheduling at the time of generating an expanded key, and takes a value of 0 to 2, and correspondingly, the value of the predetermined value i + 1 is also three values each. It is configured to take.

The output data of the adjacent addition circuit 42 and multiplication circuit 43 from the upper fil are input to the XOR circuit 44, respectively. Each XOR circuit 44 calculates the exclusive OR of the output value of the addition circuit 42 and the output value of the multiplication circuit 43. It is tripled in accordance with the arithmetic circuit 43.

For each XOR circuit 44, an M function processing circuit 45 for processing the output data of the XOR circuit 44 is provided. The M function processing circuit 45 is also tripled in correspondence with the addition circuit 42, the multiplication circuit 43 and the XOR circuit 44.

From this, the intermediate key generation circuit 40 outputs the intermediate key (ai, bi, ci, di), and outputs the intermediate key from the M function processing circuit 45, which is tripled according to the value of the index i. The keys (a 0, b 0, c 0, d 0), (a 1, b 1, c 1, d 1), and (a 2, b 2, c 2, d 2) are output. <M function processing circuit>

The processing of the M function, which is a nonlinear function, will be described with reference to FIGS. FIG. 18 (a) shows a configuration example of the M function processing circuit. The M function processing circuit 41 generates a 32-bit output w with a 32-bit input data m. The M function processing circuit 41 includes two 6-bit SBoXs 46, four 5-bit SBoX47s, and an XOR calculation device 48 using MDS. The configuration of the 6-bit S bo x46, the 5-bit S box 47, and the XOR calculation device 48 using the MDS includes the 6-bit S box 74, the 5-bit S bo x 75, and the 5-bit S box 74 of the F function processing circuit 73 described above. A device equivalent to the XOR calculation device 76 using MDS can be used. The steps in performing the nonlinear function processing using such an M function processing circuit 41 will be described below.

(a) Divide 32-bit input data into six, five, five, five, five, and six bits of six input data m0, m1, m2, m3, m4, and m5 in order from the top I do.

(b) Input data m 1, m 2, m 3, and m 4 divided into 5 bits are input to a 5-bit S box 47, respectively, according to the table of S 5 (x) in FIG. 18 (b). , Is converted to the value of S 5 (X) corresponding to the corresponding X.

(c) The input data m0 and m5 divided into 6 bits are respectively input to the 6-bit SboX46, and correspond to the corresponding X according to the table of S6 (X) in FIG. 18 (c). To the value of S 6 (X).

(d) 32 bits of intermediate data v from the outputs S 0 to S 5 of each S box 46, 47 Is generated.

(e) The 32-bit intermediate data V is input to the XOR calculator 48 using MDS, and the output w is obtained as the operation result. Here, the value of MD S (X) shown in FIG. 19 (a) is moved to the determinant schematically shown in FIG. 19 (b) according to the corresponding bit X, and the intermediate data V Perform a matrix operation between.

Such an M function processing circuit can be applied to any of the M function processing circuits 41 and 45 in FIG. The extended key generation circuit 50 shown in FIG. 4 has four 32-bit input data X, Y, 1, \ N and a 32-bit output Kn. The input data X is input to the rotate shift circuit 51. The output of the rotation shift circuit 51 and the input data Y are input to the addition circuit 52. The input data Z is input to the rotation shift circuit 53. The output of the bit shift circuit 53 and the input data W are input to the subtraction circuit 54. The output of the subtraction circuit 54 is input to the rotation shift circuit 55. Further, the output of the adder circuit 52 and the output of the rotation shift circuit 55 are input to the XOR circuit 56. The output of the XOR circuit 56 is the output Kn of the extended key generation circuit 50.

If the encryption key is 128 bits, 56 expansion key generation circuits 50 configured as described above are prepared to correspond to the expansion key used in the data scramble circuit 20 shown in FIG. it can. When the encryption key is 192/256 bits, 64 expansion key generation circuits 50 configured as described above are prepared to correspond to the expansion key used in the data scramble circuit 20 shown in FIG. It becomes possible.

In each expanded key generation circuit 50, the corresponding intermediate key is input from the intermediate key generation circuit 40 by key scheduling based on the order table shown in Table 1 and the index table shown in Table 2, and n = 00 to 55 or An extended key K n corresponding to n = 00 to 63 is generated.

【table 1】 t XYZW

0 a b c d

1 b a d c

2 c d a b

3 d c b a

4 a c d b

5 b d c a

6 c a b d

7 cl b a c

8 a d b c

9 b c a d

10 c b d a

11 d a c b

[Table 2]

Here, the relationship between the key scheduling K n, the unique parameter t, and the index parameter s can be expressed as follows.

t = (n + L n / 36 ") mod 1 2

s = n mod 9

A 128-bit encryption key and a data scramble circuit 20 as shown in FIG. In the case of performing encryption using the parameters, the order parameter t and the index parameter s are determined based on the values of n = 0 to 55. The order (a, b, c, d) is determined by referring to the order table of Table 1 from the order parameter t determined here, and the index of Table 2 is determined from the index parameter s. The index (i) is determined by referring to the table. Thus, the intermediate key input from the intermediate key generation circuit 40 is determined for the input data X, Y, Z, W of the expansion key generation circuit 50, and the expansion key Kn is obtained. The extended key ηη generated by the extended key generation circuit 50 is input to the I function processing circuit 21 in the order of η = 0 to 55 in the order of η = 0 to 55, thereby performing encryption. When decryption is performed by the data scramble circuit 20, the expanded key ηη generated by the expanded key generation circuit 50 is input to the I function processing circuit 21 in the order of η = 55 to 00.

