JP2010245753A - Encryption operation circuit device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the problem that the power consumption of a circuit increases because a complicated circuit needs to be added in accordance with masking, increasing a gate scale and the amount of operations in the conventional manner. <P>SOLUTION: This encryption operation circuit device includes: an input selecting section for selecting external input data at the first time of a processing unit composed of the prescribed number of times of performing repetition processing and selecting internal input data in the subsequent processing; a function processing section; a random number generating section; a first exclusive OR operation section for obtaining an exclusive OR between output data of the function processing section and random number data generated by the random number generating section; a data holding section for holding an operation result of the first exclusive OR operation section; a second exclusive OR operation section for obtaining an exclusive OR between output data of the data holding section and the random number data generated by the random number generating section to define the exclusive OR as internal input data; and a control section for controlling processing timing of each section for each processing unit, and controlling processing timing for outputting to the outside an operation result of the second exclusive OR operation section as encryption data after executing the prescribed number of times of a series of processing from the input selecting section to the second exclusive OR operation section. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a cryptographic operation circuit device that performs cryptographic algorithm processing. In particular, the present invention relates to a technique for avoiding a cryptographic analysis attack that decrypts a cipher by analyzing a physical change amount of a calculation intermediate value in a cryptographic operation circuit.

  In recent years, IC cards and portable terminals having a security function have been widely used. Such a device requiring security uses some kind of cryptographic algorithm, and has a mechanism that prevents information from leaking to a third party. Recently, however, side-channel attacks against cryptographic algorithms implemented in such IC cards and portable terminals have become a major threat. A side channel attack is an attempt to obtain fraudulent information by using leakage information such as power consumption, leakage electromagnetic waves, or calculation time when a cryptographic operation circuit that is not supposed to be acquired by a third party is operating. Is an attack. Among such side channel attacks, a technique for statistically processing the amount of change in power consumption obtained during cryptographic operations and decrypting secret information is called a differential power analysis (DPA) attack and is a major threat. It has become.

  There are two methods for implementing cryptographic algorithms in such a security device: software implementation by a CPU (central processing unit) and hardware implementation by wired logic. In many cases, hardware implementation is adopted for implementation of cryptographic algorithms on an IC card or a simple portable terminal due to a problem of processing speed or a demand for low power consumption.

  Here, an example in which a block cipher algorithm represented by AES (Advanced Encryption Standard) is implemented in hardware will be described. FIG. 10 is a diagram showing a configuration of a cryptographic operation circuit device 900 for calculating a round function, which is divided into a stirring unit 901 and a key scheduling unit 902.

  In FIG. 10, the agitation unit 901 includes a selector 903 that selects plaintext (or ciphertext) input from the outside and data after round processing, a combinational circuit 904 that performs round processing with a predetermined processing function, and a combinational circuit 904. The register 905 temporarily holds the output data of the register 905 and the selector 906 that selects the output data of the register 905 or All = 0 (all 0 data) and outputs the selected data to the outside. The agitation unit 901 inputs plaintext (or ciphertext) as processing target data, performs encryption a predetermined number of times using a subkey (round key) created from the secret key by the key scheduling unit 902, Output the sentence (or plaintext) as processed data.

  In the agitation unit 901, one round process is performed in one clock, and the round process of one cycle of the selector 903, the combinational circuit 904, and the register 905 is repeated a predetermined number of times in synchronization with the clock. That is, the agitation unit 901 based on the round process of the combinational circuit 904 performs a new round process using the value of the sub key output from the key scheduling unit 902 and the intermediate value of the round process one clock before, The process of storing the operation result in the register as a new intermediate value is repeated. Then, the operation result of the round processing function is held in the register 905 as an intermediate value for each clock, and after the clock has advanced by the required number of rounds, the value appearing in the register 905 becomes the final operation result. The data is output to the outside of the cryptographic operation circuit device 900 as (in the case of encryption) or plain text (in the case of decryption). As described above, in order to avoid outputting unnecessary information such as an intermediate value of an intermediate round process to the outside, only the final result after all round processes are output.

  On the other hand, the key scheduling unit 902 includes a selector 907 that selects a secret key input from the outside and data after key scheduling processing, a register 908 that temporarily stores output data of the selector 907, and a key with a predetermined processing function. And a combinational circuit 909 that performs scheduling processing. The key scheduling unit 902 generates a subkey necessary for each round process from a secret key given from the outside of the cryptographic operation circuit device 900.

  The control unit 950 outputs a clock, a control signal a, a control signal b, and a control signal c to the selector 903, the register 905, the selector 906, the selector 907, and the register 908 to control the processing timing of each unit.

  Here, it is necessary to securely manage the secret key value so that it is not known to a third party. However, if the value of the subkey used in each round process is revealed by some method, the process of the key scheduling unit 902 is performed. There is a problem that the value of the secret key is known to a third party by calculating back. Therefore, in the design of the cryptographic operation circuit, it is necessary to consider so that the subkey is not estimated by a differential power analysis attack or the like.

  Among the differential power analysis attacks, the CPA (Correlation Power Analysis) attack shown in Non-Patent Document 1 is an attack method that focuses on the change of the register value that holds the operation intermediate value. It is known as a very effective attack method. The outline of the CPA attack against the AES algorithm will be described below (see Non-Patent Document 1).

  In the agitation unit 901 of the cryptographic operation circuit device 900 showing the hardware configuration of the block cipher algorithm in FIG. 10 described above, if the amount of change (Hamming distance) in the register 905 after one clock is large, the current value at that time It can be considered that power consumption should be large. Further, when the value of the register 905 changes, the input value of the logic gate constituting the combinational circuit 904 that performs the round process also changes accordingly, so that the state transition of the logic gate is performed. As a result, there should be a correlation between the Hamming distance of the register 905 and the power consumption at that time. Here, when the intermediate value of the register 905 is controlled so as not to be output to the outside during the round process, the possibility of calculating the Hamming distance of the register 905 is the initial round with input from the outside. Two places in the final round with output to the outside. Here, a case where the last round becomes an attack point will be described (see Non-Patent Document 1).

The register value one clock before the last round can be calculated by tracing the last round process of AES in reverse, assuming a subkey value for the last round. For example, as shown in FIG. 11, the final round process is a process of SubBytes->ShiftRow-> AddKey, and is closed to a process of 1 byte unit. Therefore, 256 values of byte values from 0x00 to 0xff are set as subkey estimation targets. If any one of them is determined, the processing byte value one clock before can be calculated. In FIG. 11, when the register value one clock before is s _{i, j} , the ciphertext output is c _{i, j} , and the subkey is k _{i, j} (where i and j are integers of 4 × 4 16 bytes) For example, as shown in FIG. 11, the processing byte value s _2,0 one clock before can be calculated as s _2,0 = c _2,2 (+) k _2,2 (here (+) Indicates an EXOR operation). Therefore, the hamming distance before and after one clock of the last round for the 1-byte component at the coordinate (2,0) position is s _2,0 (+) c _2,0 , and when calculated backward, c _2,0 (+) c _2,2 (+) K _{2 and 2} can be calculated. Here, as described above, k _2,2 can take any value from 0x00 to 0xff, but the processing byte value one clock before can be obtained by only determining one of 256 values. Can be calculated. The same applies to the remaining 15-byte component of the coordinate position.

Here, an operation is performed on N plaintexts (c _i ) of 1 ≦ i ≦ N (N is a natural number), and the Hamming distance determined from the value of the subkey k is set to h _i (k), and the correlation with the power consumption. As the Pearson correlation coefficient. Also, if the power consumption for c _i is p _i (t),
Pearson correlation coefficient Corr of h _i (k) and _{p i (t) (h i} (k), p i (t)) is,

で定義される。

Defined by

このような相関係数を副鍵が取り得る０ｘ００から０ｘｆｆの全ての値について計算する。

Such a correlation coefficient is calculated for all values from 0x00 to 0xff that the subkey can take.

  As described above, since the Hamming distance and the power consumption have a positive correlation, the value of the sub key that maximizes the correlation coefficient is the true sub key. If the values of all the 16-byte subkeys are estimated in this way, the secret key value can be obtained illegally by calculating back the key scheduling processing unit 902.

  As a conventional countermeasure against the differential power analysis attack represented by such a CPA attack, a method of masking an intermediate value of an operation using a random number is known (for example, see Non-Patent Document 2). In this document, masking of the SubBytes function, which is a key function of the AES algorithm, is described, but other functions such as the MixColumn function are also masked and include intermediate values stored in a register in the middle of round processing. Since all intermediate values except the ciphertext that is the final operation result can be masked with random numbers, the value obtained by masking the original round processing result is stored in the register.

