WO2014166732A1

WO2014166732A1 - Multifunctional shift register

Info

Publication number: WO2014166732A1
Application number: PCT/EP2014/055963
Authority: WO
Inventors: Erwin Hess; Bernd Meyer
Original assignee: Siemens Aktiengesellschaft
Priority date: 2013-04-11
Filing date: 2014-03-25
Publication date: 2014-10-16
Also published as: DE102013206430A1

Abstract

Linear feedback shift register (1), comprising a linear arrangement (2) of memory cells, a feedback function (3) and a dividing means (4), wherein the dividing means (4) splits the shift register (1) into at least two subregisters (1a, 1b) having a respective shortened linear arrangement (2a, 2b) of memory cells and a respective shortened linear feedback function (3a, 3b) such that the linear feedback shift register (1) and at least one of the subregisters (1a, 1b) can have data written to them by a respective irreducible feedback polynomial.

Description

description

Multifunctional shift register The present invention relates to the technical Ge ^¬ Biet the linear feedback shift register.

Linear feedback shift registers are important and frequently ^¬ fig components used in algorithms and devices. They can be one hand in an elegant way theoretically be ^¬ write using polynomial arithmetic over a finite field, on the other hand they are efficient and implemented with little hard ^¬ ware used as electronic components. The strings generated by shift registers have specific advantageous properties that make them meaningful for a large number of technical applications.

Shift registers are used inter alia as counters, for error detection in coding theory (CRC codes) and for generation of pseudorandom strings in statistics and signal processing (correlators, modulators, demodulators,

Spread-spectrum applications). Of particular importance are shift registers for cryptography: They are used there on the one hand in asymmetric cryptography as a computation for the implementation of arithmetic of finite extension bodies (eg for methods based on elliptic curves over finite expansion bodies); On the other hand, they are a commonly used basic component for a whole class of cryptographic methods - so-called.

Stream ciphers - as well as other derived security mechanisms, such as MACs.

It is called a binary shift register when the strings generated by the shift register consist of a sequence of the two binary digits "0" and "1". Basically, there are two - mutually dual - execution ^¬ forms linear feedback shift registers, the Fibonacci shift registers and the Galois shift registers. Figure 1 shows a sketch of the basic structure of all ^¬ common binary linear feedback shift register of length n in the Fibonacci expression.

The register consists of n memory cells So through S _n -i. These memory cells are designed to receive one of the two binary digits "0" or "1". Between the individual S ± and S i ₊ i, the content of the cell S i ₊ i can be tapped and linked via the XOR function XOR with corresponding contents of other cells and "fed back" into the last cell S _n -i picking up the memory contents is indicated in Figure 1 by the with the terms ai, ..., a _n -i Lettering ^¬ ended switch. If the contents of the cell S ± fed back, the with a ± designated switch is open ^¬ closed, the corresponds to a ± = 1. If, conversely, the content of the cell S ± not fed back, the about ^¬ associated switch is open, in which case a = 0 ±.

If we denote by S ± (t) the contents of memory cell S ± at clock time t, the operation of such a shift register can be described as follows:

• S ± (t + 1) = S _{i +} i (t), for i = 0, ..., n-2, and

• S _n _i (t + 1) = S ₀ (t) eSi (t) + a ai S i (t) + ^■■■ + Θ a _n -i S _n _i (t), where each of the values ai, ..., a _n -i is either "0" or "1" and "Θ" denotes the XOR function.

The polynomial f (X) = X ⁿ + a "-IX ^n_ + ¹ + ^■■■ AIX ¹ + 1 is referred to as" characteristic polynomial "or a" ^¬ Rückkopplungspoly nom "of the Fibonacci-shift register. The respective contents of the memory cell SO , Sl, S2, ... can be output as a bit stream. Figure 2 shows a sketch of the basic structure of all ^¬ common binary linear feedback shift register of length n in the Galois expression. Regarding the n memory cells So to S _n -i there is no Un ^¬ terschied to Fibonacci expression. The difference to the Fibonacci form is that in the Galois register only the content of the last memory cell S _n -i is tapped and fed back. Between the individual memory cells are XOR gate XOR, the contents of the cell S _n -i can ver linked ^¬ together with the contents of the cell S ± about this XOR function and in the lying behind cell S i ₊ i fed ^¬ the. The possibility for linked feeding of the memory contents is indicated in the sketch (2) by the switches labeled with the designations bi, ..., b _n -i. If the content of the cell S _n -i is fed back into the cell Si, the switch denoted by b ± is closed, which means that b ± = 1. Conversely, if the content of the cell S _n -i is not fed back into S ±, the associated switch is open, in which case b ± = 0 holds.

