KR20010109626A - Encryption device realizing triple data encryption standard atchitecture - Google Patents

Abstract

The present invention relates to an encryption device using a data encryption standard algorithm, and implements an encryption device with a smaller area by performing three iterative operations with a key scheduler and a simple data standard encryption device when implementing a triple data encryption standard. It is. To this end, the present invention is an encryption device that performs encryption using a data encryption standard algorithm, which receives a 64-bit plain text block, receives a 64-bit encryption key, a 64-bit decryption key, and a 64-bit ciphertext. A triple DES scheduler that generates a key for and replaces 64-bit data; And DES hardware that receives a 48-bit key and 64-bit data from the triple DES scheduler and performs an encryption operation to generate a 64-bit cipher text.

Description

Encryption device realizing triple data encryption standard atchitecture

The present invention relates to an encryption device, and more particularly to an encryption device using a data encryption standard algorithm.

In general, in the field of integrated circuit (IC) cards that require a high level of security, highly complex encryption and decryption algorithms must be used for authentication, one of which is called the Data Encryption Standard (DES). Algorithm.

DES performs 16 rounds of operations using both 64 bits of data and keys, and then generates 64 bits of encrypted data. DES has 16 bit rounding operations and most bit manipulation and shuffling operations to suit the original hardware implementation. When implemented in software, the computation time is considerably longer and usually takes 5ms. When implemented in hardware, the computation time becomes short while the implementation area becomes large.

In general, a dedicated DES chip focuses on reducing computation time rather than area considerations, so pipeline architectures can be used to significantly reduce computation time. Disclosed is a DES encryption device that implements DES encryption and decryption in hardware to optimize a design as hardware sharing 16 rounds while increasing data rate. And by replacing the S-Box table, which occupies 50 percent of the combinatorial logic circuit, with ROM, the area can be significantly reduced. In general, smart IC cards have ROMs, so a certain portion is allocated and used.

1 is a block diagram showing a general DES algorithm.

Referring to FIG. 1, the DES algorithm receives an 64-bit plain text block and performs substitution by initial substitution (IP), followed by the substitution unit 100. The 64-bit block of the) is divided into two 32-bit blocks and stored in the left register (L0) 120 and the right register (R0) 110, and the 32-bit block of the right register 110 is received and the key schedule A cipher function unit (f) 130 for receiving and encrypting a modifier key (K1) generated by a schedule), the data of the cipher function unit (f) 130, and the left register (L0) ( An exclusive-OR operation unit 140 receiving data of 120, a left register (L1) 160 of a next round for swapping and storing 32-bit blocks of the right register (R0) 110, and Right register (R1) 150 of the next round that stores the data of the exclusive OR operation 140. The first round consists of 16 rounds of 16 rounds. After the modification over 16 rounds, the encrypted cipher text 180 is output through the reverse initial replacement unit 170.

Fig. 2 is a block diagram showing one round and key schedule of the DES algorithm.

Referring to FIG. 2, the first round of the DES algorithm is extended substitution which receives 32 bits of data from the right register R (i-1) storing a 32 bits of text block and expands and replaces it with 48 bits of data. The unit 210 and the Exclusive-Oa unit 220 receiving the 48-bit data of the extended replacement unit and receiving the auxiliary key K _i from the key schedule and performing an exclusive OR operation. And an S-Box replacement unit 230 for replacing 48 bits of data from the exclusive-Oabu 220 with 32 bits of data, and 32 bits of data of the S-Box replacement unit 230. Exclusive copy-substituted P-Box replacement unit 240, and the 32-bit data and the 32-bit data stored in the left register (L (i-1)) of the P-Box replacement unit receives exclusive logical OR With sheave-oabu 250.

The key schedule receives a 56-bit key, divides it into two blocks of 28 bits, and shifts one or two digits to the left, respectively, and shifts 260 and 270 to receive two blocks. And a compression replacing unit 280 for compressing and replacing with an auxiliary key.

3 is a block diagram illustrating a prior art DES architecture.

Referring to FIG. 3, the prior art DES architecture includes a 4-bit counter 300 that counts the number of key shifts by receiving a reset signal, an encryption signal enc, and a decryption signal dec; A first multiplexer 310 for shifting a value of a key for a next round of operation by receiving a 64-bit key, the encryption signal enc, and the decryption signal dec; 320, an exclusive-OR operation unit 330 for receiving 48-bit data output from the shift and register 320 and data output from the register 380, and data output from the exclusive-OR operation unit 330. Eight S-Box blocks 340 for replacing with 32 bits of data, and an exclusive OR operation unit 350 for receiving 32 bits of data of the S-Box block and 32 bits of data output from the register 380. And the ratio of the data of the exclusive logical OR operation unit 350 to the external 64 ratio. It receives the data and the encrypted signal (enc) and the decoded signals (dec) input and generates a data and a data multiplexer and the register unit 390 to store.

4 is a block diagram showing a prior art S-Box.

Referring to FIG. 4, the S-Box according to the related art receives a rising clock r_clk and 48-bit data, divides the data into eight data, and selects only one of them. A ROM (410) for receiving the output value from the multiplexer 400, storing data and replacing the data with 8-bit data, and data from the ROM 410 and higher levels from the first multiplexer 400. And a second multiplexer 420 for selecting an upper 4 bit and a lower 4 bit by receiving a lower selection signal, 4 bits of data and the rising clock r_clk from the second multiplexer 420. And a demultiplexer 430 for distributing data in 32 bits.