When encryption is performed using a 192 / 256-bit encryption key and a data scrambling circuit 20 as shown in FIG. 14, the values of η = 0 to 63 are used. The order parameter (a, b, c, d) and the index (i) are determined from the order table and the index table, and the order parameter (t) and the index parameter (s) are determined. Generates an expanded key Kn from the intermediate key input based on the key. Encryption can be performed by inputting four expanded keys K n generated by the expanded key generation circuit 50 to the I function processing circuit 21 in the order of n = 0 to 63 from the beginning. When decryption is performed by the data scramble circuit 20, the expanded key K n generated by the expanded key generation circuit 50 is input to the I function processing circuit 21 in the order of n = 63 to 00. I do. In the first embodiment, the intermediate key used by the extended key generation circuit 50 can be sequentially generated by the intermediate key generation circuit 40, and the pre-processing prior to the de-task ramble processing by the data scramble circuit 20 can be performed. The number of steps can be reduced, and the time required for encryption / decryption can be reduced.

(Second embodiment)

The data scramble circuit 20 and the extended key generation circuit as shown in the first embodiment When the path 50 is used, although the processing time can be reduced, the problem that the circuit scale becomes large is included. For this reason, it is conceivable that a clock synchronization loop is formed in a part of the data scramble circuit, and the processing in the extended key generation circuit is also executed in synchronization with the clock of the data scramble circuit. An example of such a circuit is shown as a second embodiment.

FIG. 5 is a configuration example of an extended key generation circuit employed in the second embodiment, and FIG. 6 is a configuration example of a detask ramble circuit employed in the second embodiment. In the de-task ramble circuit 200 shown in FIG. 6, in order to perform encryption / decryption in units of 128-bit blocks, a 32-bit X4 input data bus a, b, c, d is used. , 32 bits x 4 output data buses e, f, g, h.

The overnight scramble circuit 200 includes a first I function processing circuit 201, a second I function processing circuit 203, a first R function processing circuit 204, and a second R function processing circuit 2 0 5, the processing block 2 10 connected to the 31st function processing circuit 206 in order, and the output of the 1st I function processing circuit 201 and the output of the processing block 210 are selectively output. Selector 208, the B-function processing circuit 202 to which the output of the selector 208 is connected, and the output of the B-function processing circuit 202 are latched for each clock cycle to be processed by the processing block 210. It has a register 209 for input, and a fourth I function processing circuit 207 to which the output of the register 209 is connected. In addition, the data scramble circuit 200 includes a register 211 for temporarily storing an expanded key used in the 21st function processing circuit 203.

In the data scramble circuit 200 configured as described above, by appropriately switching the selector 208, the processing by the first I function processing circuit 201 and the B function processing circuit 202 is performed, and then the second processing is performed. I function processing circuit 203, first R function processing circuit 204, second R function processing circuit 205, third I function processing function 206 processing block 210 and B function processing circuit 210 After repeating the clock synchronous loop including step 2 a plurality of times, the processing by the fourth I function processing circuit 207 can be executed.

At the first clock, the selector 208 is switched to the first I function processing circuit 201, and the input data a, b, c, and d are processed by the first I function processing circuit 201. After that, the B function processing circuit 202 executes the B function processing via the selector 208, and the value is held in the register 209.

At the next clock, the selector 208 is switched to the processing block 210 side, and the data output from the register 209 is processed by the processing block 210 to process each function of I-R-R-I. Is executed, the B function processing circuit 202 executes the B function processing via the selector 208, and the value is held in the register 209.

Thereafter, when an encryption key having a key length of 128 bits is used, the IRRIB loop processing composed of the processing block 210 and the B function processing circuit 202 is executed five times, and the fourth The processing by the I function processing circuit 207 is executed to obtain output data e, f, g, and h.

In this way, the data scramble circuit 200 shown in FIG. 6 executes the IB processing in the first I function processing circuit 201 and the B function processing circuit 202, and then performs the processing block 210 By repeating the IRRIB loop processing composed of the B function processing circuit 202 six times and further performing the I processing by the fourth I function processing circuit 207, the data scramble circuit 20 shown in FIG. Equivalent functions are realized. FIG. 5 shows an extended key generation circuit for generating an extended key used in the data scramble circuit 200 shown in FIG.

The expanded key generation circuit 500 shown in FIG. 5 includes four selectors: an X selector 501, a Y selector 502, a Z selector 503, and a W selector 504. The X selector 501, the Y selector 502, the Z selector 503, and the W selector 504 are respectively input data paths X, Y, I, All of the intermediate keys (ai, bi, ci, d) output from the intermediate key generation circuit 40 shown in FIG. 3 are connected to the input side.