FIG. 12 shows a configuration in the case where the AES round processing function (SubBytes->ShiftRows->MixColumns-> AddRoundKey) is masked with random numbers (see, for example, Non-Patent Document 2). In FIG. 12, Shift is an abbreviation for ShiftRows, Mix is an abbreviation for MixColumns, and Add is an abbreviation for AddRoundKey. Further, f represents the isomorphism map, and g represents a composite mapping of the inverse mapping of the isomorphism mapping and the linear transformation unit of the AES affine transformation. The Galois field inverse element x ^{−1 in} SubBytes is shown in FIG. 8 shows a circuit according _{a r a, r tmp1, r tmp2} , r b , respectively M, Z, W, random number mask corresponding to the F. Here, since ShiftRows is a simple Byte shift operation and AddRoundKey is an EXOR operation, a general function can be used as it is. Further, MixColumn is a linear function, and by performing an EXOR operation on a value obtained by processing the MixColumn function on the processing result by MixColumn (1) and a value obtained by processing the same MixColumn function on a random number by MixColumn (2), MixColumn is performed. The random component of the input of (1) can be canceled. Here, when compared with a normal round processing function that does not perform the mask processing as described in FIG. 10, functions of f and g, a MixColumn function, and the like for conversion of random values are added in addition to an EXOR operation with a random number. Has been. As a result, the value obtained by EXORing the value of the normal round processing result and the random number value is stored in the register, so that the Hamming distance is calculated from the difference between the values before and after the round processing by the mask effect of the random number. I can't. For this reason, the correlation between the difference amount and the correct subkey value becomes small, and the peak of the correlation coefficient does not appear, so that the differential power analysis attack represented by the CPA attack can be protected.

  In this way, in the prior art, the differential power analysis attack is protected by a complicated cryptographic operation circuit as shown in FIG. The above-described cryptographic operation circuit device 900 is a conventional example using a block encryption algorithm. However, the same applies to a cryptographic operation circuit device 960 using a conventional public key encryption algorithm as shown in FIG. Can do. The cryptographic operation circuit device 960 in FIG. 13 includes a cryptographic operation circuit that uses a power-residue operation and an elliptic scalar multiplication operation that are used in public-key encryption operations, and includes a stirring unit 961 and a secret key (power exponent or An exponent expansion unit 962 based on a scalar multiple index) and a control unit 970.

  In FIG. 13, the agitation unit 961 includes a combinational circuit 963 that performs a predetermined power-residue calculation and an elliptic scalar multiplication operation, a register 964 that temporarily holds output data of the combinational circuit 963, and output data of the register 964 or All = 0 (all 0 data) is selected and output to the outside. The exponent expansion unit 962 expands the exponent value, which is a secret key, into a binary value, for example, and outputs the result to the combinational circuit 963 in order from the upper bit or the lower bit of the expanded binary value. The combinational circuit 963 uses a binary value expanded by the exponent expansion unit 962 for plaintext (or ciphertext) input from the outside, performs multiplication or self-multiplication in the case of a power-residue operation, or elliptic scalar multiplication In the case of, ellipse addition or ellipse doubling is performed. The calculation result is held in the register 964 for one clock period and fed back to the combinational circuit 963 in the next round. Then, the same round processing is performed for each clock, and after repeated execution for the expansion bit length of the exponent output from the exponent expansion unit 962, the value appearing in the register 964 becomes the final operation result, and this value is converted to the ciphertext (encryption ) Or plaintext (in the case of decryption) is output to the outside of the cryptographic operation circuit device 960. The control unit 970 outputs a clock and a control signal d to the selector 965 to control processing timing of each unit. Here, FIG. 13 shows a case where an arithmetic operation for one bit of the exponent developed by the exponent developing unit 962 is processed in one clock.

  However, similarly to the cryptographic operation circuit device 900 shown in FIG. 10, the cryptographic operation circuit device 960 shown in FIG. 13 also uses a register intermediate in the bit-by-bit processing of the developed exponent for exponentiation remainder calculation and elliptic scalar multiplication. The value Hamming distance cannot prevent a CPA attack that is used as a clue to the attack.

Sugawara, Honma, Aoki, Sato, “Power channel analysis experiment on cryptographic hardware using side channel attack standard evaluation FPGA board,” Multimedia, Distributed, Collaboration and Mobile (DICOMO2007) Symposium, 7D-5, 2007. E. Trichina, “Small Size, Low Power Side Channel-Immune AES Co-processor Design and Synthesis Results”, AES 2004.

  As described above, the CPA attack protection measures according to the prior art have a complicated configuration of the cryptographic operation circuit, a large amount of processing, and problems with circuit scale and cost. For example, the defense countermeasure shown in Non-Patent Document 2 is a countermeasure against CPA attack that masks all intermediate values in the middle of Galois field inverse element calculation of the SubBytes part. For this reason, since it is necessary to mask not only the SubBytes part but also the combination circuit of the whole round process such as the MixColumn part and the AddKey part, random numbers necessary for masking must be prepared for each logic gate constituting the round processing function. I must. As a result, it is necessary to add a large number of EXOR circuits and spare circuits accompanying masking, which complicates the circuit of the round processing function, increases the gate scale, and further increases the amount of calculation, thereby increasing the power consumption of the circuit. The problem arises.

  In view of the above problems, the object of the present invention is to enable the masking by random numbers while diverting the conventional block of the encryption processing function without masking as much as possible, and to implement a new EXOR gate and a spare circuit as much as possible. An object of the present invention is to provide a cryptographic operation circuit device capable of avoiding a CPA attack while suppressing an increase in gate circuit scale and power consumption by reducing the number of gate circuits.

  According to a first aspect of the present invention, there is provided a cryptographic operation circuit device comprising: an input selection unit that selects external input data for the first time of a processing unit configured by a predetermined number of repetition processes, and selects internal input data for subsequent processes. A function processing unit that performs predetermined function processing on the data selected by the input selection unit to generate output data; a random number generation unit that generates random data having a bit width equal to the output data of the function processing unit; A first exclusive OR operation unit that obtains an exclusive OR of the output data of the function processing unit and the random number data generated by the random number generation unit, and holds the operation result of the first exclusive OR operation unit A data holding unit, a second exclusive OR operation unit that obtains an exclusive OR of the output data of the data holding unit and the random number data generated by the random number generation unit and sets the internal input data, For each processing unit The processing timing of each unit is controlled, and the operation result of the second exclusive OR operation unit after executing a series of processing from the input selection unit to the second exclusive OR operation unit a predetermined number of times is encrypted data. And a control unit for controlling processing timing to be output to the outside.

  In claim 1, for example, the calculation result of a processing function (function processing unit) composed of a combinational circuit that repeatedly executes cryptographic calculation processing at every clock of processing timing (control unit) is masked with a random number (random number generation unit). ExOR (first exclusive OR operation unit), a register (data holding unit) that holds a masked operation intermediate value, and ExOR (second exclusion) that unmasks the masked value with the same random number This is a cryptographic operation circuit device that is input again to the function processing unit via a logical OR operation unit) and repeatedly executes a predetermined number of processes as the clock signal (processing unit) advances. Since it is masked with a random number when it is stored in the register, there is no correlation between the power consumption and the operation intermediate value, and the CPA attack that decrypts the secret information by statistically processing the amount of change in power consumption obtained during the cryptographic operation Can defend against. In addition, since the unmasked original function processing data is input when inputting to the function processing unit, the conventional circuit configuration can be used.

  The cryptographic operation circuit device according to claim 2 of the present invention is the cryptographic operation circuit device according to claim 1, wherein the control unit holds the operation result of the first exclusive OR operation unit as the data The processing of the second exclusive OR operation unit is executed at a processing timing next to the processing timing held in the unit.

  In the second aspect, for example, the calculation result of the processing function (function processing unit) is masked by ExOR (first exclusive OR calculation unit) and stored in the register (data holding unit) at the next processing timing. ExOR (second exclusive OR operation unit) unmasks the masked value with the same random number, thereby reliably masking the operation intermediate value of the function processing unit while diverting the conventional circuit configuration. Can be

  According to a third aspect of the present invention, in the cryptographic operation circuit device according to the second aspect, the control unit generates the random number generation unit in the initialization step of the series of processes. A process of holding random number data in the data holding unit is executed. Thereby, the process at the time of initialization can be simplified.

  According to a fourth aspect of the present invention, in the cryptographic operation circuit device according to the second aspect, in the first processing step of the series of processes, the control unit performs the first exclusive logic operation. The processing of the second exclusive OR operation unit is executed at a processing timing next to the processing timing of holding the operation result of the sum operation unit in the data holding unit.

  In claim 4, for example, since the output data generated by the function processing unit at the very first timing is masked with a random number and stored in a register (data holding unit), it is possible to protect in the initial round that is susceptible to a CPA attack. Become.

  The cryptographic operation circuit device according to a fifth aspect of the present invention is the cryptographic operation circuit device according to the second aspect, wherein the control unit includes the first exclusive logic in the final processing step of the series of processes. The processing of the second exclusive OR operation unit is executed at a processing timing next to the processing timing of holding the operation result of the sum operation unit in the data holding unit.

  In the fifth aspect, for example, the output data generated by the function processing unit at the last timing is masked with a random number and stored in a register (data holding unit). Become.

  A cryptographic operation circuit device according to claim 6 of the present invention is the cryptographic operation circuit device according to any one of claims 1 to 5, wherein the random number generated by the random number generation unit is at least for each processing unit. It is a pseudo random number or a true random number to be updated.

  According to the sixth aspect of the present invention, the correlation between the calculation intermediate value held in the register by the pseudo random number or the true random number and the power consumption can be eliminated, and the amount of change in the power consumption obtained during the cryptographic calculation is statistically processed to obtain the secret information. You can defend against CPA attacks that decipher.

