Feistel结构的8比特轻量化S盒

doi:10.19665/j.issn1001-2400.2021.01.008

摘要/Abstract

摘要：

轻量化S盒作为轻量级对称密码算法的混淆部件,是设计轻量级对称密码算法的关键。提出一种新的8比特轻量化S盒设计方法,其单轮逻辑运算仅涉及4个单比特逻辑与运算和4个单比特逻辑异或运算,迭代4轮后密码性质可达到差分均匀度为16、非线性度为96。与目前已有轻量化S盒设计方法相比,新的8比特轻量化S盒设计方法在硬件实现资源小的同时达到了已知最优的差分均匀度和非线性度等密码学指标,解决了之前8比特轻量化S盒差分均匀度和非线性度等密码性质弱的问题。

关键词: Feistel结构, S盒, 轻量级, 对称密码, 差分均匀度, 非线性度

Abstract:

As a confusion component of the lightweight symmetric cryptographic algorithm,a lightweight S-box is the key to designing the lightweight symmetric cryptographic algorithm.In this paper,a new method for designing 8-bits lightweight S-boxes is proposed.The round logic operation in the S-boxes involves only 4 logic AND operations (single bits) and 4 logic XOR operations (single bits).After iterating 4 rounds,the differential uniformity of the 8-bits lightweight S-boxes is 16 and the nonlinearity is 96.Compared with the existing known methods,the 8-bits lightweight S-box designed by our method needs less hardware resources while gaining the best known cryptographic properties,such as the low differential uniformity and the high nonlinearity.

Key words: Feistel structure, S-box, lightweight, symmetric cryptography, differential uniformity, Nonlinearity

中图分类号:

TN918

董新锋,张文政,许春香. Feistel结构的8比特轻量化S盒[J]. 西安电子科技大学学报, 2021, 48(1): 69-75.

DONG Xinfeng,ZHANG Wenzheng,XU Chunxiang. 8 bits lightweight S-box with the Feistel structure[J]. Journal of Xidian University, 2021, 48(1): 69-75.

图/表 4

图1

图2

表1

52个8比特S盒对应的f1、f2代数正规型"