In the expanded key generation circuit 500, the output of the X selector 501 is input to the rotation shift circuit 505. The output of the rotate shift circuit 505 and the output of the Y selector 502 are input to the adder circuit 506. The output of the Z selector 503 is input to the rotation shift circuit 507. The output of the rotation shift circuit 507 and the output of the W selector 504 are input to the subtraction circuit 508. Subtraction times The output of the path 508 is input to the rotation shift circuit 509. Further, the output of the adder circuit 506 and the output of the rotate shift circuit 509 are input to the XOR circuit 510. The output of the XOR circuit 500 becomes the output Kn of the extended key generation circuit 500.

In the data scramble circuit 200 shown in FIG. 6, two sets of 32 bit X4 expanded keys are required for each packet, and correspondingly, the expanded key generation circuit 5 shown in FIG. Prepare 8 0 0s.

In the extended key generation circuit 500, the X selector 501, the Y selector 502, the Z selector 503, and the W selector 500 are based on the order table and the index table shown in Tables 1 and 2. An intermediate key to be input to 4 is selected, an expanded key is generated based on the input intermediate key, and input to the data scramble circuit 200.

Here, the eight expanded keys generated by the expanded key generation circuit 500 are divided into two groups A and B, each of which is four, and the expanded key of group A is used for the current processing. The expanded key of group B is stored in register 211 for the next processing. At the first clock, the extended key of group A is used for the I function processing in the first I function processing circuit 201, and the extended key of group B is stored in the register 211. At the next clock, the processing of the second I function processing circuit 203 is executed using the expanded key of the group B stored in the register 211. At the same time, two sets of expanded keys are generated by the expanded key generation circuit 500, and the I function processing is performed by the third I function processing circuit 206 using the expanded key of group A. Is stored in register 2 1 1. After executing the loop processing a predetermined number of times, the processing in the fourth I-function processing circuit 207 uses the group B key stored in the register 211 among the expanded keys generated in the last loop processing. Is executed. When using an encryption key with a key length of 19 2/256 bits, the data scramble circuit 20.0 performs IB processing in the first I function processing circuit 201 and the B function processing circuit 202. After that, the IRHI-B loop processing composed of the processing block 210 and the B function processing circuit 202 is repeated seven times, and then the I processing by the fourth I function processing circuit 207 is executed. As a result, the function equivalent to the data scramble circuit 20 shown in Fig. 14 is achieved. Can be realized. In the data scramble circuit 200 and the extended key generation circuit 500 in this manner, two sets of eight extended keys can be generated at any clock, and the generated extended keys can be used effectively. In addition, since the expanded key of group B generated by the previous clock is used in the second I function processing circuit 203 before the processing block 210, the expanded key generation time of group B is delayed by data scrambling. It does not affect the time, and the delay time for generating the expanded key of group A can be set within the processing time of processing block 210. Therefore, the expanded key generation time does not affect the delay time of the de-task ramble process.

(Modification of the second embodiment)

FIG. 7 shows a modification of the data scramble circuit 200 of the second embodiment.

Here, the output of the B function processing circuit 202 of the de-task ripple circuit 200 in FIG. 6 is connected to both the fourth I function processing circuit 207 and the register 209. ing.

As a result, when a predetermined number of loop processes have been completed, the output from the last B function processing circuit 202 is directly input to the fourth I function processing circuit 207 without passing through the register 209. The number of clocks in the data scrambling process can be reduced by one. In the second embodiment and its modified example, the circuit scale can be reduced as compared with the first embodiment, and the cost can be reduced. (Third embodiment)

FIG. 8 shows an intermediate key generation circuit according to the third embodiment of the present invention.

The intermediate key generation circuit 400 shown in FIG. 8 includes two selectors 401 and 402. Each of the selectors 401 and 402 is configured to select and output one from 4 × 32-bit data. When using a 128-bit encryption key In this case, the encryption key is converted into 32-bit X4 data (k0, k1, k2, k3), and the input data to be input to the selector 401 is (k0, k2, kO, k 2), and the input data to be input to the selector 402 is (k1, k3, k1, k3). In addition, when an encryption key having a key length of 192 bits is used, the encryption key is used as 32-bit X6 data (1 <0, 11 1, 12, 13, 3, 14, 1 <5). The input data input to the selector 401 is converted into (kO, k2, k4, k0), and the input data input to the selector 402 is (k1, k3, k5, k1). And Furthermore, when using an encryption key with a key length of 256 bits, the encryption key is converted to 32-bit X8 data (k0, k1, k2, k3, k4, k5, k6, k 7), the input data to be input to the selector 401 is (kO, k2, k4, k6), and the input data to be input to the selector 402 is (k1, k3, k5). , k 7).

M function processing circuits 403 and 404 for performing M function processing are connected to the selectors 401 and 402, respectively. The M function processing circuits 403 and 404 can have the same configuration as the M function processing circuit 41 described above.