  In the cryptographic operation circuit device according to claim 7 of the present invention, the input unit selects the external input data for the first time of the processing unit configured by the predetermined number of repetition processes, and selects the internal input data for the subsequent processes. A function processing unit that performs predetermined function processing on the data selected by the input selection unit to generate output data, and a random number generation unit that generates random data having a bit width equal to the output data of the function processing unit , A first exclusive OR operation unit for obtaining an exclusive OR of the output data of the function processing unit and the random number data generated by the random number generation unit, and an operation result of the first exclusive OR operation unit Alternatively, a data holding unit that holds output data of the function processing unit, and a second exclusive OR operation unit that obtains an exclusive OR of the output data of the data holding unit and the random number data generated by the random number generation unit When, The processing timing of each unit for each processing unit is controlled, and in the first processing unit, the operations of the first exclusive OR operation unit and the second exclusive OR operation unit are executed, and the second and subsequent processing In units, the operations of the first exclusive OR operation unit and the second exclusive OR operation unit are alternately executed for each process, and from the input selection unit to the second exclusive OR operation unit. A control unit for controlling the processing timing of outputting the operation result of the second exclusive OR operation unit or the output data of the data holding unit as encrypted data to the outside after a predetermined number of executions of the series of processes as the processing unit It is characterized by comprising.

  According to a seventh aspect of the present invention, for example, an operation result of a processing function (function processing unit) composed of a combinational circuit that repeatedly executes cryptographic operation processing every clock of processing timing (control unit) is masked with a random number (random number generation unit). ExOR (first exclusive OR operation unit), a register (data holding unit) that holds a masked operation intermediate value, and ExOR (second exclusion) that unmasks the masked value with the same random number Is a cryptographic operation circuit device that inputs again to the function processing unit via the logical OR operation unit) and repeatedly executes the processing for a predetermined number of times according to the progress of the clock signal (processing unit). In the second and subsequent times, a processing unit that performs masking and unmasking processing and a processing unit that does not perform masking and unmasking processing are alternately executed. In this way, it is difficult to calculate the hamming distance of the register intermediate value by executing alternately, and it is possible to protect against the CPA attack.

  The cryptographic operation circuit device according to claim 8 of the present invention is the cryptographic operation circuit device according to claim 7, wherein the random number generated by the random number generation unit is at a frequency of at least once every two processing units. It is a pseudo random number or a true random number to be updated.

  In claim 8, the correlation between the operation intermediate value held in the register by the pseudo random number or the true random number and the power consumption can be eliminated, and the amount of change in the power consumption obtained during the cryptographic operation is statistically processed to obtain the secret information. You can defend against CPA attacks that decipher.

  The cryptographic operation circuit device according to the present invention generates random number data having a bit width equal to the output data, and stores the output data or random number data of the function processing unit in the two data holding units, thereby calculating the power consumption amount. Correlation with the Hamming distance of the result is lost, and it is possible to protect against a CPA attack that decrypts secret information by statistically processing the amount of change in power consumption obtained during cryptographic computation. In particular, it is possible to realize masking by random numbers while diverting the block of the conventional encryption processing function without masking, and increase the scale of the gate circuit by minimizing new implementations of new EXOR gates and spare circuits. A CPA attack can be avoided while suppressing an increase in power consumption.

It is explanatory drawing which shows the structural example of the block encryption arithmetic circuit apparatus 100 which concerns on 1st Embodiment. 3 is a timing chart of the block cipher operation circuit device 100 according to the first embodiment. It is explanatory drawing which shows operation | movement of the block encryption arithmetic circuit apparatus 100 which concerns on 1st Embodiment in time series. It is a timing chart of the modification of 1st Embodiment. It is explanatory drawing which shows the operation | movement of the modification of 1st Embodiment in time series. It is explanatory drawing which shows the structural example of the 2 stage | paragraph pipeline type block encryption arithmetic circuit apparatus 200 which concerns on 2nd Embodiment. 6 is a timing chart of the two-stage pipeline block encryption arithmetic circuit device 200 according to the second embodiment. It is explanatory drawing which shows the structural example of the public key encryption arithmetic circuit apparatus 300 which concerns on 3rd Embodiment. It is a timing chart of the public key encryption arithmetic circuit device 300 which concerns on 3rd Embodiment. It is explanatory drawing which shows the structural example of the cryptographic operation circuit apparatus 900 which processes the conventional block cipher algorithm. It is explanatory drawing of the last round process of a general AES round process function. It is explanatory drawing which shows the example of the AES round process which performed the conventional masking countermeasure. It is explanatory drawing which shows the structural example of the encryption arithmetic circuit apparatus 960 which processes the conventional public key encryption arithmetic algorithm.

  Hereinafter, embodiments of a cryptographic operation circuit device according to the present invention will be described in detail with reference to the drawings.

(First embodiment)
FIG. 1 shows a configuration example of a cryptographic operation circuit device 100 according to the present embodiment. The cryptographic operation circuit device 100 shown in FIG. 1 corresponds to the cryptographic operation circuit device 900 of FIG. 10 described in the prior art, and is configured to perform one round processing with one clock for a block encryption algorithm typified by AES. ing. 1 includes the agitation unit 101 and the control unit 150 without including the portion corresponding to the key scheduling unit 902 in FIG. 10, and the sub key is input from the outside. However, the same block as the key scheduling unit 902 may be included as the cryptographic operation circuit device 100.

  In FIG. 1, a stirring unit 101 includes a selector 103 that selects plaintext (or ciphertext) input from the outside or data after round processing, a combinational circuit 104 that performs round processing with a predetermined processing function, and a random number generation unit. 105, the selector 106 that selects the random number data output from the random number generation unit 105 or All = 0 (all 0 data), and EXOR for obtaining an exclusive OR of the output data of the selector 106 and the output data of the combinational circuit 104 A circuit 107 (first exclusive OR operation unit), a register 108 that temporarily holds output data of the EXOR circuit 107, and random number data output from the random number generation unit 105 or All = 0 (all 0 data). The selector 109 for selecting the data, and the exclusive OR of the output data of the register 108 and the output data of the selector 109 is obtained. It constituted an EXOR circuit 110 (second exclusive-OR operation unit), and the output data or All = 0 selector 111 to be output to the outside by selecting (all zero data) of the EXOR circuit 110.

  The control unit 150 provides a reset signal to the register 108, supplies a clock to the random number generation unit 105 and the register 108, a control signal 1 to the selector 103, a control signal 2 to the selector 106, a control signal 3 to the selector 109, a selector The control signal 4 is output to 111 to control the processing timing of the stirring unit 101. Here, the control signal 1 is a control signal for selecting a plaintext (or ciphertext) input from the outside as an input of the processing function or a result of the processing function of the previous round held in the register 108. The control signal 2 is a control signal for selecting whether to perform masking with a random number when storing the result of the processing function in the register 108 or to store in the register 108 without masking. The control signal 3 is a control signal for selecting whether to perform unmasking with the random number used for masking when reading the value stored in the register 108 or to read without performing unmasking. The control signal 4 is a control signal for selecting whether or not to output the final calculation result to the outside.

  Note that the control unit 150 controls the overall operation of the cryptographic operation circuit device 100. When the key scheduling unit 902 in FIG. 10 is included, the control unit 150 also provides a clock and clock to the key scheduling unit 902 as in the control unit 905 in FIG. Output a control signal. In this case, the control unit 150 outputs a control signal c to the selector 907 of the key scheduling unit 902 and supplies a clock to the register 908. Further, H and L described in each selector in FIG. 1 represent the levels of binary control signals, H represents a high level, and L represents a low level.

  Similar to the agitation unit 901 of FIG. 10 of the prior art, the agitation unit 101 in FIG. 1 inputs plaintext (or ciphertext) as processing target data, and creates a subkey (round) created from the secret key by the key scheduling unit 902 or the like. The key is used for encryption by performing a predetermined number of round processes, and ciphertext (or plaintext) is output as processed data.

  In the agitation unit 101, one round process is performed in one clock period, and a series of round processes that go around the selector 103, the combinational circuit 104, the EXOR circuit 107, the register 108, and the EXOR circuit 110 are performed on the clock supplied from the control unit 150 Repeated a predetermined number of times in synchronization. That is, the agitation unit 101 based on the round process of the combinational circuit 104 performs a new round process using the value of the sub key input from the key scheduling unit 902 and the intermediate value of the round process one clock before. The process of storing the calculation result as a new intermediate value in the register 108 is repeated. Then, after the clock has advanced by the required number of rounds, the data output from the combinational circuit 104 in the final round becomes the final operation result, and this value is used as ciphertext (for encryption) or plaintext (for decryption). The data is held in the register 109 via the selector 108 and output to the outside of the cryptographic operation circuit device 100 via the selector 110.

  The cryptographic operation circuit device 100 according to the present embodiment is different from the conventional cryptographic operation circuit device 900 shown in FIG. 10 in that the random number generation unit 105 in the EXOR circuit 107 before storing the operation result of the combinational circuit 104 in the register 108. The random number data generated by the random number generation unit 105 in the EXOR circuit 110 when the exclusive OR operation of the random number data generated by the calculation result and the calculation result is read and the data stored in the register 108 is read (the register 108 immediately before The exclusive OR operation of the data stored in the register 108 and the data stored in the register 108 is performed.

  Note that the random number generated by the random number generation unit 105 is a true random number or a pseudo-random number. Then, the random number generation unit 105 updates to a new random number value for each calculation of one block unit that is an encryption processing unit. Further, the selector 106 and the selector 109 are controlled by the control signal 2 and the control signal 3, respectively, and when the control signal 2 and the control signal 3 are High, all 0 data is output. Therefore, the EXOR circuit 107 and the EXOR circuit 110 are output. The input data is output as it is. Therefore, the same effect can be obtained even if the circuit configuration is such that the EXOR circuit 107 and the EXOR circuit 110 are bypassed when the control signal 2 and the control signal 3 are High.

