ABSTRACT
Abstract
A block cipher encryption device for encrypting a data unit plaintext into blocks of ciphertexts, the data unit plaintext being assigned a tweak value and being divided into one or more plaintext blocks. The block cipher encryption device comprises: a combinatorial function unit associated with each plaintext block, the combinatorial function unit being configured to determine a tweak block value by applying a combinatorial function between a value derived from the tweak value and a function of a block index assigned to the plaintext block, a first masking unit in association with each plaintext block, the first masking unit being configured to determine a masked value by applying a data masking algorithm to the tweak block value determined by the combinatorial function unit associated with the plaintext block.
Description
CROSS-REFERENCE TO RELATED APPLICATIONS
This application is a National Stage of International patent application PCT/EP2019/064613, filed on Jun. 5, 2019, which claims priority to foreign European patent application No. EP 18305754.6, filed on Jun. 18, 2018, the disclosures of which are incorporated by reference in their entirety.
TECHNICAL FIELD
The invention generally relates to encryption/decryption of data stored in sector-addressable storage devices and in particular to tweakable block cipher-based encryption/decryption.
BACKGROUND
Cryptographic systems provide data protection solutions that ensure confidentiality, security, authentication, integrity, and privacy of digital data during its storage in insecure memories and/or transmission over insecure networks.
Embedded devices often carry sensitive information which is to be protected against attacks. To protect such sensitive information, encryption functions are used.
An encryption function is based on an algorithm that encrypts original data, or âplaintextâ, using one or more encryption keys. The encryption process results in ciphered data, or âciphertextâ, which can be viewed in its original form only if it is decrypted with the correct key(s).
Encryption algorithms include symmetric and asymmetric algorithms. Symmetric encryption algorithms use the same secret key for encrypting and decrypting data. Exemplary symmetric encryption algorithms comprise the DES and AES algorithms. Asymmetric encryption algorithms use two different keys comprising one public key and one private key. The public key may be shared with different users, but the private key must be kept secret so has to be protected. Exemplary asymmetric encryption algorithms comprise the RSA algorithm.
Data encryption may be a bit-wise encryption or a block-wise encryption. A bit-wise encryption consists in encrypting bits comprised in a plaintext one-by-one. A block-wise encryption consists in dividing plaintext into blocks of bits, where the bits comprised in each block are encrypted concurrently. Exemplary bit-wise encryption algorithms comprise stream ciphers where the plaintext bits are encrypted once at a time, each plaintext bit being combined with a pseudorandom cipher bit stream. Exemplary block-wise encryption algorithms comprise block ciphers that operate on fixed-length blocks of bits, each block having a fixed cipher block length.
Disk encryption is a particular case of data encryption which is implemented to protect data stored in sector-addressable embedded or external storage devices such as hard disks, solid-state drive and tape data storage. Disk encryption ensures confidentiality of stored data by preventing unauthorized access to data storage devices. Disk encryption may be implemented at the hardware and/or the software level.
Disk encryption solutions generally aim at ensuring confidentiality of the data stored on a disk, providing a fast retrieval and storage of data independently on the location where the data is stored on the disk, and providing space-saving encryption such that the amount of storage space used for encrypted data is not larger than the size of original data.
In order to meet these properties (data confidentiality, fast retrieval and storage of data, and space-saving encryption), disk encryption relies on dividing the disk space into several sectors which are encrypted and decrypted independently using block-ciphers.
A disk sector (also referred to as âa sectorâ or a âdata unitâ) represents the minimum storage unit of the storage disk/device and constitutes a fixed amount (usually 2 n , n being a natural number, e.g. 512 bytes, 2048 bytes, or 4096 bytes) of user-accessible data. To each sector of the disk is assigned a sector address (also referred to as a âsector numberâ) representing the storage location of the sector within the disk. Each sector is divided into several blocks (also referred to as âdata blocksâ), each block being assigned a block index indicating the position of the block within the sector.
As block ciphers are limited to plaintext blocks of a certain cipher block length, block ciphers-based disk encryption uses modes of operations. Modes of operation are rules that enable the expansion of the encryption block size to cover the whole data in the disk sectors and define how to repeatedly apply a block cipher's single block encryption operation to encrypt data of a larger length.
Existing block-ciphers modes of operation comprise non-tweakable modes of operation and tweakable modes of operation. Tweakable modes of operation provide a different processing to each two different sectors.
Exemplary non-tweakable modes of operation comprise the Electronic Codebook mode (ECB), the Cipher Block Chaining mode (CBC), the Propagating Cipher Block Chaining mode (PCBC), the Cipher Feedback mode (CFB), the Output Feedback mode (OFB), and the Counter mode (CTR).