S盒序号	f₁对应的向量C	f₂对应的向量D	S盒序号	f₁对应的向量C	f₂对应的向量D
1	1,0,0,0,0,0,0,0,0,0,1,0,0,0,0	0,0,0,0,0,1,0,0,0,0,0,0,0,1,0	27	0,0,0,0,1,0,1,0,0,0,0,0,0,0,0	0,1,0,0,0,0,0,0,0,0,0,0,1,0,0
2	1,0,0,0,0,0,0,0,0,0,0,1,0,0,0	0,1,0,0,0,0,1,0,0,0,0,0,0,0,0	28	0,0,0,0,1,0,1,0,0,0,0,0,0,0,0	0,0,1,0,0,0,0,0,0,0,1,0,0,0,0
3	1,0,0,0,0,0,0,0,0,0,0,1,0,0,0	0,1,0,0,0,0,0,0,0,0,0,0,0,1,0	29	0,0,0,0,1,0,0,0,0,0,1,0,0,0,0	0,0,0,0,0,1,0,0,0,0,0,0,0,1,0
4	1,0,0,0,0,0,0,0,0,0,0,1,0,0,0	0,0,0,0,0,0,0,0,0,0,1,0,0,1,0	30	0,0,0,0,1,0,0,0,0,0,1,0,0,0,0	0,0,0,0,0,0,1,0,0,0,0,1,0,0,0
5	0,1,0,0,0,0,1,0,0,0,0,0,0,0,0	1,0,0,0,0,0,0,0,0,0,0,0,1,0,0	31	0,0,0,0,1,0,0,0,0,0,0,0,1,0,0	0,1,0,0,0,0,0,0,0,0,0,0,0,1,0
6	0,1,0,0,0,0,1,0,0,0,0,0,0,0,0	0,0,1,0,0,0,0,1,0,0,0,0,0,0,0	32	0,0,0,0,1,0,0,0,0,0,0,0,1,0,0	0,0,0,0,0,0,0,0,0,0,1,0,0,1,0
7	0,1,0,0,0,0,1,0,0,0,0,0,0,0,0	0,0,1,0,0,0,0,0,0,0,0,0,0,0,1	33	0,0,0,0,0,1,0,0,0,0,0,0,0,1,0	0,1,0,0,0,0,0,1,0,0,0,0,0,0,0
8	0,1,0,0,0,0,1,0,0,0,0,0,0,0,0	0,0,0,0,1,1,0,0,0,0,0,0,0,0,0	34	0,0,0,0,0,1,0,0,0,0,0,0,0,1,0	0,0,0,0,1,0,0,0,0,0,1,0,0,0,0
9	0,1,0,0,0,0,1,0,0,0,0,0,0,0,0	0,0,0,0,1,0,0,0,0,0,0,0,1,0,0	35	0,0,0,0,0,1,0,0,0,0,0,0,0,0,1	0,1,0,0,0,0,1,0,0,0,0,0,0,0,0
10	0,1,0,0,0,0,0,1,0,0,0,0,0,0,0	0,0,0,0,0,1,0,0,0,0,0,0,0,1,0	36	0,0,0,0,0,1,0,0,0,0,0,0,0,0,1	0,0,0,0,0,0,1,0,0,0,1,0,0,0,0
11	0,1,0,0,0,0,0,1,0,0,0,0,0,0,0	0,0,0,0,0,0,1,0,0,0,0,1,0,0,0	37	0,0,0,0,0,1,0,0,0,0,0,0,0,0,1	0,0,0,0,0,0,0,0,0,0,1,0,0,1,0
12	0,1,0,0,0,0,0,0,0,0,0,0,1,0,0	0,0,0,0,1,0,1,0,0,0,0,0,0,0,0	38	0,0,0,0,0,0,1,0,0,0,1,0,0,0,0	1,0,0,0,0,0,0,0,0,0,0,0,1,0,0
13	0,1,0,0,0,0,0,0,0,0,0,0,1,0,0	0,0,0,0,0,0,1,0,0,0,0,0,0,0,1	39	0,0,0,0,0,0,1,0,0,0,1,0,0,0,0	0,0,1,0,0,0,0,1,0,0,0,0,0,0,0