  Here, in FIG. 1, the control signal 1 of the selector 103 for selecting the input data (plaintext or ciphertext) from the outside or the operation result of the previous round process fed back, the operation result of the round process or a fixed value (this In the embodiment, the control signal 4 of the selector 111 for selecting all = 0) corresponds to the control signal a of the selector 903 and the control signal b of the selector 906 of the conventional cryptographic operation circuit device 900 of FIG.

  Next, the operation of the cryptographic operation circuit device 100 of FIG. 1 will be described in detail with reference to the timing chart of FIG. FIG. 2 is a timing chart illustrating the relationship between the reset signal output from the control unit 150, the clock, the control signal 1, the control signal 2, the control signal 3, the control signal 4, and the register 108. It is. In FIG. 2, all (n + 1) rounds from the initial round to the final round are defined as one block calculation, and a ciphertext (or plaintext) as a processing result is output to the outside for each block calculation. Further, the round processing function by the combinational circuit 104 in FIG. 1 is executed every clock cycle, and the register 108 holds input data in one clock cycle. It is assumed that the initial value of the register 108 is initialized to a predetermined value (for example, all 0) when the reset signal becomes Low.

2, notation t _{2n + 3} from the timing t ₀ indicates the timing position for each clock cycle, d _n from d ₀ represents the output data for each round of the round processing function by the combination circuit 104. For example d ₀ indicates the results of the values of the initial round processing function, d ₁ the value of the result of the first round processing function, d _n is the resulting value of the final round processing functions, respectively. R, r ′, and r ″ indicate random numbers generated by the random number generation unit 105 at an update frequency for each block calculation cycle, and the random numbers r, r ′, and r ″ indicate different random values. ing. Further, (+) represents an exclusive OR operator, for example, d ₀ (+) r is an exclusive OR operation value of d ₀ and r.

  In FIG. 1, the clock is input from the control unit 150 to the random number generation unit 105. However, in the flowchart of FIG. 2, the random number generation unit 105 will be described as generating a new random number every final round. This case can be realized by providing a counter that counts one block of clocks inside the random number generator 105.

In FIG. 2, first, the reset is controlled to Low before timing t ₀ , so that the register 108 is initialized to All = 0. After timing _{t 0,} the reset is canceled under the control of the High.

At the next timing t ₁ , the control signal 2 is controlled to be Low, and the plaintext (or ciphertext) input from the outside is subjected to the initial round processing by the combinational circuit 104 and the random number generation unit 105 generates, for example, 128 bits The exclusive OR operation with the random number data r is masked by the EXOR circuit 107 and stored in the register 108. During this time, the control signal 1 is controlled to Low, and the control signal 1 is controlled to High from timing t ₂ to timing t _{n + 1} for processing the final round, and the selector 103, combinational circuit 104, EXOR circuit 107, register 108 and EXOR circuit 110 are controlled. N rounds of processing are performed.

At the next timing t ₂ , the control signal 3 is controlled to Low, the data held in the register 108, the random number data r generated by the random number generation unit 105 (the random number data used by the EXOR circuit 107 at the previous timing t ₁ , and An exclusive OR operation with the same random number data) is performed by the EXOR circuit 110 to unmask (unmask) and feed back to the selector 103 for the next round processing. Here, the unmasked data is the calculation result d ₀ that has been subjected to the initial round processing in the combinational circuit 104. Further, at timing t ₂ , since the control signal 2 is controlled to be high, the EXOR circuit 107 is equivalent to being bypassed as described above, and d ₀ fed back to the selector 103 is output by the combinational circuit 104. The operation result d ₁ processed by one round is stored in the register 108 bypassing the EXOR circuit 107.

At the next timing t ₃ , since the control signal 3 is controlled to be High, the EXOR circuit 110 is equivalent to being bypassed as described above, and d ₁ stored in the register 108 is connected to the EXOR circuit 110. The operation result d _{2 that} is bypassed and fed back to the selector 103 and processed in the second round by the combinational circuit 104 is stored in the register 108 by bypassing the EXOR circuit 107 because the control signal 2 remains High.

Thereafter, since the control signal 2 and the control signal 3 remain controlled to High until the timing t _{n at} which the (n−1) -th round is processed, the EXOR circuit 107 and the EXOR circuit 110 are bypassed. The cryptographic operation circuit device 900 operates in the same manner.

At timing t _{n + 1} to process the last round, the control signal 2 is controlled to Low, a combination circuit 104 (n-1) th round processing is calculation result d _n and random number generation unit 105 is newly generated e.g. An exclusive OR operation with the 128-bit random number data r ′ is performed by the EXOR circuit 107 to be masked and stored in the register 108.

At the next timing t _{n + 2} , the control signal 3 is controlled to be low, the data held in the register 108 and the random number data r ′ generated by the random number generation unit 105 (the random number data used by the EXOR circuit 107 at the previous timing t _{n + 1).} And the exclusive OR operation with the random number data) is performed by the EXOR circuit 110 to be unmasked and output to the selector 103 and the selector 111. At this time, since the control signal 1 is controlled to Low, the selector 103 inputs the next plaintext (or ciphertext), and the control signal 4 is also controlled to Low, so that the selector 111 uses the EXOR circuit 110. unmasked of data d _n is outputted as a ciphertext to the outside (or plaintext).

On the other hand, at the timing t _{n + 2} of the initial round of the period of the next block operation, the control signal 2 is controlled to High, so that the plaintext (or ciphertext) input from the outside via the selector 103 is received by the combinational circuit 104. initial rounds treated calculation result _{d 0} is stored in the register 108 by bypassing the EXOR circuit 107. The calculation result d ₀ does not mean the same value as the operation result d ₀ in the previous block operation, only represent the calculation result of the initial round of each block operation.

Thereafter, the operation from the timing t _{n + 3} to the timing t _{2n + 3} is the same as the operation from the timing t ₃ to the timing t _{n + 2} described above. Furthermore, when the next block calculation process is performed, the operation from the timing t _{n + 2} to the timing t _{2n + 3} may be repeated in the same manner. Note that the processing timings described above are all controlled by the control unit 150.

Here, in the cryptographic operation circuit device 100 according to the present embodiment, attention is paid to the processing of the initial round and the final round that are targets of the CPA attack. First, in the initial round processing timing t _1, the value of the register 108 is masked as an exclusive OR operation value of the operation result d ₀ of the random number r and the initial round processing. At this time, since the value of the random number r is different for each block operation, the amount of change (Hamming distance) in the register 108 cannot be estimated. However, the conventional circuit is not performed masked, the timing t ₁ previously input the initial value of the register 108 if it has been initialized to all the reset signal 0, for example, from outside the plaintext (or the ciphertext) (+) Since the operation result of the subkey is stored in the register 108, it is possible to calculate the register Hamming distance between the timings t ₀ and t ₁ , but in this embodiment, it is masked with a random number and stored in the register 108. As a result, the operation result of the plaintext (or ciphertext) (+) subkey (+) random number is stored in the register 108, and the register Hamming distance cannot be calculated.

Since the control signal 2 from the timing _{t 2} to time _{t n} is controlled to High, also from the timing _{t 3} to time _{t n + 1} is the control signal 3 is controlled to High, during which masking on the result of the processing functions A normal operation result that is not processed is stored in the register 108, but the process from the first round to the (n-1) th round is not a target of the CPA attack, so that the masking process is not necessary.

Further, even in the final round processing timing t _{n + 1,} the value of the register 108 is masked as an exclusive OR operation value of the operation result d _n of the random number r 'and the final round processing, the value of the register 108 The amount of change (Hamming distance) cannot be estimated. However, in a conventional circuit that does not perform masking, d _n is stored in the register 108 at timing t _{n + 1} , so that it is possible to calculate the register Hamming distance between timings t _n and t _{n + 1.} In the embodiment, the calculation result of d _n (+) random number is stored in the register 108 by masking with a random number and storing it in the register 108, so that the register Hamming distance cannot be calculated.

  Here, the operation flow, characteristics, and effects of the cryptographic operation circuit device 100 according to the present embodiment will be described with reference to the schematic diagram of FIG. In FIG. 3, the same reference numerals as those in FIG. In addition, although the blocks with the same reference numerals (register 108 and combinational circuit 104) are described in duplicate, these only depict the register 108 and combinational circuit 104 for each round so that the processing flow is easy to understand. Thus, the plurality of registers 108 and the combinational circuit 104 are not necessarily provided.

  The initialized value or the register value of the previous round is stored in the register 108 indicated by the dotted line immediately before the combination circuit 104 of the initial round processing in FIG. 3, but the plaintext (or ciphertext) input from the outside The calculation result of the combinational circuit 104 that performs the initial round processing is masked with the random number generated by the random number generation unit 105 in the EXOR circuit 107, stored in the next register 108, and output to the combinational circuit 104 that performs the first round processing. In addition, since the masked calculation result stored in the register 108 is read out and unmasked with the same random number generated by the random number generation unit 105 in the EXOR circuit 110, the calculation result immediately after the combination circuit 104 in the initial round processing is obtained. Calculate the register Hamming distance between the register 108 to be stored and the register 108 immediately before the initial round processing It is not possible.