FIG. 1 is a block diagram illustrating the structure of a conventional encryption device implementing the ECB mode of operation. According to such ECB mode of operation, the original plaintext is divided into m+1 plaintext blocks. Each plaintext block P is encrypted separately using a block cipher encryption unit 11 - j that uses a key and implements a block cipher to generate a ciphertext block in association with each plaintext block.
FIG. 2 is a block diagram illustrating the structure of a conventional encryption device implementing the CBC mode of operation. According to the CBC mode of operation, each plaintext block P is XORed, before being encrypted by a block cipher encryption unit 21 - j , with the ciphertext block generated by encrypting the previous plaintext block P j-1 in the chain. The first plaintext block P 0 is XORed with an initialization vector, a random or a pseudorandom fixed-size input variable required to be unique and unpredictable at encryption time.
FIG. 3 is a block diagram illustrating the structure of a conventional encryption device implementing the CFB mode of operation. According to the CFB mode of operation, each ciphertext block C j is generated as the output of the exclusive OR (XOR) operation applied to:
the plaintext block P j associated with this ciphertext block, and to the result of the encryption, by the block cipher encryption unit 31 - j , of the ciphertext block generated in association with the previous plaintext block P j-1 in the chain.
The first ciphertext block is generated as the output of the XOR operation applied to the plaintext block associated with this ciphertext block and to the result of the encryption of an initialization vector.
FIG. 4 is a block diagram illustrating the structure of a conventional encryption device implementing the OFB mode of operation. According to the OFB mode, each ciphertext block C j is generated as the output of the XOR operation applied to:
the plaintext block P j associated with this ciphertext block, and to the result of the encryption, by the block cipher encryption unit 41 - j , of an intermediate ciphertext generated by the previous block cipher encryption unit 41 - j in the chain.
The first ciphertext block is generated as the output of the XOR operation applied to the first plaintext block associated with this first ciphertext block and to the result of the encryption of an initialization vector.
In addition to the plaintext and the encryption key, tweakable modes of operation take as input a tweak value that plays the same role as the initialization vectors (for example in the CBC mode of operation). Exemplary tweakable modes of operation comprise:
the Liskov, Rivest, and Wagner (LRW) modes such as the Tweak Block Chaining (TBC) disclosed in âM. Liskov, R-L. Rivest, and D. Wagner, âTweakable Block Ciphersâ, CRYPTO 2002, LNCS, volume 2442, 2002â; the XOR-Encrypt-XOR (XEX) mode designed by Rogaway and published in âRogaway, âEfficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMACâ, Dept. of Computer Science, University of California, Davisâ, and the tweakable with ciphertext stealing (XTS) mode (also referred to as the âXTS-AES modeâ), standardized in 2007 as IEEE P1619 for the AES block cipher algorithm.
FIG. 5 is a block diagram illustrating the structure of a conventional encryption device implementing the TBC mode of operation. According to the TBC mode of operation, each plaintext block P j is encrypted into a ciphertext block C j , by a block cipher encryption unit 51 - j , that uses an encryption key and a tweak value during encryption. An initial tweak value T 0 is used for the encryption of the first plaintext block P 0 . The tweak value used for the encryption of each successive plaintext block corresponds to the ciphertext block generated by the previous block cipher encryption unit 51 -( j â1) in the chain.
The XEX and XTS modes of operation use a tweak value which corresponds to the sector address assigned to the data unit or sector containing data to be encrypted. The XEX mode of operation uses a same encryption key for tweak value encryption and plaintext block encryption. The XTS mode of operation uses two different encryption keys. A first encryption key (also referred to as a âtweak encryption keyâ) is used to encrypt the tweak value. A second encryption key (also referred to as âdata encryption keyâ) is used for plaintext blocks encryption.
The processing of each single plaintext block according to the XEX and XTS modes is similar and comprises two phases. The first phase aims at generating a tweak block by applying an encryption of the tweak value using a block cipher and the tweak encryption key followed by a combinatorial function (e.g. modular multiplication) over a finite field involving a primitive element over a given finite field and the block index associated with the processed plaintext block. The second phase aims at generating a ciphertext block in association with the processed plaintext block and consists of plaintext block encryption using a block cipher and the data encryption key, where the input and output of the block cipher encryption unit are XORed with the tweak block generated at the first phase. The repetition of the single plaintext block encryption to the remaining plaintext blocks in the chain is defined by the mode of operation.