An adder circuit 405 for adding a predetermined value is connected to the negative M function processing circuit 403. Further, the other M function processing circuit 404 is connected to a multiplication circuit 406 for multiplying a predetermined value. The adder circuit 405 adds one of predetermined values M (4 i), M (4 i + 1), M (4 i + 2), and M (4 i +3) to the input data. , Index i is tripled corresponding to the value 0-2. The specified values M (4 i), M (4 i + 1) s M (4 i +2) and M (4 i +3) are 4 i, 4 i + 1, 4 i + 2, 4 i +, respectively. 3 is a fixed value processed by an M function that is a non-linear function, and is configured to take three values each corresponding to the value of index i 0 to 2, and these are calculated in advance and stored in ROMOM409. Is stored in Further, the multiplication circuit 405 multiplies the input data by a predetermined value i + 1, and is tripled corresponding to the values 0 to 2 of the index i. The value of the index i is equivalent to the index value used for key scheduling when generating an expanded key, and takes a value of 0 to 2, and correspondingly, the value of the predetermined value i + 1 also corresponds to three values. It is configured to take a value.

The output of the addition circuit 405 and the output of the multiplication circuit 406 are respectively supplied to the XOR circuit 408. Is entered. The XOR circuit 408 calculates the exclusive OR of the output value of the addition circuit 405 and the output value of the multiplication circuit 406, and corresponds to the addition circuit 405 and the multiplication circuit 406. It is tripled.

The output of the XOR circuit 408 is connected to an M function processing circuit 410 for processing the M function. The M function processing circuit 410 is also tripled in correspondence with the addition circuit 405, the multiplication circuit 406 and the XOR circuit 408.

The output of the M function processing circuit 410 is connected to four selectors 411 to 414. The outputs of the selectors 4 1 1 to 4 14 are stored in a register 4. 15 for holding an intermediate key.

In the intermediate key generation circuit 400 thus configured, the addition circuit 405, the multiplication circuit 406, the 0 1 ^ circuit 408, and the M function processing circuit 410 correspond to the values 0 to 2 of the index i. Therefore, it is possible to generate three 32-bit intermediate keys at the same time. Therefore, in this intermediate key generation circuit 400, three intermediate keys, a0 to a2, b0 to b2, c0 to c2, and d0 to d2, are generated at each clock, and At every clock, all intermediate keys are generated and stored in registers 415. Since such a cryptographic circuit is connected by a 32-bit bus, four clocks are required to input a 128-bit plaintext or ciphertext. Therefore, there is no problem even if the intermediate key generation circuit 400 needs four clocks to generate an intermediate key. Also, by configuring the intermediate key generation processing in advance before the data scramble processing, the processing time in the intermediate key generation circuit 400 does not affect the time of the de-task ramble processing. Since the predetermined value to be input to the addition circuit 405 is calculated in advance and converted to ROM, the calculation time can be reduced and the circuit scale can be reduced.

Furthermore, the intermediate key generation circuit 400 is configured to generate three intermediate keys simultaneously according to the value of the index i (0 to 2), but to generate four intermediate keys according to the order value (a to d). It is also conceivable to configure so that the intermediate key is generated at the same time. However, with the configuration of the intermediate key generation circuit 400 shown in the third embodiment, the circuit scale can be further reduced. (Fourth embodiment)

FIG. 9 shows an extended key generation circuit employed in the fourth embodiment.

The expanded key generation circuit 520 shown in FIG. 9 includes an X selector 521, a Y selector 522, a Z selector 523, and a W selector 524.

In the expanded key generation circuit 520, the output of the X selector 521 is input to the port shift circuit 525. The output of the rotation shift circuit 525 and the output of the Y selector 522 are input to the addition circuit 526. The output of the Z selector 523 is input to the rotate shift circuit 527. The output of the rotate shift circuit 527 and the output of the W selector 524 are input to the subtraction circuit 528. The output of the subtraction circuit 528 is input to the rotation shift circuit 529. Further, the output of the adder circuit 526 and the output of the rotate shift circuit 529 are input to the XOR circuit 530. The output of the XOR circuit 530 is the output K n of the expanded key generation circuit 520.

The X selector 521, the Y selector 522, the Z selector 523, and the W selector 524 are four-input, one-output selectors, respectively, and are registers for storing the intermediate key generated by the intermediate key generation circuit 400 as shown in FIG. The output of 5 is input. Here, nine expanded key generation circuits 520 are prepared corresponding to the number of index tables shown in Table 2. The X selector 521, the Y selector 522, the Z selector 523, and the W selector 524 of the first expanded key generation circuit 520 correspond to the indexable s = 0 (aO, b 0 ₅ c 0 ₃ dO), (aO, b0, c0, dO), (aO, bO, c0, dO), (aO, b0, c0, dO) are input. Also for the second to ninth extended key generation circuits 520, based on the value of the index i determined based on the index parameter s, (ai, bi, c, cM) is determined by the X selector 521, the Y selector 522,される Input to selector 523 and W selector 524. Table 3 shows the correspondence of input data to the X selector 521, the Y selector 522, the Z selector 523, and the W selector 524 of the circuits 0 to 8.