In formulas, the operation of a Galois shift register can be described as follows: If we denote by S ± (t) the contents of memory cell S ± at clock time t, the operation of such a shift register can be described as follows:

• S _± (t + 1) = S ii (t) + ebiS _n -i (t), for i = 0, ..., n-1.

So (t + 1) = Sn-1 (t)

Here, each of the values bi, ..., b _n -i is either "0" or "1", and "Θ" denotes the XOR function.

The polynomial g (X) = X ⁿ + b _n -IX ^{"" 1} + ^■ "BIX + ¹ + 1 is referred to as" characteristic polynomial "or a" ^¬ Rückkopplungspoly nom "of the Galois shift register. Of the algebraic structural features of these polynomials f (X) and g (X), the properties of the sequences produced by the shift register are critically dependent. These features of the polynomial are in turn determined by which of the numbers ai,..., A _n -i, resp. bi, ..., b _n -i have the value "0" and which have the value "1".

Particularly important in practice are shift registers whose feedback polynomials f (X) resp. g (X) have the following properties:

• f (X) - resp. g (X) - is irreducible

• f (X) - resp. g (X) - is "primitive"

The "primitiveness" of the polynomial is the stronger requirement: every primitive polynomial is irreducible, but not every irreducible polynomial is primitive.

The advantageous properties of linear feedback shift registers with irreducible or primitive feedback function are based essentially on the two following known features:

1. If the feedback function f (X) is primitive, the output sequence will always have the length 2 ⁿ -l and every 2 ⁿ -l possible binary vectors for each initialization of the shift register different from (0, ...., 0) (So, ... · S _n i) act as internal to ^¬ the shift register stood.

2. If the feedback function f (X) is irreducible, then has the output sequence for each of (0, ...., 0) different Anfangsbele ^¬ supply of the shift register is always the same length, this is a divisor of 2 ⁿ -l. Overall occur again all possible binary vectors (So, ...., S ni) Φ (0, ...., 0) as an internal state of the shift register.

Often, there is a need to have multiple such shift register ^circuits in an application or product to realize at the same time. This situation occurs when using it for cryptographic purposes:

• You then need z. For example, for asymmetric methods based on elliptic curves over GF (2 ⁿ ) a Galois

Shift registers of length n; this shift register is the core of an arithmetic unit for implementing the required basic arithmetic of the finite field

GF ( ²ⁿ ).

• In general, asymmetric cryptographic Ver ^¬ will go along with symmetric processes (eg. As for encryption or for a MAC calculation) is used. Also for these mechanisms one can use one or more shift registers; usefully have these

Shift registers have a much shorter length than when used for asymmetric cryptography. Typical is a length of ~ n / 2. Generally, it is the typical situation that covering different ^¬ nen functionalities which are realized by means of shift registers in a particular device are selected in sequence. Thus, in the case of the above-mentioned application in cryptography z. B. initially agreed with the asymmetric part a key. With the following symmetric

After that, the data to be transmitted is encrypted or provided with a MAC.

The flip-flops, which form the memory cells of the shift register, are the circuit-technically more complex part and also significantly larger. The logic gates for the realization of the feedback map play only a minor role in terms of the number of gates and the space required by the circuit or code size of the program.

The present invention is therefore based on the object to provide a shift register, which allow reduced costs. This object is achieved by the solutions specified in the independent claims. Advantageous embodiments of the invention are specified in further claims.

According to a first aspect, the invention relates to a linear feedback shift register. The linear feedback shift register comprises a linear array of memory cells, a feedback function, and a partitioning means. The partition means divides the shift register in such a manner in at least two sub-registers, each having a shortened linear array of memory cells and each having a shortened linear feedback function that the linear feedback shift register and at least one of the Un ^¬ terregister an irreducible Rückkopplungspoly ^¬ nom can be described by each.