  Similarly, an unmasked calculation result is stored in the register 108 immediately before the combination circuit 104 of the final round process in FIG. 3, but the calculation result of the combination circuit 104 of the final round process is a random number by the EXOR circuit 107. Masked with a random number generated by the generation unit 105 and stored in the next register 108, and when outputting the ciphertext (or plaintext) to the outside, the masked operation result stored in the register 108 is read and EXOR Since the circuit 110 performs unmasking with the same random number generated by the random number generation unit 105, the register Hamming distance between the register 108 immediately before and the register 108 immediately after the combination circuit 104 in the final round process cannot be calculated.

  As described above, the cryptographic operation circuit device 100 according to the present embodiment cannot calculate the Hamming distance in each register by assuming the subkey, and can eliminate the correlation between the subkey and the power consumption. As a result, the conventional round processing function portion not subjected to masking processing or the like can be used as it is, and a number of EXOR circuits and spares necessary for masking the entire round processing function with random numbers as in the prior art. No additional circuit is required. In particular, by masking the value of the register 108 only for the calculation results of the initial round process and the final round process, which are targets of the CPA attack, the CPA attack can be avoided with a minimum calculation amount and circuit overhead. .

(Modification of the first embodiment)
In the first embodiment, as shown in FIG. 2, the register 108 is reset to 0 at the time of initialization from the timing t ₀ to t ₁ , and the random number r is set at the next initial round from the timing t ₁ to t _2. D ₀ (+) r obtained by performing an exclusive OR operation on the operation result of the combinational circuit 104 is stored in the register 108. In contrast, in the modification of the first embodiment, as shown in FIG. 4, as at initialization the random number r in a register 108 of t ₁ from the timing t ₀ is stored, the next timing t ₁ From t to t ₂ , the operation result d ₀ of the combinational circuit 104 is stored in the register 108 as it is. In this case, in FIG. 1, a selector that can directly input the random value output from the random number generation unit 105 to the register 108 at the time of initialization may be provided between the EXOR circuit 107 and the register 108. As shown in the timing chart of FIG. 4, the reset signal of the register 108 is set to High instead of Low at the time of initialization, and the control signal 2 is set to Low at the timing t ₀ at the time of initialization. since random number 105 generated is input to the EXOR circuit 107 via the selector 106, depending on the output value of the combinational circuit 104 at that time, any random numbers output from the EXOR circuit 107 at timing _{t 0} is the register 108 Will be held. In the case of this modification, as shown in the timing chart of FIG. 4, there is no need for unmasking when reading from the register 108 at the timing t ₂ , which is different from the case of FIG. 2 of the first embodiment. , the control signal 3 at the timing _{t 2} is left in the High.

  Even in the case of this modification, as shown in FIG. 5, the value of the register 108 holds a random value before the initial round, so the Hamming distance cannot be calculated.

  Thereafter, the processing related to the final round of the encryption operation of each block data is the same as that of the first embodiment.

(Second Embodiment)
Next, a cryptographic operation circuit device 200 according to the second embodiment will be described. FIG. 6 shows a configuration example of the cryptographic operation circuit device 200. The cryptographic operation circuit device 200 shown in FIG. 6 corresponds to a block cryptographic algorithm typified by AES, similar to the cryptographic operation circuit device 900 described in the prior art and the cryptographic operation circuit device 100 according to the first embodiment. It is configured to perform one round process with one clock. 6 includes the agitation unit 201 and the control unit 250 without including the portion corresponding to the key scheduling unit 902 in FIG. 10, and the sub key is input from the outside. However, the same block as the key scheduling unit 902 may be included in the cryptographic operation circuit device 200.

  Hereinafter, the cryptographic operation circuit device 200 according to the second embodiment will be described in detail with reference to FIG. In FIG. 6, the agitation unit 201 includes a selector 203 that selects plain text (or cipher text) input from the outside or data after round processing, a combinational circuit 204 that performs round processing with a predetermined processing function, and a random number generation unit. 205, EXOR for obtaining exclusive OR of selector 206 for selecting random number data output from random number generation unit 205 or All = 0 (all 0 data), output data of selector 206 and output data of combinational circuit 204 A circuit 207 (first exclusive OR operation unit), a register 208 that temporarily holds output data of the EXOR circuit 207, and random number data output from the random number generation unit 205 or All = 0 (all 0 data). The selector 209 for selecting, and the exclusive OR of the output data of the register 208 and the output data of the selector 209 is obtained. EXOR circuit 210 (second exclusive OR operation unit), selector 211 that selects output data of EXOR circuit 210 or plaintext (or ciphertext) input from the outside, and a combination that performs round processing with a predetermined processing function The circuit 212, the selector 213 for selecting the random number data output by the random number generation unit 205 or All = 0 (all 0 data), and the exclusive OR of the output data of the selector 213 and the output data of the combinational circuit 212 are obtained. EXOR circuit 214 (first exclusive OR operation unit), register 215 that temporarily holds output data of EXOR circuit 214, random number data output by random number generation unit 205 or All = 0 (all zero data) ) To select the exclusive logic of the output data of the register 215 and the output data of the selector 216 EXOR circuit 217 (second exclusive OR operation unit) for obtaining the value, selector 218 for selecting the output data of EXOR circuit 217 or the output data of EXOR circuit 210, the output data of selector 218 or All = 0 (all 0) And a selector 219 that outputs ciphertext (or plaintext) to the outside.

  In addition, the control unit 250 supplies a reset signal to the register 208 and the register 215, supplies a clock to the random number generation unit 205, the register 208, and the register 215, the control signal 1 to the selector 203, the control signal 2 to the selector 211, and the selector 206. The control signal 3, the control signal 4 to the selector 209, the control signal 5 to the selector 213, the control signal 6 to the selector 216, the control signal 7 to the selector 218, and the control signal 8 to the selector 219, respectively. To control.

  Here, the control signal 1 is a control signal for selecting a plaintext (or ciphertext) input from the outside as an input of the processing function or a result of the basic processing function 2 held in the register 215. The control signal 2 is a control signal for selecting a plaintext (or ciphertext) input from the outside or a result of the basic processing function 1 held in the register 208. That is, the control signal 1 and the control signal 2 are control signals for switching the input to the combinational circuit 204 (basic processing function 1) or the combinational circuit 212 (basic processing function 2).

  The control signal 3 is a control signal for selecting whether to perform masking with a random number when storing the result of the processing function in the register 208 or to store in the register 208 without masking. The control signal 4 is a control signal for selecting whether to perform unmasking with the random number used for masking when reading the value stored in the register 208 or to read without performing unmasking. That is, the control signal 3 and the control signal 4 are control signals for controlling the presence / absence of masking and unmasking in the operation of writing and reading the operation result of the combination circuit 204 (basic processing function 1) to the register 208.

  The control signal 5 is a control signal for selecting whether to perform masking with a random number when storing the result of the processing function in the register 215 or to store in the register 215 without masking. The control signal 6 is a control signal for selecting whether to perform unmasking with a random number used for masking when reading a value stored in the register 215 or to read without performing unmasking. That is, the control signal 5 and the control signal 6 are control signals for controlling the presence / absence of masking and unmasking in the write and read operations of the operation result of the combinational circuit 212 (basic processing function 2) to the register 215.

  The control signal 7 is a control signal for selecting the operation result of the combinational circuit 212 (basic processing function 2) held in the register 215 or the operation result of the combinational circuit 204 (basic processing function 1) held in the register 208. The control signal 8 is a control signal for selecting whether or not to output the final calculation result to the outside.

  The cryptographic operation circuit device 200 according to the present embodiment is an application example of the first embodiment described with reference to FIG. 1, and parallel data divided into first-half data and second-half data in order to improve throughput in the block cipher algorithm. It is a two-stage pipeline configuration that processes the above simultaneously. In particular, the CPA attack can be prevented only by performing the process of masking only the first half data in the initial round and the final round.

  In FIG. 6, the first stage circuit of the two-stage pipeline configuration includes a selector 203, a combination circuit 204, a random number generation unit 205, a selector 206, an EXOR circuit 207, a register 208, a selector 209, and an EXOR circuit 210. This corresponds to the circuit from the selector 103, the combinational circuit 104, the random number generation unit 105, the selector 106, the EXOR circuit 107, the register 108, the selector 109, and the EXOR circuit 110 in FIG. Similarly, a second-stage circuit having a two-stage pipeline configuration includes a selector 211, a combinational circuit 212, a random number generation unit 205, a selector 213, an EXOR circuit 214, a register 215, a selector 216, and an EXOR circuit 217. This corresponds to a circuit including one selector 103, combination circuit 104, random number generation unit 105, selector 106, EXOR circuit 107, register 108, selector 109, and EXOR circuit 110. However, in this embodiment, the calculation result fed back to the selector 203 of the first-stage circuit is the calculation result processed by the combinational circuit 212 of the second-stage circuit, and conversely, the selector 211 of the second-stage circuit. The calculation result fed back to is the calculation result processed by the combinational circuit 204 of the first-stage circuit. Then, an operation result processed by the combination circuit 204 of the first-stage circuit or an operation result processed by the combination circuit 212 of the second-stage circuit by the selector 218 before being finally output from the selector 219 to the outside. Is supposed to be selected.