[Table 3]

Extended key generation circuit input signal SelectorX SelectorY SelectorZ SelectorW

Circuit o a0, b0, c0, d0 a0, b0, c0, d0 a0, b0, c0, d0 a0, b0, c0, d0

Circuit 1 a1, b1, c1, d1 a1, b1, c1, d1 a1, b1, d, d1 a1, b1, c1, d1

Circuit 2 a2, b2, c2, d2 a2, b2, c2, d2 a2, b2, c2, d2 a2, b2, c2, d2

Circuit 3 a0, b0, c0, d0 a1, b1, c1, d1 a0, b0, c0, d0 a1, b1, c1, d1

Circuit 4 a1, b1, c1, d1 a2, b2, c2, d2 a1, b1, c1, d1 a2, b2, c2, d2

Circuit 5 a2, b2, c2, d2 a0, b0, c0, d0 a2, b2, c2, d2 a0, b0, c0, d0

Circuit 6 a0, b0, c0, d0 a2, b2, c2, d2 a0, b0, c0, d0 a2, b2, c2, d2

Circuit 7 a1, b1, d, d1 a0, b0, c0, d0 a1, b1, d, d1 a0, b0, c0, d0

Circuit 8 a2, b2, c2, d2 a1, b1, c1, d1 a2, b2, c2, d2 a1, b1, c1, d1 Also, X selector 521, Y selector 522, Z selector 5 of circuits 0 to 8 23. The selector control in the W selector 524 is performed based on the order table shown in Table 1, and the correspondence of the select control is shown in Table 4.

[Table 4]

Extended key generation circuit input selector control

a: 00b, b: 01b, c: 10b, d: 11b, unselected: 00000000b By storing the selector control table in this expanded key generation circuit 520 in ROM, control becomes simple, and the circuit scale can be reduced. It can be reduced.

The expanded key output from each expanded key generation circuit 520 is input to a de-task ripple circuit via an output circuit 540 as shown in FIG. The output circuit 540 is composed of selectors 541 to 548. KW 0 to KW 8 are input. The outputs EX_A0 to EX—A3 and EX—B0 to EX_B3 of the selectors 541 to 548 output the expanded key of 32 bits X4 as two sets of groups A and B. Table 5 shows the selector control table for each of the selectors 541 to 548 at the time of encryption, and Table 6 shows the table at the time of decryption.

[Table 5]

Expanded key generation circuit input selector control (B-symbolization)

[Table 6]

Extended key generation circuit input selector control (decryption)

When an extended key generation circuit 500 as shown in FIG. 5 is used, the X selector 501 to W selector 504 needs to configure a circuit of 12 inputs and 1 output, which increases the circuit scale. However, by using an extended key generation circuit 520 as shown in FIG. 9, the X selectors 52 1 to W selector 524 can be configured with 4-input 1-output selector circuits, respectively. Can be greatly reduced. This means that although nine extended key generation circuits 520 in FIG. 9 need to be prepared, the circuit scale of the entire extended key generation circuit is reduced.

(Fifth embodiment)

FIG. 15 shows a configuration example of the detask rumble circuit employed in the fifth embodiment. In the de-task ramble circuit 220 shown in FIG. 15, in order to perform encryption / decryption in units of 128-bit blocks, a 32-bit X4 input data bus a, b, c, d, and 32 bits X4 output data buses e, f, g, h.

The de-task function circuit 220 has a first processing block 2 28 having a first I function processing circuit 22 1, a B function processing circuit 22 2, and a second I function processing circuit 22 3, A second processing block 229 having a first R function processing circuit 224 and a second R function processing circuit 225 is provided. The decoupler circuit 220 includes a selector 226 for selectively outputting the input data and the output of the second R function processing circuit 225, and a second I function processing circuit 222. There is a register 2 27 that holds the output of 3 for each clock.

In the data scramble circuit 220 configured as described above, by appropriately switching the selector 2 26, the first I function processing circuit 22 1, the B function processing circuit 22 2, and the second I function processing circuit 22 2 After performing the processing of step 3, the RRIBI processing loop consisting of the second processing block 2 229 and the first processing block 228 is repeated several times, and the result is output to the output data bus (e, f, g, h). Can be output. In the first clock, the selector 226 is switched to the input data overnight, and the input data a, b, c, and d are processed in the first processing block 228, and then the register 227 is processed. Holds its value.

At the next clock, the selector 2 26 is switched to the second processing block 2 29, and the data output from the register 2 27 is transferred to the second processing block 2 29 and the first processing block 2 29. Each function process is executed by 2 8, and it is stored in register 2 27. Is held.

Thereafter, when using an encryption key with a key length of 128 bits, the loop processing composed of the first processing block 229 and the first processing block 228 is executed five times, and the output data is output. E Obtain e, f, g, h.

The first I function processing circuit 221 and the second I function processing circuit 223 are generated by the expanded key generation circuit 500 shown in FIG. 5 and the expanded key generation circuit 520 shown in FIG. The extended key will be entered. If the extended key generation circuit is configured to simultaneously generate two sets of extended keys of 32 bits X4, group A of the two sets of extended keys generated by one clock is the first. It can be configured so that it is used in the I function processing circuit 221 and the group B is used in the second function processing circuit 223. As a result, both the extended key generation processing by the extended key generation circuit and the data scramble processing can be performed at the same time, and a delay in processing time can be prevented.

