DE4016203A1 - METHOD FOR BLOCK-ENCRYPTING DIGITAL DATA - Google Patents

Abstract

The process is for the blockwise coding of digital or digitised analog data. At a moment j, the plain text is read into a first operation register as a binary data block (T)<(j)> of L bits and then converted there into an intermediate text C1<(j)> by means of a temporary code S1<(j)> and a reversible function F. The intermediate text C1<(j)> is then transferred in parallel to a second operation register in which it is converted into an intermediate text C2<(j)> by means of a temporary code S2<(j)> and the reversible function F. After a total of R such conversion steps there exists the intermediate text CR<(j)> representing the code text C<(j)> at moment j, whereby the transfer of the individual intermediate texts from one operation register to the next takes place simultaneously in parallel in accordance with the systolic algorithm. The conversion of the data block in operation register k takes place in several steps, whereby the number of steps is set and the individual steps are formed by rapid elementary operations. The sequence of the elementary operations is determined by a variable permutation Pik<(j)> which forms part of the code Sk<(j)> and is so formed that each of the conversion steps is completed precisely once.

Description

The invention relates to a method for block-by-block encryption of digital data or digitized analog data, in which at a point in time j the plaintext to be encrypted is read as a binary data block T ^(j) of L bit into a first operation register and then therein by means of a temporary key S 1 ^(j) and a reversible function F is converted to an intermediate text C₁ ^(j) , whereupon the intermediate text C₁ ^{(j) is transferred in} parallel to a second operation register in which the intermediate text C₁ ^(j) by means of a temporary key S₂ ^(j) and the reversible function F is converted to an intermediate text C₂ ^(j) , so that after a total of R such conversion steps, the intermediate text C _R ^(j) representing the ciphertext C ^(j) at time j is formed, the transfer of the individual intermediate texts from one into the subsequent operation register is performed simultaneously in parallel according to the systolic algorithm.

Such an encryption method without the systolic The algorithm is called the DES method known and for example by J. Seberry et al. in "Cryptography: An Introduction to Computer Security", Prentice Hall described.

However, the disadvantage of this known method is that insufficient processing speed, the in today's cryptographic applications and common data transfer speeds is required.

The invention has for its object a method of the type mentioned to improve so that even the currently used  Data transfer speeds in the range of 140 Mbit / sec a synchronous encryption is possible, while at the same time increasing data security at only little additional hardware is to be achieved.

This object is achieved according to the invention in that the conversion of the data block in the operation register k takes place in several conversion steps, the number of conversion steps being fixed and the individual conversion steps being formed by fast-running elementary operations, the order of which is determined by a variable permutation Pi _k ^{(j ) is} determined, which is part of the key S _k ^(j) and is formed such that each of the conversion steps is carried out exactly once.

The progress achieved by the invention essentially consists in the fact that exceptionally high processing speeds are achieved by using elementary operations, since this usually requires only a single time cycle. Due to the freely selectable and constantly changing sequence of the elementary operations, an exceptionally high level of data security is achieved with comparatively little effort. Since the permutation is variable and depends on the time j and the permutation as a recursive function is newly determined for each time j, there are a total of 10 for each operation register and each time j! different permutations are available. With a number of R operation registers, a new one can be selected for each point in time from (10!) ^R different images. Even at R = 4 you get an additional safety factor of (10!) ⁴ <1.73 · 10²⁶, which requires an extraordinarily small additional hardware expenditure of around 20%. A power of two is expediently chosen for the length L of the data block.

For the start of a data transmission, the method provides that the keys S₁ ⁽¹⁾ , S₂ ⁽¹⁾ ,. . ., S _R ⁽¹⁾ are specified as start keys at the first point in time and are adopted unchanged for a specified number of times. The set of start keys must be known to both participants together and can be distributed using a modern public key procedure, for example. The possible advantages of a selected plaintext attack (in which the attacker has a ciphering device) over a known plaintext attack (in which the attacker has clear and associated ciphertext) can be excluded by the fact that a preliminary phase of approx. 1 sec is connected upstream, in which a physical white noise (which cannot be influenced) is transmitted in encrypted form and only then is the text to be transmitted encrypted.

