CN105049203A - Configurable 3DES encryption and decryption algorism circuit capable of supporting multiple work modes - Google Patents

Abstract

The invention belongs to the technical field of cryptography integrated circuit design, in particular to a configurable 3DES encryption and decryption algorithm circuit supporting multiple working modes. The 3DES encryption and decryption algorithm circuit of the present invention is composed of an AHB bus interface, a data transmission module, an execution module, a core encryption module and the like. The invention adopts the structure of ping-pong cache, so that the whole circuit avoids the clock consumption of waiting for input data between adjacent encryption and decryption operations during the encryption and decryption process, and improves the encryption and decryption efficiency. The invention provides a bus interface, which is convenient for integration into a system on chip with AMBA bus as the interconnection mechanism. The invention realizes optional single DES encryption and decryption or 3DES encryption and decryption, and realizes encryption and decryption of four different modes of DES or 3DES. The invention has high overall operation efficiency and small area, and can be better applied to systems with high safety performance requirements.

Description

A configurable 3DES encryption and decryption algorithm circuit supporting multiple working modes

technical field

The invention belongs to the technical field of cryptography integrated circuit design, and in particular relates to a configurable 3DES encryption and decryption algorithm circuit supporting multiple working modes.

Background technique

In recent years, with the rapid development and popularization of computer and information technology, the scale of application systems in various industries has expanded rapidly, and the resulting application data has shown explosive growth. The generation and transmission of large amounts of data will undoubtedly expose more application information to the network while promoting the development of the industry. In order to ensure the security of generated and transmitted data, various industries are researching the software and hardware implementation of effective encryption and decryption modules in their own application systems.

The DES encryption algorithm is the most widely used symmetric cipher, which uses a 64-bit block and a 56-bit key. DES is relatively vulnerable under exhaustive attacks. An improved solution is to use multiple encryption techniques, such as triple DES (3DES) encryption algorithm. The 3DES encryption algorithm uses the DES algorithm in three stages, and encrypts the data in the stages of DES encryption, DES decryption and DES encryption by using different keys. This technology expands the width of the key and greatly reduces the possibility of trying to brute force the encryption algorithm. So far, the 3DES encryption algorithm is considered safe against brute force cracking. Therefore, in applications that require high security performance, the 3EDS encryption algorithm has been widely accepted. If the data does not require high data security, double DES or DES encryption algorithm can be used to reduce the implementation cost and improve the operation speed.

Contents of the invention

The purpose of the present invention is to provide a configurable 3DES encryption and decryption algorithm circuit supporting multiple working modes, which can be widely used in systems requiring security performance.

The configurable 3DES encryption and decryption algorithm circuit supporting multiple working modes provided by the present invention adopts a ping-pong buffer structure, so that the entire circuit avoids the clock consumption of waiting for input data between adjacent encryption and decryption operations during the encryption and decryption process, and improves Encryption and decryption efficiency.

The 3DES encryption algorithm circuit provided by the present invention has an overall block diagram as shown in Figure 1, and includes the following modules:

(1) AHB bus interface DES_ahb module, used to integrate into the system-on-chip with AMBA bus as the interconnection mechanism;

(2) The top-level module DES_mode module is used to realize the signal connection of the data transmission interface DES_io module, DES_3DES execution module and core encryption DES module. The entire DES_mode module can be used to realize the choice of single DES encryption and decryption or 3DES encryption and decryption; and realize the encryption and decryption of four different modes of DES or 3DES, the four modes are: electronic codebook (ECB), cipher block chaining (CBC), password Feedback (CFB), output feedback (OFB);

(3) Data transmission interface DES_io module, the main function of this module is to transmit data with the external module in units of 32 bits, store the data in the register, and then perform different scheduling according to the required mode, with 64 bits as the unit The unit transfers the data that needs to be encrypted and decrypted to the DES_3DES module;

(4) DES_3DES execution module, which can realize two encryption and decryption methods of DES and 3DES according to the control register;

(5) Core encryption DES module, the basic iterative algorithm process of this module is shown in Figure 2. Among them, let Li-1 and Ri-1 respectively refer to the high 32 bits and low 32 bits input by the encrypted data transformation module of one iteration; Li and Ri respectively refer to the high 32 bits output by the encrypted data transformation module of one iteration And the lower 32 bits, and as the data input of the next round of iteration; Ki is the round key required for the transformation of encrypted data in each round of iteration; Ci-1, Di-1 respectively refer to the corresponding round key generation in one round of iteration The upper 28 bits and lower 28 bits of the module input; Ci and Di respectively refer to the upper 28 bits and lower 28 bits output by the corresponding round key generation module in one iteration, and are used as the input of the next iteration.