(Sixth embodiment)

FIG. 16 shows a configuration example of the data scramble circuit employed in the sixth embodiment. The data scramble circuit 240 shown in FIG. 16 uses a 32-bit X4 input data bus a, b, c, d to perform encryption / decryption in a 128-bit block unit. And 32 bits x 4 output data buses e, f, g, h.

The de-task function circuit 240 includes a first processing function 2419 having a first I function processing circuit 241, a B function processing circuit 242, and a second I function processing circuit 243. A second processing circuit 250 having a first R function processing circuit 244 and a second R function processing circuit 245 is provided. The data scramble circuit 240 includes an output selector 247 for selectively outputting the output of the first processing block 249 and the output of the second processing block 250, and an output selector 224. A register 248 for holding the output of the register 47 for each clock, and an input-side selector 246 for selectively outputting the input data and the output of the register 248 are provided.

In the data scramble circuit 240 configured as described above, the first I-function processing circuit 241 and the B-function processing circuit 242 are switched by appropriately switching the input selector 246 and the output selector 247. The processing by the second I function processing circuit After that, the HR processing by the second processing block 250 and the IBI processing by the first processing block 249 are performed alternately and repeatedly, and the result is output to the output data bus (e, f, g, h). Can be configured.

In the first session, the input selector 246 is switched to the input data, and the input data a, b, c, and d are processed in the first processing block 249, and then the register 2 4 8 holds that value.

At the next clock, the output selector 247 is switched to the second processing block 250, and the data output from the register 248 is processed by the second processing block 250 so that each function processing is performed. It is executed, and its value is held in register 248.

In the next step, the input selector 246 is switched to the register 248, and the output selector 247 is switched to the first processing block 249. The data output from the 248 is subjected to each function processing in the first processing procedure 249, and the value is held in the register 248. By repeating this multiple times, it is possible to realize a function equivalent to the above-described overnight scrambling circuit.

The first I function processing circuit 241 and the second I function processing circuit 243 have an expanded key generation circuit 500 shown in FIG. 5 and an expanded key generation circuit 520 shown in FIG. The key will be entered. If the expanded key generation circuit is configured to generate 32 bits X4 expanded keys simultaneously for two sets, group A is the first of the two sets of expanded keys generated by one clock. It can be configured so that it is used in the I function processing circuit 241 and the group B is used in the second function processing circuit 243.

In this data scramble circuit 240, two cycles are required for one I-B-I-R-R process, so that the effect of the delay time due to the extended key generation processing by the extended key generation circuit is eliminated.

(Seventh embodiment)

FIG. 17 shows a configuration example of a data scramble circuit employed in the seventh embodiment. In the data scramble circuit 260 shown in FIG. 17, input / output buses a, b, and c of 32 bits X4 are used to perform encryption / decryption in units of 128 bits. , d, and 32 bits X4 output data buses e, f, g, h.

The data scramble circuit 260 includes a first processing block 2668 having a first I function processing circuit 261, a B function processing circuit 262, and a second I function processing circuit 2663, and an R function A second processing block 269 comprising a processing circuit 264 is provided. Also, the detask rumble circuit 260 includes an output-side selector 266 for selectively outputting the output of the first processing block 268 and the output of the second processing block 269, and an output side. It has a register 267 for holding the output of the selector 266 for each clock, and an input-side selector 265 for selectively outputting input data and the output of the register 267.

In the data scramble circuit 260 configured as described above, the first I function processing circuit 26 1 and the B function processing circuit 26 2 2 are switched by appropriately switching the input side selector 26 5 and the output side selector 26 6. After executing the processing by the second I-function processing circuit 263, then by the second processing block 269: after the processing is repeated twice and the IBI processing by the first processing block 268 is alternately repeated. The output data bus (e, f, g, h) can be configured to output the result.

In the first clock, the input selector 265 is switched to the input data side, and the input data a, b, c, d are processed in the first processing block 268, and then the register 26 7 holds that value.

At the next clock, the output selector 2666 is switched to the second processing block 2697, and the data output from the register 2667 is subjected to the R function processing by the second processing block 2669. It is executed, and its value is held in register 267. Similarly, in the next clock, the output selector 266 remains at the second processing block 269, and the data output from the register 267 is converted to the R function by the second processing block 269. Processing is executed, and the value is held in the register 267.

Further, at the next clock, the input selector 265 is switched to the register 267, and the output selector 266 is switched to the first processing block 268. The output data is subjected to each function processing in the first processing block 268, and the value is held in the register 267. By repeating this multiple times, it is possible to realize the same function as the data scramble circuit described above. Becomes

The first I function processing circuit 26 1 and the second I function processing circuit 26 3 have the expanded key generation circuit 500 shown in FIG. 5 and the expanded key generation circuit 500 shown in FIG. The key will be entered. If the extended key generation circuit is configured to generate two sets of extended keys of 32 bits X 4 at the same time, of the two sets of extended keys generated in one clock, group A is the first I function It can be configured to be used in the processing circuit 261 and to use the group B in the second function processing circuit 263.