It can be advantageous here that the start key for 2R times are taken over unchanged.

In a preferred procedure according to the invention the keys following the start key as recursive functions from returning a particular Intermediate text formed. This has the advantage that a Access to the keys that generate the following Intermediate texts from the outside are usually not possible.

It can also be provided that the return of the Intermediate text delayed via intermediate register he follows. The time difference is necessary because of the Time difference due to the systolic algorithm: The Receiver can only be decrypted after 2R time units have and is then in the possession of all related ones Intermediate texts.  

In a particularly expedient embodiment of the invention, it is provided that the keys following the start key act as recursive functions
S _k ^(j) = f _k (S _k ^(j-1) , C _{R / 2} ^(j-2R) ) can be calculated.

Basically, the number of in one Elementary operations to be performed can be freely chosen. With regard to the available standing number of sensible and short operations The invention provides that in each of the Operation register a total of ten conversion steps take place, whereby ten different Elementary operations can be used.

It has proven to be advantageous that for each of the conversion steps the data block is first transferred to its own sub-register, the elementary operation is carried out there, and the data block is then transferred back to the operation register, the elementary operations depending on special subkeys of the temporary key S _k ^(j) . It is further advantageous if the operation register transfers the data block to all sub-registers for each conversion step, the data block in all sub-registers is subjected to the respective elementary operation, and then the operation register takes over the data block of the sub-register determined by the permutation Pi _k ^(j) .

The following are within the scope of the invention Elementary operations provided:

A first elementary operation can consist of an addition, the output block y = (y _i ) ₀ ^{L-1 being} calculated for the input block x = (x _i ) ₀ ^L-1 and the partial key a = (alpha _i ) ₀ ^L-1 by y _i = x _i + alpha _i mod 2 = x _i ⊕ alpha _i .

A second elementary operation can consist of a conditional exchange, whereby the output block y = (y _i ) is calculated for the input block x = (x _i ) ₀ ^L-1 and the subkey b = (beta _i ) ₀ ^{L / 2-1} that x _i and x _{i + L / 2 are} exchanged if beta _i = 1.

A third elementary operation can consist of a conditional exchange, whereby the output block y = (y _i ) is calculated for the input block x = (x _i ) ₀ ^L-1 and the subkey b = (beta _i ) ₀ ^{L / 2-1} that x _i and x _{L-1-i are} exchanged if beta _i = 1.

A fourth elementary operation can consist of a 2 Matrix multiplication exist in which the L-bit block first split into L / 2 2-bit blocks and then on each such one of the matrix operations

is applied, their selection by one 2-bit key is controlled.

A fifth elementary operation can be done Triple permutations exist for which the L-bit block first split into [L / 3] 3-bit subsets and open permutation is performed on each subset, where the selection is made using a 3-bit key.

A sixth elementary operation can consist of one 4-bit mapping exist, for which the L-bit block initially is split into L / 4 4-bit blocks, with the element of such a 4-bit block as a number between 0 and 15, d. H. as an element of Z₁₆ = {0, 1, 2,. . ., 15} is understood, whereupon 4 b Abbildungenective pictures Phi₁,  Phi₂, Phi₃, Phi₄ are considered on Z₁₆ and one of them is applied to a 4-bit block, the selection is made using a 2-bit key.

A seventh elementary operation can consist of a 4-bit cyclic convolution exist, in which the L bit first Block split into L / 4 4-bit blocks and then on each of the blocks with a cyclic convolution y = x * c

is executed, where c = (c _i ) ₀³ has odd parity and one 3-bit key per 4-bit block controls the selection among the parameter vectors c.