  Next, the operation of the cryptographic operation circuit device 200 of FIG. 6 will be described in detail with reference to the timing chart of FIG. 7 shows a reset signal, a clock, a control signal 1, a control signal 2, a control signal 3, a control signal 4, a control signal 5, a control signal 6, and a control signal 7 output from the control unit 250. 5 is a timing chart depicting the relationship among the processing timings of the control signal 8, the register 208, and the register 215. In FIG. 7, (n + 1) rounds from the initial round to the final round are regarded as one block operation, and the ciphertext (or plaintext) of the processing result is output to the outside for each block operation. Further, the basic processing functions by the combinational circuit 204 and the combinational circuit 212 in FIG. 6 are executed every one clock cycle, and the register 208 and the register 215 hold input data in one clock cycle. Note that the initial values of the register 208 and the register 215 are initialized to a predetermined value (for example, all 0) when the reset signal becomes Low.

7, notation _{t 2n + 3} from the timing _{t 0} indicates the timing position for each clock cycle, _{d n} from _{d 0} indicates the output data function processes the first half of the data in the combination circuit 204, or a combination circuit 212, d ' ₀ to d ′ _n indicate output data obtained by performing function processing on the latter half data in the combinational circuit 204 or the combinational circuit 212. R, r ′, and r ″ indicate random numbers generated by the random number generation unit 105 at an update frequency for each block calculation cycle, and the random numbers r, r ′, and r ″ indicate different random values. ing. Further, (+) represents an exclusive OR operator, for example, d ₀ (+) r is an exclusive OR operation value of d ₀ and r.

  As in the first embodiment, in FIG. 6, the clock is input from the control unit 250 to the random number generation unit 205, but in the flowchart of FIG. 7, the random number generation unit 205 generates a new random number every final round. Will be described as being generated.

In FIG. 7, first, the reset is controlled to Low before timing t ₀ , so that the register 208 and the register 215 are initialized to All = 0. After timing _{t 0,} the reset is canceled under the control of the High.

At the next timing t ₁ , since the control signal 1 and the control signal 3 are controlled to be Low, the operation result d ₀ in which the plaintext (or ciphertext) of the first half data input from the outside is subjected to the initial round processing by the combinational circuit 204. And the 128-bit random number data r generated by the random number generation unit 205 is masked by the EXOR circuit 207, and the calculation result (d ₀ (+) r) is stored in the register 208. (Initial round processing of the first half block).

At the next timing t ₂ , the control signal 3 is controlled to be high and the control signal 4 is controlled to be low, and the data (d ₀ (+) r) held in the register 208 and the random number data r ( The exclusive OR operation with the random number data used by the EXOR circuit 207 at the previous timing t ₁ is performed by the EXOR circuit 210 to unmask (unmask) the operation result d ₀ to the selector 211. Output. Here, since the control signal 2 is held high, the calculation result d ₀ enters the combinational circuit 212 via the selector 211 and is processed by the basic processing function 2. Further, since the control signal 5 of the selector 213 is High, the calculation result d ₁ is stored in the register 215 bypassing the EXOR circuit 214 as it is. On the other hand, since the control signal 1 of the selector 203 remains Low, the operation result d ′ ₀ obtained by performing the initial round processing on the plaintext (or ciphertext) of the second half data input from the outside is the control signal of the selector 206. Since 3 is High, the EXOR circuit 207 is bypassed and stored in the register 208 (initial round processing of the second half block).

As a result, at timing t ₂ , the calculation result d ′ ₀ of the initial round of the second half data is stored in the register 208, and the calculation result d ₁ of the first round of the first half data is stored in the register 215.

At the next timing t ₃ , since the control signal 4 is controlled to be High, the EXOR circuit 210 is equivalent to being bypassed as described above, and the operation result d ′ ₀ stored in the register 208 is converted into the EXOR circuit. The signal 210 is bypassed and output to the selector 211. Further, since the control signal 2 of the selector 211 remains High, the calculation result d ′ ₀ is input to the combinational circuit 212 and is processed, and the first round calculation result d ′ ₁ of the latter half data is output to the EXOR circuit 214. . At this time, the control signal 5 of the selector 213 is so remains High, the operation result d _'1 is as calculation result d of the first round of the second half data in the register 215 by bypassing the EXOR circuit 214' ₁ are stored. On the other hand, since the control signal 6 of the selector 216 remains High, the previous calculation result d ₁ held in the register 215 bypasses the EXOR circuit 217 as it is, and the control circuit 1 passes through the selector 203 whose High is the combination circuit 204. And the combinational circuit 204 performs arithmetic processing. Calculation result _{d 2} of the second round of the first half data, control signals 3 of the selector 206 because remains High, is directly stored in bypassing the EXOR circuit 207 register 208.

As a result, at the timing t ₃ , the calculation result d ₂ of the first round of the first half data is stored in the register 208, and the calculation result d ′ ₁ of the first round of the second half data is stored in the register 215.

About From the next timing _{t 4} to time _{t n,} since the control signal 8 is controlled in the same state all High from the control signal 1, the combination circuit 204 and the register 208 the operation result is alternating combination circuit 212 register 215 The operation stored in is repeatedly performed. That is, the round processing of the second half data is performed in parallel with a delay of one clock cycle from the round processing of the first half data. Depending on whether the number of repetitions is an odd number or an even number, the operation result of the final round process is stored in either the register 208 or the register 215, but the basic operation is similarly performed.

At timing t _{n + 1} for processing the final round of the first half data of the first block, the control signal 3 of the selector 206 is controlled to Low, and a combination circuit 204 (n-1) th round treated calculation result d _n The exclusive OR operation with, for example, 128-bit random number data r ′ newly generated by the random number generation unit 105 is performed by the EXOR circuit 207 and masked, and the masked operation result (d _n (+) r ′) is obtained. Store in the register 208. On the other hand, since the control signal 4 of the selector 209 remains High, the previous calculation result d ′ _n−2 held in the register 208 bypasses the EXOR circuit 210 as it is, and the control signal 2 passes through the High selector 211. The result is output to the combinational circuit 212 and processed by the combinational circuit 212. The operation result d ′ _n−1 of the (n−1) -th round of the latter half data is stored in the register 215 by bypassing the EXOR circuit 214 as it is because the control signal 5 of the selector 213 remains High.

As a result, at timing t _{n + 1} , the register 208 stores (d _n (+) r ′) obtained by masking the n-th round operation result d ₂ of the first half data, and the register 215 stores the second (second) data (( n-1) Round operation result d' _n-1 is stored.

At the next timing t _{n + 2} , the control signal 4 of the selector 209 is controlled to low, so that the random number data r ′ generated by the random number generation unit 205 (the same random number data used by the EXOR circuit 207 at the previous timing t _{n + 1).} Data) is output to the EXOR circuit 210, and the EXOR circuit 210 performs an exclusive OR operation between the masked operation result (d _n (+) r ′) held in the register 208 and the random number data r ′. unmask reduction operation result _{d n} were unmasked reduction is output to the selector 211 and the selector 218. At this time, since the control signal 7 is controlled to High, the operation result _{d n} are input to the selector 219 via the selector 218, the control signal 8 of the selector 219 is also controlled to Low, via the selector 219 calculation result d _n of the final round of the first half data Te is output as the ciphertext (or plaintext). On the other hand, since the control signal 2 of the selector 211 is controlled to Low, the plaintext (or ciphertext) of the first half data of the next block is input to the combinational circuit 212 and subjected to arithmetic processing, and the arithmetic result d ₀ is obtained from the EXOR circuit 214. Is output. At this time, since the control signal 5 of the selector 213 is controlled to Low, the exclusive OR operation of the random number data r ′ generated by the random number generation unit 205 and the operation result d ₀ is performed by the EXOR circuit 214 to be masked. The masked calculation result (d ₀ (+) r ′) is stored in the register 215. The calculation result d ₀ does not mean the same value as the operation result d ₀ in the previous block operation, only represent the calculation result of the initial round of the first half data of each block operation.

On the other hand, since the control signal 6 of the selector 216 is controlled to be high, the operation result d ′ _n−1 held in the register 215 is directly bypassed the EXOR circuit 217 and enters the selector 203, and the control signal 1 is high. calculation result d _'n computed treated with a combination circuit 204 via the selector 203 is outputted to the EXOR circuit 207. At this time, since the control signal 3 of the selector 206 is controlled to High, the operation result d ′ _n of the last round of the latter half data is directly stored in the register 208 bypassing the EXOR circuit 207.

As a result, at timing t _{n + 2} , the operation result d ′ _n of the last round of the latter half data is stored in the register 208, and the operation result (d ₀ of the initial round of the next block of the masked first half data is stored in the register 215. (+) r ') is stored, the operation result d _n of the final round of the first half data of the previous block in parallel are output as cipher text to the outside (or plaintext).

At the next timing t _{n + 3} , since the control signal 4 of the selector 209 is controlled to be high, the EXOR circuit 210 is bypassed, and the operation result d ′ _n held in the register 208 is output to the selector 211 and the selector 218. At this time, since the control signal 7 is controlled to be high, the calculation result d ′ _n is input to the selector 219 via the selector 218, and the control signal 8 of the selector 219 is also controlled to be low. As a result, the operation result d ′ _n of the last round of the latter half data is output to the outside as ciphertext (or plaintext).

On the other hand, since the control signal 2 of the selector 211 remains controlled low, the plaintext (or ciphertext) of the second half data of the next block is input to the combinational circuit 212 and processed, and the calculation result d ′ ₀ is EXOR. It is output to the circuit 214. At this time, since the control signal 5 of the selector 213 is controlled to High, the EXOR circuit 214 is bypassed, and the operation result d ′ ₀ of the second half data of the next block is stored in the register 215. The calculation result d _'0 is the operation result d in the previous block operation' does not mean the same value as ₀ and only represent the calculation result of the initial round of the second half data of each block operation.