The 64-bit intermediate data is divided into independent left and right 32-bit data Li-1 and Ri-1, and the process of each round of iterative transformation can be classified as the following formula:

in, operation to the second XOR operation input. That is, Ri-1 is expanded to 48-bit data by extension and permutation first, and then XOR operation is performed with the 48-bit round key Ki, and the result is sent to the S box. The second XOR operation. See the left half of Figure 2.

To generate the round key Ki, first shift Ci and Di to the left by 1 or 2 bits, and then perform a replacement and compression operation. The result is the round key Ki of each round of iteration, see the right half of Figure 2.

The entire iterative data path is performed under the control of the encryption iteration control submodule in FIG. 3 .

The block diagram of the core encryption DES module is shown in Figure 3, and the main submodules include:

Encryption iteration control sub-module, this sub-module includes a key initial replacement module, the function of this module is to convert the 64-bit initial key into 56-bit data through the replacement selection operation, and use it as the round key generation module in Figure 2 Input; sub-key generation module, the data path of this module is the right half in the above-mentioned Fig. 2;

The data initial replacement sub-module is to rearrange the original input plaintext and use it as the input of the encrypted data transformation module in Figure 2;

The round function sub-module is the above-mentioned data path ;

The data reverse initial permutation sub-module is a reciprocal operation with the initial permutation operation. This module performs a permutation operation on the output of the data after 16 rounds of encryption iterations, and the result is the final ciphertext output.

The circuit of the invention has high overall operation efficiency and small area, and can be better applied to systems with high safety performance requirements.

Description of drawings

Figure 13 The overall block diagram of the DES encryption algorithm circuit.

Figure 2 The basic iterative algorithm process of the core encryption DES module. In the figure, Li-1, Ri-1 and Li, Ri respectively refer to the upper 32 bits and lower 32 bits of the data input and output of one iteration; Ci-1, Di-1 and Ci, Di respectively refer to the The upper 28 bits and lower 28 bits of the corresponding round key input and output.

Figure 3 block diagram of the core encryption DES module.

Figure 4 Description of the control register fields of the DES_io module. In the figure, start_bit: start control signal; endec_bit: encryption and decryption selection signal, low for encryption, high for decryption; des_tdes_bit: DES or 3DES selection signal, high for 3DES, low for DES; mode_bits: mode selection signal, "00" for ECB, "01" is CBC, "10" is CFB, "11" is OFB.

Figure 5 is a schematic diagram of the structure of the ping-pong cache. In the figure, the registers data_in_reg and data_in_reg2 are used to realize interleaved storage of encrypted data, and the purpose of the signal cnt is to realize the storage control signal of external encrypted data, which is used to select the encrypted register object.

Figure 6 DES_io module scheduling scheme diagram. In the figure, des_data_in: data input port; endec: encryption or decryption operation control signal; mode_bit: mode selection signal.

Figure 7 Schematic diagram of the internal state machine of the DES_io module. State description: IDLE: initial state; DES: encryption state; NOACTIVE: encryption completion state. Signal description: start_bit: When the signal is 1, it indicates that the data required for encryption is ready, and the encryption starts; des_data_valid: When the signal is 1, it indicates that the encryption is completed.

Figure 8 Schematic diagram of the internal state machine of the DES_3DES module. State description: IDLE: initial state; DES1: DES encryption state or the first encryption state of 3DES encryption state; DES2: decryption state of 3DES encryption state; DES3: second encryption state of 3DES encryption state.

Signal description: triple_active: when the signal is 1, the encryption is valid; des_tdes: when the signal is 1, it indicates the 3DES encryption mode, and when it is 0, it indicates the DES encryption mode; single_data_valid: when the signal is 1, it indicates that the single round of encryption and decryption is completed.