An eighth elementary operation can consist of an 8 bit cyclic convolution exist, in which the L bit first Block split into L / 8 8-bit blocks and then on each of the blocks with a cyclic convolution y = x * c

is executed, where c = (c _i ) ₀⁷ has odd parity and one 7-bit key per 8-bit block controls the selection and the parameter vector c.

A ninth elementary operation can consist of a cyclic shift C _m , in which the L-bit block is shifted cyclically by m = k · L / 16 bits, the value k being selected using a ₂log L / 16 bit key.

A tenth elementary operation can consist of a 16-bit variable cyclic shift, in which the L-bit block is first divided into L / 16 16-bit blocks, then the Hamming weight w (x) is calculated for each of the 16-bit blocks and finally each block is cyclically shifted by w (x) positions so that y = C _{w (x)} · x.

Finally, there is also the possibility that the conditional exchange already described is replaced by a general conditional exchange, the total block being divided into L / 2 subsets and the elements of the i-th subset being exchanged if beta _i = 1 for an L / 2-bit partial key beta = (beta _i ) ₀ ^{L / 2-1} .

In the following the invention with reference to the Drawing explained in detail; show it:

Fig. 1 is a schematic representation of an apparatus for performing the method according to the invention,

FIG. 2 shows a likewise schematic detailed illustration of a section of the object according to FIG. 1.

The method described below is used for block-by-block encryption of digital data or digitized analog data, in which, at a point in time j, the plaintext T ^(j) to be encrypted is read into a first operation register 1 as a binary data block of L bits and then therein by means of a temporary one Key S₁ ^(j) and a reversible function F is converted to an intermediate text C₁ ^(j) . The intermediate text C₁ ^(j) is then transmitted in parallel in a second operation register 2, in which the intermediate text C₁ ^(j) by means of a temporary key S₂ ^(j) and the reversible function F is converted to an intermediate text C₂ ^(j). After a total of R such conversion steps, the intermediate text C _R ^(j) representing the ciphertext C ^(j) at time j is formed. The transfer of the individual intermediate texts from the one into the subsequent operation register takes place simultaneously in accordance with the systolic algorithm, so that an increase in the number of operation registers does not affect the average throughput time, but only causes a higher time shift. The data block in the operation register k is converted in several conversion steps, the number of conversion steps being fixed and the individual conversion steps being formed by fast-running elementary operations. The order of these elementary operations is determined by a variable permutation Pi _k ^(j) , which is part of the key S _k ^(j) and is formed such that each of the conversion steps is carried out exactly once. The elementary operations can be implemented very quickly in terms of hardware, so that they are usually completed after a cycle time.

The keys S₁ ⁽¹⁾ , S₂ ⁽¹⁾ ,. . ., S _R ⁽¹⁾ are specified as the start key at the first point in time and must be known to both participants by a public key method, for example. These start keys are adopted unchanged for a specified number of times, for example for 2R times.

The keys following the start key will then be as recursive functions from the repatriation of a certain intermediate text. The use of a Intermediate text compared to the plain text or the Ciphertext (used in a Chosen plaintext attack both are known) has the advantage that this is because of the only internal use is not known.  

It is also provided that the return of the intermediate text is delayed via intermediate registers. In particular, the keys following the start key are called recursive functions
S _k ^(j) = f _k (S _k ^(j-1) , C _{R / 2} ^(J-2R) )
calculated.

A total of ten conversion steps take place in each of the operation registers 1 , 2 , 3 , 4 , as can be seen from FIG. 2, ten different elementary operations being used for this. For each of the conversion steps, the data block is first transferred to its own sub-register 5 and the elementary operation is carried out there. The data block is then retransmitted to the operation register 1 , 2 , 3 , 4 , the elementary operations depending on special subkeys of the temporary key S _k ^(j) .