In this data scramble circuit 260, three cycles are required for one I-B-I-R-R process, so that the influence of the delay time due to the extended key generation processing by the extended key generation circuit is eliminated.

(Industrial applicability)

According to the present invention, it is possible to reduce the circuit scale by configuring a clock synchronous loop in a block cipher algorithm that repeatedly executes basic function processing. Further, by configuring the intermediate key to be generated in advance, the process of generating an expanded key from the intermediate key can be speeded up. Furthermore, in the extended key generation processing, the control of key scheduling can be simplified, and high-speed processing can be realized with a compact circuit.

Claims

The scope of the claims

1.

Performs a de-task ramble using the I function that calculates the exclusive OR of the data and the multiple expanded keys generated from the encryption key, and the B and R functions that shuffle the bits of the data. A data scramble circuit for performing encryption / decryption of a 128-bit common key block cipher,

After processing the I function, the processing block that performs processing in the order of the B function, the I function, the R function, the R function, and the I function is processed n times, and then the processing is performed in the order of the B function and the I function. A data scramble circuit that includes an I function processing circuit that processes a function, a B function processing circuit that processes the B function, and an R function processing circuit that processes the R function.

2.

After processing the I function, the processing block that performs processing in the order of the B function, I function, R function, R function, and the I function is processed n times, and then each I function for performing the processing in the order of the B function and the I function The data scramble circuit according to claim 1, wherein all of the processing circuit, the B function processing circuit, and the R function processing circuit are mounted.

3.

A clock synchronous loop connected in the order of the B function processing circuit, the I function processing circuit, the R function processing circuit, the R function processing circuit, and the I function processing circuit is configured, and the I function processing circuit, the clock synchronous loop, the B function processing circuit The data scramble circuit according to claim 1, wherein the data scramble circuit is connected to the I function processing circuit in this order.

Four .

Data scrambling is performed by using an I function that performs an exclusive OR operation of data with a plurality of expanded keys generated from an encryption key and a B function and an R function that stir data bits. A data scramble circuit for performing encryption / decryption of a common key block cipher having a key length of 128 bits / 192 bits / 256 bits and a processing block of 18 bits.

After processing the I and B functions, process the processing block that performs processing in the order of the I function, R function, R function, I function, and B function n times, and then perform the processing of the I function. A de-task function circuit which includes an I function processing circuit for processing the I function, a B function processing circuit for processing the B function, and an R function processing circuit for processing the R function.

Five .

A clock synchronous loop is connected in the order of the I function processing circuit, the R function processing circuit, the R function processing circuit, the I function processing circuit, and the B function processing circuit, and the I function processing circuit, the B function processing circuit, and the clock synchronization The de-task ramping circuit according to claim 4, wherein the loop is connected to the I-function processing circuit in this order.

6.

A first I function processing circuit;

A processing block in which a second I function processing circuit, a first R function processing circuit, a second R function processing circuit, and a third I function processing circuit are sequentially connected;

A selector for selectively outputting an output of the first I function processing circuit and an output of the processing block;

A B function processing circuit to which the output of the selector is connected,

A register for latching the output of the B function processing circuit every clock cycle and inputting the latched output to the processing block;

A fourth I function processing circuit to which the output of the register is connected,

The data scramble circuit according to claim 5, further comprising: a clock synchronous loop configured by the processing block and the B function processing circuit.

7.

Calculates the exclusive OR of multiple extended keys generated from an encryption key and Data scrambling is performed using a number and a B function and an R function that stagger the data bits, and a common key block with a key length of 128/192/256 bits and a processing block of 128 bits A data scramble circuit for performing encryption / decryption of encryption,

After performing processing in the order of I function, B function, and I function, processing the I function in order to process n times the processing block that performs processing in the order of R function, R function, I function, B function, and I function A data scramble circuit that includes an I function processing circuit for performing the B function, a B function processing circuit for processing the B function, and an R function processing circuit for processing the R function.

8.

A first processing block in which a first I function processing circuit, a B function processing circuit, and a second I function processing circuit are sequentially connected;

A second processing block in which a first R function processing circuit and a second R function processing circuit are sequentially connected;

A selector for selectively inputting any of input data and an output of the second processing block to the first processing block;

The data scramble circuit according to claim 7, comprising:

9.

Data scrambling is performed by using an I function that calculates the exclusive OR of data and multiple extended keys generated from the encryption key, and a B function and an R function that shuffle the data bits. A data scramble circuit for encrypting / decrypting 28/192 bits / 256 bits, processing block 128 bits / common key block cipher,

The I function is processed in order to alternately perform a plurality of times a first processing block that performs processing in the order of the I function, the B function, and the I function, and a second processing block that performs processing in the order of the R function and the R function. And a B-function processing circuit for processing the B function; and a R-function processing circuit for mounting the R function processing circuit for processing the R function.

Ten .

A second processing block to which a first R function processing circuit and a second R function processing circuit are connected, and an output side for selectively outputting one of the output of the first processing block and the output of the second processing block A selector,

An input selector for selectively inputting either input data or an output of the output selector to the first I function processing circuit;

The data scramble circuit according to claim 9, comprising:

1.