Further, since the control signal 6 of the selector 216 is controlled to be Low, the operation result (d ₀ (+) r ′) held in the register 215 and the random number data r ′ generated by the random number generation unit 205 are exclusive. unmask of performing a logical OR operation in the EXOR circuit 217, enters the calculation result _{d 0} is the selector 203 unmasking of the first half data control signal 1 is processing a combination circuit 204 via the selector 203 of the High The round operation result d ₁ is output to the EXOR circuit 207. At this time, the control signal 3 of the selector 206 because it is controlled to High, the operation result _{d 1} of the first round half data is directly stored in bypassing the EXOR circuit 207 register 208.

As a result, at timing t _{n + 3} , the register 208 stores the first round operation result d ₁ of the first block data of the next block, and the register 215 stores the operation result d ′ ₀ of the second block data of the next block. In parallel, the operation result d ′ _n of the final round of the latter half data of the previous block is output to the outside as ciphertext (or plaintext).

  Thereafter, the same operation is repeated to execute parallel processing. Note that the processing timings described above are all controlled by the control unit 250.

Here, timings t ₁ and t ₂ at which the function output values d ₀ and d ′ ₀ of the initial round are stored, and timings t _{n + 1} and t _{n + 2 at} which the function output values d _n and d ′ _{n of the} final round are stored Subject to CPA attack. Here, it is assumed that the attacker can obtain only the plaintexts d ₀ and d ′ ₀ and the ciphertexts d _n and d ′ _n . At timings t ₁ and t ₂ , the register 208 changes in the order of _0- > (d ₀ (+) r)-> d ′ _0- > d ₂ , but temporarily d ₀ , d ′ ₀ due to the effect of the random number r. Even if is known, the Hamming distance cannot be calculated at any clock timing. At timings t _{n + 1} and t _{n + 2} , the register 208 that holds the final operation result changes in the order of d ′ _n−2 −> (d _n (+) r ′) −> d ′ _n −> d ₁ . Again, due to the effect of the random number r ′, even if the ciphertexts d _n and d ′ _n are known, the Hamming distance cannot be calculated at any clock timing.

Even at timings t _{n + 2} , t _{n + 3} , and t _{n + 4} at which the register 215 performs processing on the next block, the Hamming distance cannot be calculated at any clock timing due to the effect of the random number r ′. Similarly, by masking only the initial round and the final round of the first half block operation processing (processing one clock cycle earlier) of the parallel data to be pipelined, the clock that becomes the CPA attack point at the minimum operation cost Calculation of register hamming at timing can be avoided. In this embodiment, as in the first embodiment, the random number generated by the random number generation unit 205 is a true random number or a pseudo-random number, and a new value is obtained for each operation of one block unit that is an encryption processing unit. Updated.

  In this embodiment, in order to make it impossible to calculate the amount of change from the initial state (for example, 0) of each register, masking is performed on the first half of the parallel data that is pipelined with a delay of one clock cycle. However, the latter half of the parallel data may be masked with a random number different from the first half.

  As described above, since the cryptographic operation circuit device 200 according to the present embodiment has a two-stage pipeline configuration, the throughput of the block encryption algorithm is improved as compared with the cryptographic operation circuit device 100 according to the first embodiment. In particular, it is possible to protect against the CPA attack at a minimum calculation cost for performing the process of masking only the first half data in the initial round and the final round.

(Third embodiment)
Next, a cryptographic operation circuit device 300 according to the third embodiment will be described. In the cryptographic operation circuit device 100 according to the first embodiment and the cryptographic operation circuit device 200 according to the second embodiment, an example in the case of application to a block encryption algorithm typified by AES has been shown. In the case of hardware implementation with a configuration in which a combinational circuit and a register are connected in series and cyclically processed for a cryptographic module that performs a power-residue operation and an elliptic scalar multiplication operation in FIG. The present invention can be applied similarly to the case of the block encryption algorithm. Hereinafter, in the present embodiment, an example in which the present invention is applied to the power-residue calculation and the elliptic scalar multiplication used in the calculation of such a public key encryption algorithm will be described.

  FIG. 8 is a configuration diagram of the cryptographic operation circuit device 300 according to the third embodiment. In FIG. 8, the cryptographic operation circuit device 300 includes a stirring unit 301, an exponent expansion unit 302, and a control unit 350. The basic configuration of the stirring unit 301 of the cryptographic operation circuit device 300 in FIG. 8 is the same as that of the stirring unit 101 in FIG. 1 shown in the first embodiment.

  In FIG. 8, the agitation unit 301 includes a combinational circuit 303 that performs predetermined function processing using plaintext (or ciphertext) input from the outside, data after round processing, and the output of the exponent expansion unit 302, and a random number generation unit 304, a selector 305 for selecting random number data output from the random number generation unit 304 or All = 0 (all 0 data), and EXOR for obtaining an exclusive OR of the output data of the selector 305 and the output data of the combinational circuit 303 A circuit 306 (first exclusive OR operation unit), a register 307 that temporarily holds output data of the EXOR circuit 306, a register 308 that holds output data of the selector 305, and output data and registers of the register 308 EXOR circuit 309 (second exclusive OR operation unit) for obtaining an exclusive OR with the output data 307, EXO Composed of a selector 310 to be output to the outside by selecting the output data or All = 0 circuit 309 (all zero data). Here, the combinational circuit 303 shown in FIG. 8 of the present embodiment is configured by a circuit that performs a power-residue operation or an elliptic scalar multiplication operation based on the output value of the exponent expansion unit 302. The power-residue calculation or the elliptic scalar multiplication is a well-known calculation and is the same as that in FIG.

  The control unit 350 provides a reset signal to the register 307 and the register 308, supplies a clock to the register 307, the register 308, and the random number generation unit 304, and outputs a control signal 1 to the selector 305 and a control signal 2 to the selector 310, respectively. Then, the processing timing of the stirring unit 301 is controlled. Here, the control signal 1 of the selector 305 is a control signal for selecting whether to perform masking with a random number when storing the result of the processing function in the register 307 or to store in the register 307 without masking. Since it is output via the register 308, it is also a control signal for selecting whether or not unmasking is performed when data stored in the register 308 is read at a timing delayed by one clock cycle. The control signal 2 is a control signal for selecting whether or not to output the final calculation result to the outside.

  In this embodiment, an exponent is binary-expanded and a power-residue operation or an elliptic scalar multiplication operation is executed from the most significant bit by the left binary method. An example of processing with a clock is assumed. In addition, the calculation result for the exponent 1 bit calculated by the combinational circuit 303 is stored in the register 307 as a calculation intermediate value, and the final result obtained by repeating the calculation for the length of the expanded bit length is output to the outside.

Next, the operation of the cryptographic operation circuit device 300 of FIG. 8 will be described in detail with reference to the timing chart of FIG. FIG. 9 is a timing chart illustrating the relationship between the reset signal output from the control unit 350, the clock, the control signal 1, the control signal 2, the control signal 3, the register 307, and the register 308. is there. In FIG. 9, (n + 1) rounds from the initial round to the final round are defined as one block operation, and the ciphertext (or plaintext) as a processing result is output to the outside for each block operation. Further, the processing function by the combinational circuit 303 in FIG. 8 is executed every clock cycle, and the register 307 and the register 308 hold input data in one clock cycle. Note that the initial values of the registers 307 and 308 are initialized to predetermined values (for example, all 0) when the reset signal becomes low. Note that the operation is not affected even if the reset signal is not input to the register 308, but in FIG. 8, the register 308 reset signal is input and initialized to All = 0 in order to clarify the initial value at the time of reset. . In FIG. 9, the notations from timing t ₀ to t _{n + 1} indicate timing positions for each clock cycle, and dn ₋₁ to d ₀ indicate output data for each round of the processing function by the combinational circuit 303. For example d _n-1 is a result of the value of the initial round processing function, d _n-2 is the resulting value of the first round processing function, d ₀ indicates the results of the value of the final round processing functions, respectively. R _n−1 to r ₀ indicate random numbers generated by the random number generation unit 105 at an update frequency for each clock cycle. Further, (+) represents an exclusive OR operator. For example, d _n−1 (+) r _n−1 is an exclusive OR operation value of d _n−1 and r _n−1 .

In FIG. 9, first, at the timing t ₀ , the reset is controlled to be Low, so that the registers 307 and 308 are initialized to All = 0. Since the control signal 2 of the selector 310 is High, All = 0 is output to the outside. Note that after the timing t0, the reset is released under the control of High.

At the next timing t ₁ , since the control signal 1 is controlled to be Low, the random number data rn ₋₁ generated by the random number generation unit 304 is input to the EXOR circuit 306, and the result of the initial round processing performed by the combinational circuit 303 Masking is performed by performing an exclusive OR operation with d _n−1, and the masked operation result (d _n−1 (+) r _n−1 ) is stored in the register 307. On the other hand, the register 308 stores the random number data rn ₋₁ generated by the random number generation unit 304.

As a result, at timing t ₁ , the masked calculation result (d _n−1 (+) r _n−1 ) is stored in the register 307, and the random number data r _n−1 is stored in the register 308.