For reasons of circuitry, it is advantageous that the operation register transfers the data block to all sub-registers 5 for each conversion step. There, the data block in all sub-registers 5 is subjected to the respective elementary operation. Subsequently, the operation register 1 , 2 , 3 , 4 takes over only the data block of the sub-register 5 , which is determined by the permutation Pi _k ^(j) .

The elemental operation of the first sub-register may be composed of an addition, wherein the input block x = (x _i) ₀ ^L-1 and the subkey a = (alpha _i) ₀ ^L-1 of the output block y = (y _i) ₀ ^L-1 is calculated by y _i = x _i + alpha _i mod 2 = x _i ⊕ alpha _i .

The elementary operation of the second sub-register can consist of a conditional exchange, whereby for the input block x = (x _i ) ₀ ^L-1 and the subkey b = (beta _i ) ₀ ^{L / 2-1,} the output block y = (y _i ) it is calculated that x _i and x _{i + L / 2 are} exchanged if beta _i = 1.

The elementary operation of the third sub-register can consist of a conditional exchange, whereby for the input block x = (x _i ) ₀ ^L-1 and the subkey b = (beta _i ) ₀ ^{L / 2-1,} the output block y = (y _i ) it is calculated that x _i and x _{L-1-i are} exchanged if beta _i = 1.

The elementary operation of the fourth sub-register can be off a 2 matrix multiplication, in which the L-bit block first split into L / 2 2-bit blocks and  then on each such one of the Matrix operations

is applied, their selection by one 2-bit key is controlled.

The elementary operation of the fifth sub-register can be off Triple permutations exist for which the L-bit block first split into [L / 3] 3-bit subsets and open permutation is performed on each subset, where the selection is made using a 3-bit key.

The elementary operation of the sixth sub-register can consist of a 4-bit image, for which the L-bit block is split into L / 4 4-bit blocks, where the element of such a 4-bit block as a number between 0 and 15, i.e. H. as an element of Z₁₆ = {0, 1, 2,  . . ., 15} is understood, whereupon 4 bÿective illustrations Phi₁, Phi₂, Phi₃, Phi₄ considered on Z₁₆ and one each of them on a 4-bit block is applied, the selection by a 2-bit Key is done.  

The elementary operation of the seventh sub-register can be off a 4-bit cyclic convolution, in which initially the L-bit block split into L / 4 4-bit blocks and then on each of the blocks a cyclic convolution y = x * c with

is executed, where c = (c _i ) ₀³ has odd parity and one 3-bit key per 4-bit block controls the selection among the parameter vectors c.

The elementary operation of the eighth sub-register can be done an 8-bit cyclic convolution, in which initially the L-bit block is split into L / 8 8-bit blocks and then on each of the blocks a cyclic convolution y = x * c with

is executed, where c = (c _i ) ₀⁷ has odd parity and one 7-bit key per 8-bit block controls the selection among the parameter vectors c.

The elementary operation of the ninth sub-register can consist of a cyclic shift C _m , in which the L-bit block is shifted cyclically by m = k · L / 16 bit, the value k being selected using a ₂log L / 16 bit key .

The elementary operation of the tenth sub-register can consist of a 16-bit variable cyclic shift, in which the L-bit block is first divided into L / 16 16-bit blocks, then the Hamming weight w (x) for each of the 16-bit blocks. calculated and finally each block is cyclically shifted by w (x) positions so that y = C _{w (x)} · x.

However, it is also possible that the conditional exchange described for the second or third sub-register is replaced by a general conditional exchange, the total block being divided into L / 2 subsets and the elements of the i-th subset being exchanged if beta _i = 1 for an L / 2-bit partial key beta = (beta _i ) ₀ ^{L / 2-1} .

The decryption is carried out with the same device as the encryption, in that the encryption text C ^{(j) is} read into the R-th operation register and converted there into the intermediate text C _R-1 ^(j) . This intermediate text is sent through the individual operation registers in the same way as for the encryption, only in the opposite direction, as a result of which the corresponding intermediate texts are successively delivered, and finally the desired plain text. The reverse mapping through the individual conversion steps is described by the same mapping F in the individual operation registers. The inverting effect is achieved by replacing the respective key with an inverse key.