In one aspect, the invention relates to a method for multifunctional use of such a shift register. A first application is carried out by means of the entire Schieberegis ^¬ ters. A second application by means of the Minim ^¬ least performed one sub-register. The invention will be explained in more detail below with reference to the drawing in ^¬ example. Showing:

Figure 1 is a sketch of a linear feedback binary shift register in the Fibonacci-expression according to the prior art;

Figure 2 is a sketch of a linear feedback binary shift register in the Galois expression according to the prior art;

FIG. 3 shows a linearly fedback shift register according to an embodiment of the invention;

Figure 4 shows the linear feedback shift register of Figure 3, highlighting further aspects. Figures 3 and 4 show a preferred embodiment of a linear feedback shift register 1. The shift ^¬ registers 1 comprises a linear array 2 of Speicherzel ^¬ len, a feedback function 3 and a subdivision means 4. The subdivision means 4 divides the shift register 1 into two sub-registers la and lb up. The shift register 1a comprises a shortened linear array 2a of memory cells and a shortened linear feedback function 3a. The shift register 3b lb includes a shortened linear array 2b of memory cells and a shortened linear feedback Kopp ^¬ distribution function. The linear feedback shift register 1, and at least one of the sub-registers la and lb are respectively described by an irreducible, preferably primitive, feedbackers ^¬ lungspolynom. Preferably, however, both sub-registers la and lb can be prepared by a respective feedback polynomial Primiti ^¬ ves.

The shift register 1 can be embodied in Fibonacci-expression or in Galois-expression. In the exemplary embodiment illustrated in FIGS. 3 and 4, a Fi ^¬ bonacci characteristic is assumed. The linear array 2 and the feedback function of the shift register 3 can 1 since ^¬ forth, except the peeled ^¬ th between two memory cell sub-division means 4, comparable wired as shown in Figure 1 and / or be interconnected. Also includes the slide switch ^¬ beregister 1 ai, a _2, ... a _n i over which the Speicherinhal ^¬ te can be passed to the designed as XOR-layer feedback ^¬ function. 3 Instead of the division into 2 sub-registers, the shift register 1 can also be divided into more than 2 sub-registers, of which at least one, several or all can be represented by a respective irreducible feedback ^polygon , preferably by a respective primitive feedback polynomial.

The subdivision means 4 shown in ^FIGS . 3 and 4 comprises two multiplexers 4a, 4b. In alternative embodiments AND gates are used for the subdivision means.

Preferably, moreover, each of the memory cells of the shift register 1 can be optionally fed back by means of at least one switching means, so that the linear feedback shift register 1 and the at least one of the sub-registers la, lb can be described adaptably in a variety of ways by the respective irreducible feedback polynomial.

The shift register 1 is particularly suitable for performing a hybrid cryptographic method and / or a

Arithmetic of a finite field of the characteristic 2

(GF (2 ⁿ )). Preferably, in the context of the hybrid cryptographic method, an asymmetric cryptographic method based on elliptic curves over a finite field of characteristic 2 (GF (2 ⁿ )) is performed using the entire shift register 1, and a symmetric cryptographic method is performed using the larger one of the two sub-registers 1a, 1b, or by means of one of the sub-registers, which is about half the size of the entire shift register 1.

According to a preferred embodiment, the Rückkopp- is averaging function 3 of the binary linear feedback shift register 1, and the dividing means 4 is selected in such a way that using a single shift register 1 simultaneously meh ^¬ eral - but at least two - shift register 1, la, realized lb un ^¬ terschiedlicher length which have the required and advantageous mathematical, statistical or cryptographic properties. For this purpose, the possibility is created, the linear feedback binary shift register 1 of length n logically split at least one suitable location, so that at least a shorter shift register la of length m is formed, which also has the above advantageous properties, without causing changes to the position of Feedback be ^¬ handles required. Figures 3 and 4 show the separation of a Fibonnacci- shift register 1, wherein the ent ^¬ standing by the separation process shorter shift register lb of the parts register cells _reC hts 2b and XOR layer 3b consists _reC hts.

If the given shift register 1 are separated logically outlined in Figure 3 point 9, as unmarried ^¬ Lich two multiplexers 4a, 4b and the corresponding wiring are processing at the specified location to insert, further changes to the feedback taps are not necessary. The circuit structure can then be realized as shown in Figure 4 by means of the multiplexer 4a, 4b. For implementation of preferred embodiments of the invention, the associated feedback polynomial

fi (X) = X ⁿ + a _n -iX ^{11 "1} + ^■■■ + a _m X ^m + ^■■■ + aiX ¹ + 1 of degree n are chosen so that the following properties are fulfilled: · fl (X ) = is primitive or at least irreducible,

• a _m = 1,

• f2 (X) = X ^m + "'+ AIX ¹ + 1 is primitive or at least irreducible. This ensures that both the total register of length n as well as the shorter Schiebere ^¬ gister the length therein m has the desired properties.