14	0,1,0,0,0,0,0,0,0,0,0,0,1,0,0	0,0,0,0,0,0,0,1,0,0,0,0,0,1,0	40	0,0,0,0,0,0,1,0,0,0,1,0,0,0,0	0,0,0,0,0,0,0,1,0,0,0,1,0,0,0
15	0,1,0,0,0,0,0,0,0,0,0,0,0,1,0	0,0,1,0,0,0,0,0,0,0,0,0,0,0,1	41	0,0,0,0,0,0,1,0,0,0,0,1,0,0,0	0,1,0,0,0,0,0,1,0,0,0,0,0,0,0
16	0,1,0,0,0,0,0,0,0,0,0,0,0,1,0	0,0,0,0,1,1,0,0,0,0,0,0,0,0,0	42	0,0,0,0,0,0,1,0,0,0,0,1,0,0,0	0,0,0,0,1,0,0,0,0,0,1,0,0,0,0
17	0,1,0,0,0,0,0,0,0,0,0,0,0,1,0	0,0,0,0,1,0,0,0,0,0,0,0,1,0,0	43	0,0,0,0,0,0,0,1,0,0,0,1,0,0,0	0,1,0,0,0,0,1,0,0,0,0,0,0,0,0
18	0,1,0,0,0,0,0,0,0,0,0,0,0,0,1	0,0,0,0,0,0,1,0,0,0,0,1,0,0,0	44	0,0,0,0,0,0,0,1,0,0,0,1,0,0,0	0,0,0,0,0,0,1,0,0,0,1,0,0,0,0
19	0,0,1,0,0,0,0,1,0,0,0,0,0,0,0	0,1,0,0,0,0,1,0,0,0,0,0,0,0,0	45	0,0,0,0,0,0,0,1,0,0,0,1,0,0,0	0,0,0,0,0,0,0,0,0,0,1,0,0,1,0
20	0,0,1,0,0,0,0,1,0,0,0,0,0,0,0	0,0,0,0,0,0,1,0,0,0,1,0,0,0,0	46	0,0,0,0,0,0,0,1,0,0,0,0,0,1,0	0,1,0,0,0,0,0,0,0,0,0,0,1,0,0
21	0,0,1,0,0,0,0,0,0,0,1,0,0,0,0	1,0,0,0,0,0,0,0,0,0,0,0,0,1,0	47	0,0,0,0,0,0,0,1,0,0,0,0,0,1,0	0,0,1,0,0,0,0,0,0,0,1,0,0,0,0
22	0,0,1,0,0,0,0,0,0,0,1,0,0,0,0	0,0,0,0,1,0,1,0,0,0,0,0,0,0,0	48	0,0,0,0,0,0,0,0,0,0,1,0,0,1,0	1,0,0,0,0,0,0,0,0,0,0,0,1,0,0
23	0,0,1,0,0,0,0,0,0,0,1,0,0,0,0	0,0,0,0,0,0,0,1,0,0,0,0,0,1,0	49	0,0,0,0,0,0,0,0,0,0,1,0,0,1,0	0,0,1,0,0,0,0,1,0,0,0,0,0,0,0
24	0,0,0,0,1,1,0,0,0,0,0,0,0,0,0	0,1,0,0,0,0,1,0,0,0,0,0,0,0,0	50	0,0,0,0,0,0,0,0,0,0,1,0,0,1,0	0,0,1,0,0,0,0,0,0,0,0,0,0,0,1
25	0,0,0,0,1,1,0,0,0,0,0,0,0,0,0	0,1,0,0,0,0,0,0,0,0,0,0,0,1,0	51	0,0,0,0,0,0,0,0,0,0,1,0,0,1,0	0,0,0,0,1,0,0,0,0,0,0,0,1,0,0
26	0,0,0,0,1,1,0,0,0,0,0,0,0,0,0	0,0,0,0,0,0,0,0,0,0,1,0,0,1,0	52	0,0,0,0,0,0,0,0,0,0,1,0,0,1,0	0,0,0,0,0,0,0,1,0,0,0,1,0,0,0