Detailed ways

The main function of the data transmission interface DES_io module is to transmit data with the external module in units of 32 bits, store the data in the register, and then perform different scheduling according to the required mode, and use 64 bits as the unit to encrypt and decrypt The data is passed into the DES_3DES module.

The data transmission interface DES_io module stores the control register of the control signal configured by the software, as shown in Figure 4, this register is used to implement different encryption and decryption methods and different working mode configuration scheduling. The different control fields are as follows:

start_bit: start control signal.

endec_bit: encryption and decryption selection signal, low for encryption, high for decryption.

des_tdes_bit: DES or 3DES selection signal, high for 3DES, low for DES.

mode_bits: mode selection signal, "00" is ECB, "01" is CBC, "10" is CFB, "11" is OFB.

busy_bit: busy signal, when it is high, it means that this round of encryption and decryption has not been completed; when it is low, it means that it is completed.

The structure of the ping-pong buffer is adopted in the module, so that the entire circuit avoids the clock consumption of waiting for input data between adjacent encryption and decryption operations during the encryption and decryption process, and improves the encryption and decryption efficiency. The block diagram of the module is shown in Figure 5. It includes a control state machine, a data processing and storage module, a counter, two registers data_in_reg and data_in_reg2, and two registers data_in_reg and data_in_reg2 are used to cross-store encrypted data; the data processing and storage modules are under the control of the control state machine Different data paths are selected to realize the processing of different encrypted data and the storage of results; the counter generates signal cnt under the control of the control state machine, and the signal cnt is the storage control signal for realizing external encrypted data, which is used to select the encrypted register object. This structure realizes interleaved storage of encrypted data by adding a set of registers (data_in_reg2), and improves the efficiency of the entire encryption and decryption by adding a small hardware overhead.

In the DES encryption and decryption mode, the encryption clock utilization rate (the encryption clock utilization rate refers to the number of clock cycles occupied by the encryption and decryption execution in the entire encryption and decryption process and the clock cycle occupied by the entire process between the input of the encryption and decryption data and the completion of the encryption and decryption ratio) increased from 82% to 92%; in the 3DES encryption and decryption mode, the encryption clock utilization rate increased from 93% to 97%.

The scheduling scheme of the data transmission interface DES_io module is shown in Figure 6, and its internal state machine is shown in Figure 7.

When the start_bit is set high by the outside, it means that the outside has put the data to be encrypted into data_in_reg, and put the key required for encryption into key_reg. The state machine enters the DES state, sets des_active to high, and starts DES_3DES to start working.

When it is detected that des_data_valid is high, it indicates that the encryption is over, the state machine enters the NOACTIVE state, sets des_active low, and one encryption ends.

The DES_3DES execution module can implement DES and 3DES encryption and decryption methods according to the control register.

The internal state machine of the DES_3DES execution module is shown in Figure 8. Its execution process is:

The initial state is IDLE. When triple_active is high, it indicates that the encryption starts and enters the DES1 state.

DES1 state: set single_active high, single_endec=triple_endec, key is triple_key1, and start a DES encryption. Until single_data_valid is high, the first round of encryption ends. If des_tdes is low, it means that only single des encryption and decryption is needed, and the next state is IDLE state. If des_tdes is high, it means triple_des encryption and decryption is required, and the next state is DES2.

DES2 state: set single_active high, single_endec=!triple_endec, key is triple_key2, and start a DES encryption. Until single_data_valid is high, the second round of encryption ends. The next state is DES3.

DES3 state: set single_active high, single_endec=triple_endec, key is triple_key3, and start a DES encryption. Until single_data_valid is high, the third round of encryption ends. The next state is IDLE.

Among them, since there are some process switching clocks in the middle of each triple_des encryption and decryption, the results of each encryption and decryption need to be saved in order to save 64-bit registers. After each DES encryption, the result is output to the DES_io module through the port triple_data_out[63:0], temporarily stored in the register des_data_out[63:0], and when the next encryption starts, it is input through the port triple_des_in[63:0] .

The entire 3DES encryption and decryption algorithm circuit is designed with VerilogHDL. Under the synthesis of SMIC65nmCMOS technology, the corresponding area is 0.01429mm ² , and the power consumption is 2.688mW when working at 500MHz. The 3DES encryption and decryption algorithm circuit can be well used in applications with high security performance requirements, low cost, and low power consumption.