Similarly shift registers can also be subdivided into Galois characteristics.

It is also possible to carry out the separation of the shift register so that the shorter shift register consists of the parts register _cells _left 2a and XOR _{Schichti inks} 3a. Likewise, with a suitable choice of the feedback polynomial, a division into a plurality of smaller shift registers is also possible.

According to embodiments of the invention, the feedback polynomial fl (X) - resp. gi (X) - a binary linear rückge ^¬ coupled shift register so determined that both it itself and the polynomial contained therein f2 (X) - resp. g ₂ (X) have the desired properties, namely to be primitive or at least irreducible.

As a result, it is possible to realize a plurality of functionalities with the cells of a long shift register with little additional implementation effort.

The invention is particularly advantageous for hybrid cryptographic methods: With a Galois shift register of length n (useful lengths are about n = 131 or n = 163) as the core, a serial-parallel arithmetic unit for the arithmetic in the finite field can be used Realize GF (2 ⁿ ). With the aid of this arithmetic, key exchange and authentication procedures can be realized on the basis of elliptic curves via GF (2 ⁿ ). These methods can achieve a security level of about 2 ^{n 2} , ie in the concrete examples mentioned about 2 ⁶⁵ resp. 2 ⁸¹ . The appropriate level of security of a symmetric crypto tographischen process (or stream cipher MAC) may reach 2 ^{n 2} can be ^¬ already with a shift register of length. In the examples mentioned so with shift registers of length 65 respectively. 81. How to realize symmetrical cryptographic mechanisms with the desired level of security with such shift registers is described in the specialist literature (filter generator, Geffe generator, etc.). A particular advantage of embodiments of the invention lies in the fact that one of the arithmetic Basisisko ^¬ nente for the implementation of an asymmetric cryptographic process even more - and to a certain extent "en passant" and almost free - realize one or more symmetrical ^¬ mechanisms can.

Of particular importance is the invention for applications in which the implementation effort (chip area, code size) must be minimized, such as passive RFID.

The following are examples of parameter sets that are particularly suitable for the low-cost use of hybrid cryptographic methods based on elliptic curves over GF (2 ¹³¹ ) and GF (2 ¹⁶³ ). The Po ^¬ lynompaare listed in Table 1 are at least irreducible. The products listed in Table 2 on ^¬ Polynompaare even primitive. In both tables, each row represents a respective Polynompaar represents. Schiebere ^¬ gister according to embodiments of the invention can be, for example, produce, by the shift register 1 configured and / or adapted is to describe the entire shift register by a polynomial in the first column, while one of the Sub-register la, lb is described by the polynomial associated polynomial in the second column.

Table 1: Irreducible polynomial pairs fi = χ ^Λ 131 + χ ^Λ 10 + χ ^Λ 5 + χ ^Λ 4 + 1 f ₂ = χ ^Λ 65 + χ ^Λ 10 + χ ^Λ 5 + χ ^Λ 4 + 1 fi = χ ^Λ 131 + χ ^Λ 18 + χ ^Λ 16 + χ + 1 f ₂ = χ ^Λ 65 + χ ^Λ 18 + χ ^Λ 16 + χ + 1 fi = χ ^Λ 131 + χ ^Λ 19 + χ ^Λ 16 + χ ^Λ 2 + 1 f ₂ = χ ^Λ 65+ χ ^Λ 19 + χ ^Λ 16 + χ ^Λ 2 + 1 fi = χ ^Λ 131 + χ ^Λ 26 + χ ^Λ 21 + χ + 1 f ₂ = χ ^Λ 65 + χ ^Λ 26 + χ ^Λ 21 + χ + 1

Table 2: Primitive polynomial pairs

Embodiments of the invention therefore address the need to provide binary linear feedback shift registers whose feedback functions are selected to be simultaneously appropriate for a plurality of different shift register applications of registers of different lengths. Especially for use in the low-cost / low-energy sector - for example for RFID tags or for battery-powered sensors - there is an urgent need for such multifunctional shift registers. In most applications of shift registers in the coding theory and signal processing, the register used have a relatively small number of memory cells so that savings due to USAGE ^¬-making multifunctional shift register when convenient on record are likely to play a minor role and therefore probably not considered were.