表1

表2

参考文献 19

[1]	SHANNON C E. Communication Theory of Secrecy Systems[J]. The Bell System Technical Journal, 1949,28(4):656-715.
[2]	DIFFIE W, HELLMAN M E. Exhaustive Cryptanalysis of the NBS Data Encryption Standard[J]. Computer, 1977,10(6):74-84.
[3]	DAEMEN J, RIJMEN V. The Design of Rijndael:AES-the Advanced Encryption Standard[M]. Heidelberg:Springer, 2002.
[4]	AOKI K, ICHIKAWA T, KANDA M, et al. Camellia:a 128-Bit Block Cipher Suitable for Multiple Platforms-Design and Analysis [C]//Lecture Notes in Computer Science:2012.Heidelberg:Springer Verlag, 2001: 39-56.
[5]	WU W L, ZHANG W T, FENG D G. Impossible Differential Cryptanalysis of ARIA and Camellia[J]. Journal of Computer Science and Technology, 2007,22(3):449-456.
[6]	TAIZO S, KYOJI S, TORU A, et al. The 128-bit Block Cipher CLEFIA [C]//Lecture Notes in Computer Science:4593.Heidelberg:Springer Verlag, 2007: 181-195.
[7]	BOGDANOV A, KNUDSEN L R, LEANDER G, et al. PRESENT:an Ultra-Lightweight Block Cipher [C]//Lecture Notes in Computer Science:4727,Heidelberg:Springer Verlag, 2007: 450-466.
[8]	JIA P, XU H, QI W F. Research on Cryptographic Properties of Lightweight S-boxes[J]. Journal of Cryptologic Research, 2015,2(6):497-504.
[9]	BORGHOFF J, CANTEAUT A, GÜNEYSU T,et al.PRINCE:a Low-latency Block Cipher for Pervasive Computing Applications [C]//Lecture Notes in Computer Science:7658.Heidelberg:Springer Verlag, 2012: 208-225.
[10]	魏悦川, 潘晓中, 戎宜生, 等. 对PRINCE分组密码的不可能差分攻击[J]. 西安电子科技大学学报, 2017,44(1):119-124.
	WEI Yuechuan, PAN Xiaozhong, RONG Yisheng, et al. Impossible Differential Cryptanalysis on the PRINCE[J]. Journal of Xidian University, 2017,44(1):119-124.
[11]	BEIERLE C, JEAN J, KOLBL S, et al. The Skinny Family of Block Ciphers and Its Low-latency Variant Mantis [C]//Lecture Notes in Computer Science:9815.Heidelberg:Springer Verlag, 2016: 123-153.
[12]	徐洪, 段明, 谭林, 等. NBC算法[J]. 密码学报, 2019,6(6):760-767.
	XU Hong, DUAN Ming, TAN Lin, et al. On the NBC Algorithm[J]. Journal of Cryptologic Research, 2019,6(6):760-767.
[13]	田甜, 戚文峰, 叶晨东, 等. 基于NFSR的分组密码算法SPRING[J]. 密码学报, 2019,6(6):815-834.
	TIAN Tian, QI Wenfeng, YE Chendong, et al. SPRING:a Family of Small Hardware-oriented Block Ciphers Based on NFSRs[J]. Journal of Cryptologic Research, 2019,6(6):815-834.
[14]	FARAHMAND F, DIEHL W, ABDULGADIR A, et al. Improved Lightweight Implementations of CAESAR Authenticated Ciphers [C]//Proceedings of the 2018 26th IEEE International Symposium on Field-Programmable Custom Computing Machines.Piscataway:IEEE, 2018: 29-36.
[15]	TEMPELMEIER M, FARAHMAND F, HOMSIRIKAMOL E, et al. Implementer’s Guide to Hardware Implementations Compliant with the Hardware API for Lightweight Cryptography[EB/OL].[2020-07-22].https://cryptography.gmu.edu/athena/LWC/ LWC_HW_Implementers_Guide.pdf.
[16]	REZVANI B, COLEMAN F, SACHIN S, et al.Hardware Implementations of NIST Lightweight Cryptographic Candidates:a First Look:Cryptology ePrint Archive:Report 2019/824[R/OL]. [2020-07-22].https://eprint.iacr.org/2019/824.
[17]	IWATA T, KHAIRALLAH M, MINERNATSU K, et al.Duel of the Titans:the Romulus and Remus Families of Lightweight AEAD Algorithms:Cryptology ePrint Archive:Report 2019/992[R/OL]. [2020-07-22].https://eprint.iacr.org/2019/992.
[18]	SADEGH S, NASOUR B.An Argument on the Security of LRBC,a Recently Proposed Lightweight Block Cipher:Cryptology ePrint Archive:Report 2020/392[R/OL]. [2020-07-22].https://eprint.iacr.org/2020/392.
[19]	DE MEYER L.Looking at the NIST Lightweight Candidates from a Masking Point-of-View:Cryptology ePrint Archive:Report 2020/699[R/OL]. [2020-07-22].https://eprint.iacr.org/2020/699.

CCZ等价类	S盒序号	CCZ等价类	S盒序号	CCZ等价类	S盒序号	CCZ等价类	S盒序号
Group_S0	1,13,18,21	Group_S3	4,7,35,48	Group_S6	9,26,43,49	Group_S9	16,20,31,40
Group_S1	2,5,37,50	Group_S4	6,24,45,51	Group_S7	10,14,22,30	Group_S10	17,25,39,44
Group_S2	3,15,36,38	Group_S5	8,19,32,52	Group_S8	11,12,23,29	Group_S11	27,34,41,47
Group_S2	3,15,36,38	Group_S5	8,19,32,52	Group_S8	11,12,23,29	Group_S12	28,33,42,46