At the next timing t ₂ , the exclusive OR of the masked operation result (d _n−1 (+) r _n−1 ) stored in the register 307 and the random number data r _n−1 stored in the register 308 is obtained. unmask reduction performed by the EXOR circuit 309 performs an operation, the operation result _{d n-1} obtained by unmasking of is fed back to the selector 310 and the combination circuit 303. Since the control signal 2 of the selector 310 remains High, it is not output to the outside. The calculation result dn ₋₁ fed back to the combinational circuit 303 is subjected to the first round of function processing in the combinational circuit 303, and the calculation result dn ₋₂ is stored in the register 307. On the other hand, since the control signal 1 of the selector 305 at this time is controlled to High, All = 0 is stored in the register 308.

As a result, at the timing t ₂ , the first round operation result dn ₋₂ is stored in the register 307, and 0 is stored in the register 308.

At the next timing t ₃ , since 0 is stored in the register 308, the EXOR circuit 309 is bypassed, and the first round operation result dn ₋₂ stored in the register 307 is fed back to the combinational circuit 303 as it is. Then, the second round of function processing is performed, and the calculation result dn _-3 is output to the EXOR circuit 306. At this time, since the control signal 1 of the selector 305 is controlled to Low, the random number data _{r n-3} to the random number generating unit 304 has generated is input to the EXOR circuit 306, a second round of calculation results of the combinational circuit 303 _{d n -3} and an exclusive OR operation for masking, and the masked operation result (d _n-3 (+) r _n-3 ) is stored in the register 307. On the other hand, the register 308 stores the random number data rn _-3 generated by the random number generation unit 304.

As a result, at timing t ₃ , the masked calculation result (d _n−3 (+) r _n−3 ) is stored in the register 307, and random number data r _n−3 is stored in the register 308.

Thereafter, the same processing from the timing t ₁ to timing t _n is repeated.

At timing t _{n + 1} of the final round, an exclusive OR operation is performed on the masked operation result (d ₀ (+) r ₀ ) stored in the register 307 and the random number data r ₀ stored in the register 308 to perform EXOR. Unmasking is performed by the circuit 309, and the unmasked operation result d ₀ is fed back to the selector 310 and the combinational circuit 303. At this time, since the control signal 2 of the selector 310 is controlled to Low, the final round operation result d ₀ is output to the outside as ciphertext (or plaintext) via the selector 310.

Here, as shown in FIG. 9, masking with random numbers is performed once every two clocks. That is, when storing the operation result in the register 307, the random number and the random number are processed at a frequency of once for processing of the exponent 2 bits developed by the combinational circuit 303 (that is, at a frequency of once for processing of two clocks). A value obtained by performing the exclusive OR operation is stored in the register 307. Then, to continue the same operation until the processing for the least significant bit d ₀ completes a series of cryptographic operations are controlled by the control unit 350 so that it can obtain an operation result at the timing of t n _{+ 1.} In this series of operations, the value of the register 307 is (dn _-1 (+) rn _-1 )-> dn _-2- > (dn _-3 (+) rn _-3 )-> _{dn-. 4 -> ····· (d 2 (} +) r 2) -> d 1 -> (d 0 (+) r 0) , and the tentatively obtain the value (i is an integer from 0 to n) of _{d i} Even if it is possible, the Hamming distance becomes (d _i (+) d _i−1 (+) r _i ) due to the effect of the random number r _i at any clock timing. It can be avoided.

  Note that the random number used for masking is a true random number or a pseudo-random number, and is updated to a new value every operation of 1 bit of at least 2 expansion indices. In the present embodiment, the case where n is an odd number is shown. Alternatively, a new random number may be updated every bit of the expansion index, and a value obtained by performing an exclusive OR operation between the random number value and the calculation result every clock may be stored in the register every clock.

  As described above, in the cryptographic operation circuit device 300 according to the present embodiment, the stored value of the register 307 is masked with a different random number each time, so that it is possible to calculate the Hamming distance of the register intermediate value in the processing for each expanded exponent bit. Can not. As a result, it is possible to prevent CPA attacks against the power-residue calculation and the elliptic scalar multiplication.

  As described above, in the cryptographic operation circuit device 100 according to the first embodiment and the cryptographic operation circuit device 200 according to the second embodiment, the example is applied to the block encryption algorithm represented by AES, and the basic processing function is changed. Therefore, the back-calculation of the Hamming distance related to the register values before and after the initial round operation and before and after the final round operation can be prevented with a small processing amount and overhead. In addition, the cryptographic operation circuit device 300 according to the third embodiment shows an example of application to a public key encryption algorithm, and even in this case, without changing the basic processing function, exponentiation-expanded residue calculation or The back-calculation of the Hamming distance accompanying the clock transition of the register value holding the calculation result of the processing function in the elliptic scalar multiplication can be prevented with a small processing amount and overhead.

  Although the embodiments of the cryptographic operation circuit device according to the present invention have been described above, the present invention can be implemented in various other forms without departing from the spirit or main features thereof. Therefore, the above-described embodiment is merely an example in all respects and should not be interpreted in a limited manner. The present invention is shown by the scope of claims, and the present invention is not limited to the text of the specification. Furthermore, all modifications and changes belonging to the scope of the claims are within the scope of the present invention.

1, 2, 3, 4, 11, 12, 13, 14, 15, 16, 17, 18, 21, 22, a, b, c, d... Control signals 100, 200, 300, 900, 960,. ..Cryptographic operation circuit devices 101, 201, 301, 901, 961... Stirring units 103, 106, 109, 111, 203, 206, 209, 211, 213, 216, 218, 219, 903, 906, 907, 965... Selectors 104, 204, 212, 303, 904, 909, 963... Combinational circuits 105, 205, 304 ... random number generators 108, 208, 215, 307, 308, 905, 908, 964. ..Registers 150, 250, 350, 950, 970 ... Control units 107, 110, 207, 210, 214, 217, 306, 309 ... EXOR times 302,962 ... exponential expansion section 902 ... key scheduling unit

Claims (8)

An input selection unit that selects external input data for the first time of a processing unit configured by a predetermined number of repetition processes, and selects internal input data for subsequent processing;
A function processing unit that performs predetermined function processing on the data selected by the input selection unit to generate output data;
A random number generator for generating random data having a bit width equal to the output data of the function processor;
A first exclusive OR operation unit for obtaining an exclusive OR of the output data of the function processing unit and the random number data generated by the random number generation unit;
A data holding unit for holding a calculation result of the first exclusive OR calculation unit;
A second exclusive OR operation unit that obtains an exclusive OR of the output data of the data holding unit and the random number data generated by the random number generation unit and sets the internal input data;
The processing timing of each unit for each processing unit is controlled, and the second exclusive OR operation unit after executing a series of processes from the input selection unit to the second exclusive OR operation unit a predetermined number of times. A cryptographic operation circuit device comprising: a control unit that controls processing timing for outputting a calculation result to the outside as cryptographic data. The cryptographic operation circuit device according to claim 1,
The control unit executes the process of the second exclusive OR operation unit at a processing timing subsequent to the processing timing of holding the operation result of the first exclusive OR operation unit in the data holding unit. A cryptographic operation circuit device. The cryptographic operation circuit device according to claim 2,
The cryptographic operation circuit device, wherein the control unit executes a process of holding the random number data generated by the random number generation unit in the data holding unit in the initialization step of the series of processes. The cryptographic operation circuit device according to claim 2,
In the initial processing step of the series of processes, the control unit performs the second exclusive timing at a processing timing subsequent to a processing timing for holding the calculation result of the first exclusive OR calculation unit in the data holding unit. A cryptographic operation circuit device that executes processing of an OR operation unit. The cryptographic operation circuit device according to claim 2,
In the final processing step of the series of processes, the control unit performs the second exclusive timing at a processing timing subsequent to a processing timing for holding the calculation result of the first exclusive OR calculation unit in the data holding unit. A cryptographic operation circuit device that executes processing of an OR operation unit. In the cryptographic operation circuit device according to any one of claims 1 to 5,
The cryptographic operation circuit device, wherein the random number generated by the random number generation unit is a pseudo-random number or a true random number that is updated at least for each processing unit. An input selection unit that selects external input data for the first time of a processing unit configured by a predetermined number of repetition processes, and selects internal input data for subsequent processing;
A function processing unit that performs predetermined function processing on the data selected by the input selection unit to generate output data;
A random number generator for generating random data having a bit width equal to the output data of the function processor;
A first exclusive OR operation unit for obtaining an exclusive OR of the output data of the function processing unit and the random number data generated by the random number generation unit;
A data holding unit for holding a calculation result of the first exclusive OR calculation unit or output data of the function processing unit;
A second exclusive OR operation unit for obtaining an exclusive OR of the output data of the data holding unit and the random number data generated by the random number generation unit;
The processing timing of each unit for each processing unit is controlled, and in the first processing unit, the operations of the first exclusive OR operation unit and the second exclusive OR operation unit are executed, and the second and subsequent processing In units, the operations of the first exclusive OR operation unit and the second exclusive OR operation unit are alternately executed for each process, and from the input selection unit to the second exclusive OR operation unit. A control unit for controlling the processing timing of outputting the operation result of the second exclusive OR operation unit or the output data of the data holding unit as encrypted data to the outside after a predetermined number of executions of the series of processes as the processing unit A cryptographic operation circuit device comprising: The cryptographic operation circuit device according to claim 7,
The cryptographic operation circuit device, wherein the random number generated by the random number generation unit is a pseudo random number or a true random number that is updated at a frequency of at least once every two processing units.

Images