In the case of the 3-permutation, the inversion is carried out by listing the associated inverse permutations in the analog order. If the kth permutation Pi _{k is} selected by the key during encryption, then the inverse permutation Pi _k ^{-1 is} selected by the same key during decryption.

In the 4-bit mapping, the inversion takes place in that the inverse maps Phi₁ ^-1 , Phi₂ ^-1 , Phi₃ ^-1 , Phi₄ ^-1 are listed in the same order and selected by the same key.

In the 4-bit cyclic convolution, the inversion takes place in that the inverse factors C ^-1 are listed in the same order and selected by the same key.

The inversion takes place during the cyclical shift by cyclical shift by -m = -k · L / 16 bit.

In the 16-bit variable cyclic shift, the inversion is carried out by calculating the Hamming weight of y, i.e. C _{w (y)} and shifting cyclically by -w (y) positions, so that x = C _{-w (y )} · Y. It should be noted here that w (x) = w (y), although a key does not occur here.

Claims (20)

1. A method for block-by-block encryption of digital data or digitized analog data, in which, at a point in time j, the plaintext to be encrypted is read as a binary data block T ^(j) of L bits into a first operation register ( 1 ) and then therein by means of a temporary key S₁ ^(j) and a reversible function F is converted to an intermediate text C₁ ^(j) , whereupon the intermediate text C₁ ^{(j) is transferred in} parallel to a second operation register ( 2 ), in which the intermediate text C₁ ^(j) by means of a temporary key S₂ ^(j) and the reversible function F is converted to an intermediate text C₂ ^(j) , so that after a total of R such conversion steps, the intermediate text C _R ^(j) representing the ciphertext C ^(j) at time j is produced, the transmission of the individual intermediate texts from the one into the subsequent operation register in accordance with the systolic algorithm takes place simultaneously in parallel, thereby gek indicates that the conversion of the data block in the operation register k takes place in several conversion steps, the number of conversion steps being fixed and the individual conversion steps being formed by fast-running elementary operations, the order of which is determined by a variable permutation Pi _k ^(j) which is part of the Key S _k ^(j) and is formed so that each of the conversion steps is carried out exactly once. 2. The method according to claim 1, characterized in that the key S₁ ⁽¹⁾ , S₂ ⁽¹⁾ ,. . ., S _R ⁽¹⁾ are provided as start keys at the first point in time and are adopted unchanged for a fixed number of times. 3. The method according to claim 2, characterized in that the starting keys for 2R times remain unchanged be taken over. 4. The method according to claim 2 or 3, characterized marked that on the starting key  following key as recursive functions from the Return of a certain intermediate text formed will. 5. The method according to claim 4, characterized in that the return of the intermediate text about Intermediate register is delayed. 6. The method according to any one of claims 2 to 5, characterized in that the keys following the start key as recursive functions S _k ^(j) = f _k (S _k ^(j-1) , C _{R / 2} ^{(j-2R) )} can be calculated. 7. The method according to any one of claims 1 to 6, characterized in that a total of ten conversion steps take place in each of the operation registers ( 1 , 2 , 3 , 4 ), ten different elementary operations being used for this. 8. The method according to any one of claims 1 to 7, characterized in that for each of the conversion steps, the data block is first transferred to its own sub-register ( 5 ), the elementary operation is carried out there and then the data block to the operation register ( 1 , 2 , 3 , 4 ) is transferred back, the elementary operations depending on special subkeys of the temporary key S _k ^(j) . 9. The method according to claim 8, characterized in that the operation register ( 1 , 2 , 3 , 4 ) for each conversion step transfers the data block to all sub-registers ( 5 ), the data block in all sub-registers ( 5 ) is subjected to the respective elementary operation, and then the operation register ( 1 , 2 , 3 , 4 ) takes over the data block of the sub-register ( 5 ) determined by the permutation Pi _k ^(j) . 