Performs a de-task ramble using the I function that calculates the exclusive OR of the data and the multiple expanded keys generated from the encryption key, and the B and R functions that shuffle the bits of the data. A data scramble circuit for performing encryption / decryption of a 128-bit common key block encryption,

An I function for processing the I function in order to process a first processing block that performs processing in the order of the I function, the B function, and the I function, and a second processing block that performs the R function processing a plurality of times in a predetermined order. A data scramble circuit that includes a processing circuit, a B function processing circuit that processes the B function, and an R function processing circuit that processes the R function.

1 2.

A second processing block including a first R function processing circuit;

An output-side selector for selectively outputting one of the output of the first processing block and the output of the second processing block;

The first selector selectively selects one of input data and an output of the output-side selector. An input selector for input to the I function processing circuit,

The data scramble circuit according to claim 11, comprising:

13 .

The B function processing circuit includes: an input data conversion unit configured to convert 32 bits X4 input data into 4 bits X32 input data; and 32 4 bits connected to the input data conversion unit. It is provided with an output SboX and an output data converter for converting the output data of 4 bits x 32 output from each of the 4 bits SboX into the output data of 32 bits X4. The data scramble circuit according to claim 1, 4, 7, 9, or 11.

14 .

The R function processing circuit includes an F function processing circuit that mixes data bits, and mixes two input data bits of 32 bits X 4 input data to output 32 bits X 2 outputs. An F-function processing circuit that outputs the data, and two XOR circuits that perform an exclusive OR operation on the output data of the F-function processing circuit and the remaining two of the input data. De-task clamp circuit according to 1, 4, 7, 9 or 11.

1 5.

The F-function processing circuit includes: an input data conversion unit configured to convert input data of 32 bits and a software X2 into a plurality of input data having an unequal number of bits; and a plurality of input data conversion units connected to the input data conversion unit. S bo X, an MDS operation circuit to which an output from the S b 0 X is input and performing an exclusive OR operation using MDS, and a multiplication circuit for multiplying output data of the output data conversion unit by a predetermined value. 15. The data scramble circuit according to claim 14, further comprising: an XOR circuit for calculating an exclusive OR of an output of the multiplication circuit and an output of the output data conversion unit.

1 6.

The plurality of S boxes are two 6-bit S boxes and four 5-bit S boxes. 16. The data scramble circuit according to claim 15, wherein the input data conversion unit converts 32 bits X2 input data into 6 bits X2 and 5 bits X4 input data.

1 7.

An intermediate key generation circuit for generating an intermediate key from the encryption key,

An expanded key generation circuit that generates a plurality of expanded keys from the intermediate key generated from the intermediate key generation circuit;

A data scramble circuit for performing data scramble using an I function for calculating an exclusive OR of the data and the extended key, a B function and an R function for stirring data bits,

A cryptographic circuit for performing encryption / decryption of a common key block cipher having a key length of 128 bits / 192 bits / 256 bits and a processing key of 128 bits;

The intermediate key generation circuit executes an intermediate key generation process before the data scramble process of the data scramble circuit;

The encryption circuit, wherein the extended key generation circuit generates the extended key in parallel with the detask rumble processing of the detask rumble circuit.

1 8.

The intermediate key generation circuit is configured to execute the extended key generation circuit based on an order parameter table set according to an order radix and an index parameter table set according to an index radix. The encryption circuit according to claim 17, wherein the intermediate key used in the extended key generation processing is sequentially generated.

1 9.

The intermediate key generation circuit includes:

An input data conversion unit that divides the encryption key into 32 bits,

An addition circuit that adds a predetermined value to the input data from the input data conversion unit; a multiplication circuit that multiplies the input data from the input data conversion unit by a predetermined value; An XOR circuit for calculating an exclusive OR of an output value of the addition circuit and an output value of the multiplication circuit;

19. The encryption circuit according to claim 18, further comprising: a storage unit configured to store a predetermined value to be added in the addition circuit as a preset value calculated in advance.

2 0.

The intermediate key generation circuit, based on an order parameter table set according to the order radix and an index parameter table set according to the index radix, Generate a number of intermediate keys according to one type and the type of index,

The extended key generation circuit is provided for the number of tables set in the index parameter table, and is selectively provided according to the order parameter table and the index parameter table. 10. The encryption circuit according to claim 19, wherein an expanded key is generated from the input intermediate key.

twenty one .

An expanded key output selector provided by the data scramble circuit for the number of expanded keys required in one cycle, for selectively inputting the expanded key generated by the expanded key generation circuit to the destructive circuit; ,

20. The encryption circuit according to claim 20, further comprising: storage means for storing an expanded key selection control table of the expanded key output selector.

twenty two .

12. An expanded key generation circuit for generating an expanded key to be input to the data scramble circuit according to claim 6, wherein the second expansion is input to the second I function processing circuit. An expanded key generation circuit that generates a key group together with the first expanded key group input to the first I function processing circuit or the third I function processing circuit one cycle before.