Claims (4)

1. A configurable 3DES encryption and decryption algorithm circuit that supports multiple operating modes is characterized in that it comprises the following modules: (1) AHB bus interface DES_ahb module, used to integrate into the system-on-chip with AMBA bus as the interconnection mechanism; (2) The top-level module DES_mode module is used to realize the signal connection of the data transmission interface DES_io module, DES_3DES execution module and core encryption DES module; the entire DES_mode is used to realize the selection of single DES encryption and decryption or 3DES encryption and decryption; and realize four different Encryption and decryption of DES or 3DES in four modes: codebook, cipher group link, cipher feedback, output feedback; (3) The data transmission interface DES_io module, its main function is to transmit data with the external module in units of 32 bits, store the data in the register, and then perform different scheduling according to the required mode, in units of 64 bits Pass the data to be encrypted and decrypted into the DES_3DES module; (4) DES_3DES execution module, which realizes two encryption and decryption methods of DES and 3DES according to the control register; (5) Core encryption DES module, the basic iterative algorithm process of this module is as follows: Let Li-1 and Ri-1 respectively refer to the high 32 bits and low 32 bits input by the encrypted data transformation module for one iteration; Li and Ri respectively refer to the high 32 bits and low 32 bits output by the encrypted data transformation module for one iteration. 32 bits, and as the data input for the next round of iteration; Ki is the round key required for the transformation of encrypted data in each round of iteration; Ci-1 and Di-1 respectively refer to the input of the corresponding round key generation module in one round of iteration The upper 28 bits and lower 28 bits of ; Ci and Di respectively refer to the upper 28 bits and lower 28 bits output by the corresponding round key generation module in one iteration, and are used as the input of the next iteration; The 64-bit intermediate data is divided into independent left and right 32-bit data Li-1 and Ri-1, and the process of each round of iterative transformation is classified as the following formula: in, The operation between the input of the second XOR operation, that is, Ri-1 is first expanded to 48-bit data through extended replacement, and then XOR operation is performed with the 48-bit round key Ki, and the result is sent to the S box, and the S box The output of is then subjected to a permutation operation and a second XOR operation with Li-1; Round key Ki generation: First shift Ci and Di to the left by 1 or 2 bits, and then perform a permutation and compression operation, and the result is the round key Ki of each iteration. 2. The configurable 3DES encryption and decryption algorithm circuit supporting multiple operating modes according to claim 1, wherein the data transmission interface DES_io module includes a control register of a control signal configured by software, and the control register is used to realize different Encryption and decryption methods and configuration scheduling for different working modes. 3. the configurable 3DES encryption and decryption algorithm circuit supporting multiple operating modes according to claim 2, is characterized in that said data transmission interface DES_io module adopts the structure of ping-pong cache, and it comprises a control state machine, a data processing and Storage module, a counter, two registers data_in_reg and data_in_reg2, and two registers data_in_reg and data_in_reg2 are used to interleave the encrypted data; the data processing and storage module select different data paths under the control of the control state machine to achieve different The encrypted data is processed and the result is stored; the counter generates the signal cnt under the control of the control state machine, and the signal cnt is a storage control signal for realizing external encrypted data, and is used to select the encrypted register object. 4. The configurable 3DES encryption and decryption algorithm circuit supporting multiple operating modes according to claim 3, characterized in that the internal state machine execution flow of the DES_3DES execution module is: The initial state is IDLE, when triple_active is high, it indicates that the encryption starts and enters the DES1 state; DES1 state: set single_active high, single_endec=triple_endec, the key is triple_key1, and start a DES encryption; until single_data_valid is high, the first round of encryption ends; if des_tdes is low, it means that only single des encryption and decryption is needed, and enter the next one The state is IDLE; if des_tdes is high, it means that triple_des encryption and decryption are required, and the next state is DES2; DES2 state: set single_active high, single_endec=!triple_endec, the key is triple_key2, start a DES encryption; until single_data_valid is high, the second round of encryption ends; enter the next state is DES3; DES3 state: set single_active high, single_endec=triple_endec, key is triple_key3, start a DES encryption until single_data_valid is high, the third round of encryption is over; enter the next state is IDLE.