10. The method according to any one of claims 1 to 9, characterized in that one of the elementary operations consists of an addition, wherein for the input block x = (x _i ) ₀ ^L-1 and the partial key a = (alpha _i ) ₀ ^L-1 the output block y = (y _i ) ₀ ^{L-1 is} calculated by y _i = x _i + alpha _i mod 2 = x _i ⊕ alpha _i . 11. The method according to any one of claims 1 to 9, characterized in that one of the elementary operations consists of a conditional exchange, wherein for the input block x = (x _i ) ₀ ^L-1 and the partial key b = (beta _i ) ₀ ^{L / 2-1} the output block y = (y _i ) is calculated by exchanging x _i and x _{i + L / 2} if beta _i = 1. 12. The method according to any one of claims 1 to 9, characterized in that one of the elementary operations consists of a conditional exchange, wherein for the input block x = (x _i ) ₀ ^L-1 and the partial key b = (beta _i ) ₀ ^{L / 2-1} the output block y = (y _i ) is calculated by exchanging x _i and x _L-1-i if beta _i = 1. 13. The method according to any one of claims 1 to 9, characterized in that one of the elementary operations consists of a 2 matrix multiplication, in which the L-bit block is first split into L / 2 2-bit blocks and then one for each of the matrix operations is applied, the selection of which is controlled by a 2-bit key. 14. The method according to any one of claims 1 to 9, characterized characterized that one of the elementary operations from There are 3 permutations for which the L-bit block first split into [L / 3] 3-bit subsets and permutation is performed on each subset, the selection each using a 3-bit key he follows. 15. The method according to any one of claims 1 to 9, characterized characterized that one of the elementary operations from a 4-bit mapping, for which the L-bit block is split into L / 4 4-bit blocks, the element of such a 4-bit block as one Number between 0 and 15, d. H. as an element of Z₁₆ = {0, 1, 2,. . ., 15} is understood, whereupon 4 bÿective Figures Phi₁, Phi₂, Phi₃, Phi₄ on Z₁₆ be considered and one at a time 4-bit block is applied, the selection by a 2-bit key is made. 16. The method according to any one of claims 1 to 9, characterized in that one of the elementary operations consists of a 4-bit cyclic convolution, in which the L-bit block is first split into L / 4 4-bit blocks and then on each of the blocks a cyclic folding y = x * c with is executed, where c = (c _i ) ₀³ has odd parity and one 3-bit key per 4-bit block controls the selection among the parameter vectors c. 17. The method according to any one of claims 1 to 9, characterized in that one of the elementary operations consists of an 8-bit cyclic convolution, in which the L-bit block is first split into L / 8 8-bit blocks and then on each of the blocks a cyclic folding y = x * c with is executed, where c = (c _i ) ₀⁷ has odd parity and one 7-bit key per 8-bit block controls the selection among the parameter vectors c. 18. The method according to any one of claims 1 to 9, characterized in that one of the elementary operations consists of a cyclic shift C _m , in which the L-bit block is cyclically shifted by m = k · L / 16 bits, the selection of Value k is done by a ₂log L / 16 bit key. 19. The method according to any one of claims 1 to 9, characterized in that one of the elementary operations consists of a 16-bit variable cyclic shift, in which the L-bit block is first divided into L / 16 16-bit blocks, then to each of the 16-bit blocks, the Hamming weight w (x) is calculated and finally each block is cyclically shifted by w (x) positions, so that y = C _{w (x)} · x. 20. The method according to claim 11 or 12, characterized in that the conditional exchange described there is replaced by a general conditional exchange, wherein the entire block is divided into L / 2 subsets and the elements of the i-th subset are exchanged if beta _i = 1 for an L / 2-bit partial key beta = (beta _i ) ₀ ^{L / 2-1} .