The S-Box generates an input value of a P-Box substitute by exclusively ORing the extended substitution value and the compressed substitution value. Implementing a combinatorial logic circuit can complete the operation in one cycle, but since the area is large, it is implemented in ROM to finish in eight cycles. Instead, one bit of 6 bits divided into 48 bits is used to select the upper and lower 4 bits from the 8-bit output value of the ROM, and the remaining 5 bits and the 3 bits of the rising clock (r_clk) add up. It is taken as an 8-bit ROM address. As shown in FIG. 4, there is a rising clock r_clk implemented in eight cycles to latch the data value of the key value into the next data.

5 is a block diagram illustrating a triple DES architecture of the prior art.

Referring to FIG. 5, the prior art triple DES architecture includes a first DES encryption unit 500 for receiving a 64-bit plain text block and an encryption key Ke and generating a 64-bit cipher text, and the first DES encryption unit. A DES decryption unit 510 which receives the 64-bit data and the decryption key Kd from the 500 and decrypts the cipher text, and a 64-bit non-encryption statement and the encryption key Ke from the DES decryption unit 510. And a second DES encryption unit 520 which receives the input and generates a final cipher text.

The DES architecture of the related art described above has a problem in that an area is increased by connecting three DES encryption devices as shown in FIG. 5.

The present invention has been made to solve the above problems of the prior art, and an object thereof is to provide an efficient encryption device with a small area.

1 is a block diagram showing a general DES algorithm;

2 is a block diagram showing a round 1 and key schedule of the DES algorithm;

3 is a block diagram illustrating a prior art DES architecture;

4 is a block diagram showing a prior art S-Box;

5 is a block diagram illustrating a triple DES architecture of the prior art;

6 is a block diagram of a triple DES encryption device of the present invention;

7 is a register map for executing a triple DES encryption device of the present invention.

Explanation of symbols on the main parts of the drawings

610: Triple DES scheduler 620: DES hardware

In order to achieve the above object, the encryption device of the present invention is an encryption device that performs encryption using a data encryption standard algorithm, which receives a 64-bit plaintext block and receives a 64-bit encryption key, a 64-bit decryption key, and 64-bit. A triple DES scheduler generating a 48-bit key and substituting 64-bit data based on the feedback of the ciphertext; And DES hardware that receives a 48-bit key and 64-bit data from the triple DES scheduler and performs an encryption operation to generate a 64-bit cipher text.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the technical idea of the present invention. do.

6 is a block diagram of a triple DES encryption device of the present invention.

Referring to FIG. 6, the triple DES encryption apparatus of the present invention receives a 64-bit plaintext (Tp) block and receives a 64-bit encryption key (Ke), a 64-bit decryption key (Kd), and a 64-bit encryption text. A DES scheduler 610 for generating a 48-bit key and substituting 64-bit data, and a 48-bit key and 64-bit data are received from the triple DES scheduler 610. DES hardware 620 for generating a 64-bit cipher text by performing an encryption operation is received.

The triple DES encryption device having the above configuration has a 64-bit plain text block and a fed back 64-bit cipher text to generate data output and selects an encryption key (Ke) and a decryption key (Kd). Produce a key value. After executing DES hardware three times, the final result is a triple DES cipher.

7 is a register map for executing the triple DES encryption apparatus of the present invention.

Referring to FIG. 7, the register area can be reduced by sharing Data [0: 7] of addresses 0011h to 0018h with a value of des_out [0: 7] which is an output of the triple DES encryption device. A typical smart card uses a register map to interface with the DES hardware, which is intended to be programmable. When using different register areas for storing the Data and the des_out values, the area becomes large. Data can only be shared with des_out because it is only used to encrypt the DES encryption device for the first time and not used after that. That is, the first data is written only and the des_out is read only after three encryption operations. If you implement a scheduler in this way, you can implement the desired behavior with a small footprint.

Although the technical spirit of the present invention has been described in detail according to the above-described preferred embodiment, it should be noted that the above-described embodiment is for the purpose of description and not of limitation. In addition, those skilled in the art will understand that various embodiments are possible within the scope of the technical idea of the present invention.

As described above, the present invention implements triple DES encryption and decryption in hardware to perform three DES operations with one piece of hardware, thereby reducing not only the area of the register map, but also the implementation area of the entire triple DES encryption device. .

Claims (4)

An encryption apparatus for performing encryption using a data encryption standard algorithm, A triple DES scheduler that receives a 64-bit plaintext block, feeds back a 64-bit encryption key, a 64-bit decryption key, and a 64-bit ciphertext to generate a 48-bit key and replace the 64-bit data; And DES hardware that receives a 48-bit key and 64-bit data from the triple DES scheduler and performs encryption operation to generate 64-bit ciphertext An encryption device comprising a. The method of claim 1, And the 64-bit data is an initial input that is input only when the first encryption operation is performed. The method of claim 1, And the triple DES scheduler receives a cipher text fed back from DES hardware, receives an encryption key and a decryption key, and generates a 48-bit key three times. The method of claim 1, And a register for executing a triple DES encryption device is executed by sharing the 64-bit data and the 64-bit cipher text.