The situation is different when shift registers, for example, for the realization of a serial-parallel computation for multiplication in finite fields of the form

GF (2 ⁿ ) can be used. In these applications (in particular for the realization of cryptographic components), the number of shift register cells - which is at the same time the degree of expansion n of the finite field - can easily go into the hundreds.

Preferred embodiments of the invention overcome the disadvantages of the prior art by providing measures for multiple use of a shift register and thus reduction the circuit scale - in particular to reduce the number of required to ^¬ shift register cells - are made. Although preferred embodiments of the invention have been described herein primarily in terms of their advantageous properties for implementing cryptographic functionality, particularly in the low-cost / low-energy domain, the invention is not limited to this field. There is also an improvement over that

State of the art, if other technical methods (coding, signal processing, etc.) implemented on low-cost / low-energy devices or other devices that covered in various ^¬ by the scope and meaning of the claims including equivalents based on linear feedback shift registers.

Claims

claims

1. Linear feedback shift register (1), comprising a linear array (2) of memory cells, a feedback function (3) and a subdivision means (4), wherein the Un ^¬ terteilungsmittel (4) the shift register (1) in at least two sub-registers (la, lb), each having a ver ^¬ shortened linear array (2a, 2b) of memory cells and each having a shortened linear feedback function (3a, 3b) is divided,

in that the linear feedback shift register (1) and at least one of the sub-registers (la, lb) are each writable by an irreducible feedback polynomial.

Second shift register (1) according to claim 1, wherein the linear feedback shift register (1) and the at least one of the sub-registers (la, lb) are each writable by a primitive feedback polynomial.

3. shift register (1) according to any one of the preceding claims, wherein a plurality or all of the sub-registers (la, lb) each by an irreducible feedback polynomial, preferably each by a primitive feedback polynomial, are writable.

4. shift register (1) according to any one of the preceding claims, wherein the subdivision means (4) logic gate functions ^¬ , preferably AND gate or multiplexer (4a, 4b), summarized.

5. shift register (1) according to any one of the preceding claims, wherein each of the memory cells by means of at least one switching means is optionally rückkoppelbar.

6. Shift register (1) according to one of the preceding claims, wherein the shift register (1) is designed and / or adapted, that the linear feedback shift register (1) and the at least one of the sub-registers (la, lb) by the respective irreducible feedback polynomial are writable.

7. Shift register (1) according to one of the preceding claims, wherein the shift register (1) is adapted to perform a hybrid cryptographic method.

8. Shift register (1) according to one of the preceding claims, wherein the shift register (1) is adapted to support an arithmetic of a finite field of the characteristic 2 (GF (2 ⁿ )).

9. shift register (1) according to any one of the preceding claims, wherein the shift register (1) is adapted to perform an asymmetric cryptographic method using the entire shift register (1), and a symmet ^¬ rische cryptographic method by means of one of min mind ^¬ least to perform a sub-register (1a, 1b) writable by an irreducible polynomial.

The shift register (1) of claim 9, wherein the asymmetric cryptographic method is based on elliptic curves over a finite field of characteristic 2 (GF (2 ⁿ )).

11 shift register (1) according to claim 9 or 10, wherein the sub-register (la, lb) on which the symmetric kryp ^¬ tographische method is feasible, the largest of the sub-registers (la, lb) and / or about half as large as the entire shift register (1) is.

12. Shift register (1) according to one of the preceding claims, wherein the shift register (1) is comprised of an RFID.

13. A method for multifunctional use of a shift register (1) according to any one of the preceding claims, wherein a first application by means of the entire shift register (1), and a second application is performed by means of the at least one sub-register (1a, 1b).

14. The method of claim 13, wherein an asymmetric cryptographic method using the entire

Shift register (1) is performed, and a symmetric cryptographic method by means of one of at least ei ^¬ nen recordable by an irreducible polynomial sub-register (la, lb) is performed.

15. The method of claim 13 or 14, wherein the sub-register (la, lb) on which the symmetric cryptographic method is performed, the largest of the sub-registers (la, lb) and / or is about half as large as the entire shift register ( 1).