FIG. 6 is a block diagram illustrating the structure of a conventional encryption device implementing the XEX mode of operation. Accordingly, the tweak encryption unit 61 generates an encrypted tweak value stored in a storage unit 63 - 0 (e.g. a register). Then, along the chain, successive combinatorial functions (e.g. modular multiplications) over a Galois field are performed by combinatorial function units 65 - j , each combinatorial function producing a tweak block T j stored in a storage unit 63 - j . The encryption device further comprises m+1 block cipher encryption units 67 - j for j=0, . . . , m, the j th block cipher encryption unit 67 - j being configured to determine a j th intermediate ciphertext block IC j by encrypting the output of the XOR operation applied to the j th plaintext block P j and the tweak block T j stored in the j th storage unit 63 - j . Then, the j th ciphertext block C j is determined by applying an XOR operation to the j th intermediate ciphertext block IC j and the tweak block T j stored in the j th storage unit 63 - j.
FIG. 7 is a block diagram illustrating the structure of a conventional encryption device implementing the XTS mode of operation. The XTS mode uses ciphertext stealing to provide support and encryption of data units/sectors with a size that is not divisible by the cipher block-length. In case units/sectors size is divisible by the cipher block length, ciphertext blocks are generated in a similar way as they are being generated by the XEX mode of operation except for tweak and data encryption keys being different. Accordingly, the data unit is divided into m+1 plaintext blocks among which the first m plaintext blocks P 0 , P 1 , . . . , P m-1 have the cipher block-length (for example 128 bits for the AES block-cipher), and the last plaintext block P m has a length lower or equal to the cipher block length (for example less than or equal to 128 bits for the AES block-cipher). The (mâ2) first ciphertext blocks are generated in a similar way as ciphertext blocks are generated in the XEX mode of operation. The m th ciphertext block C m is generated from the processing of the (mâ1) th plaintext block P m-1 . The determination of the (mâ1) th ciphertext block consists of two processing steps. At a first step, full-length plaintext block Pâ² m is generated by filling the original m th plaintext block P m with the last digits of the m th ciphertext block C m such that the plaintext block P m is of length equal to the cipher block-length. At a second step, a first XOR operation, a block cipher encryption, and a second XOR operation are applied to the determined full-length plaintext block Pâ² m and the tweak block stored in the m th storage unit to generate the (mâ1) th ciphertext block C m-1 .
Tweakable operation modes provide stronger data protection and security than non-tweakable modes. The use of the tweak blocks provides an additional security layer and adds a difficulty to malicious parties who plan to recover the tweak blocks and the data encryption key for recovering the original data stored on a protected device. However, recent studies revealed that tweakable modes of operation, in particular the AES-XTS mode, are prone to side-channel attacks. Some power side-channel attacks against the AES-XTS mode use the side-channel information leaked through the modular multiplications for recovering the tweak blocks, as disclosed in âC. Luo, Y. Fei, and A-A. Ding, âSide-Channel Power Analysis on XTS-AESâ, In Proceedings of the Design, Automation & Test in Europe Conference & Exhibition, 2017â. Such attacks show that in spite of using encrypted tweaks, the XTS-AES mode and in general tweakable modes of operation are still vulnerable to side-channel attacks.
There is accordingly a need for protecting tweakable modes of operation for block ciphers used for data encryption.
SUMMARY
In order to address these and other problems, there is provided a block cipher encryption device for encrypting a data unit plaintext into blocks of ciphertexts, the data unit plaintext being assigned a tweak value and being divided into one or more plaintext blocks. The block cipher encryption device comprises a combinatorial function unit associated with each plaintext block (P j ), the combinatorial function unit being configured to determine a tweak block value (T j ) by applying a combinatorial function between a value derived from the tweak value and a function of a block index assigned to the plaintext block. The block cipher encryption device further comprises, in association with each plaintext block (P j ), a first masking unit configured to determine a masked value M j (T j
CROSS-REFERENCE TO RELATED APPLICATIONS
This application is a National Stage of International patent application PCT/EP2019/064613, filed on Jun. 5, 2019, which claims priority to foreign European patent application No. EP 18305754.6, filed on Jun. 18, 2018, the disclosures of which are incorporated by reference in their entirety.
TECHNICAL FIELD
The invention generally relates to encryption/decryption of data stored in sector-addressable storage devices and in particular to tweakable block cipher-based encryption/decryption.
BACKGROUND
Cryptographic systems provide data protection solutions that ensure confidentiality, security, authentication, integrity, and privacy of digital data during its storage in insecure memories and/or transmission over insecure networks.
Embedded devices often carry sensitive information which is to be protected against attacks. To protect such sensitive information, encryption functions are used.
An encryption function is based on an algorithm that encrypts original data, or âplaintextâ, using one or more encryption keys. The encryption process results in ciphered data, or âciphertextâ, which can be viewed in its original form only if it is decrypted with the correct key(s).
Encryption algorithms include symmetric and asymmetric algorithms. Symmetric encryption algorithms use the same secret key for encrypting and decrypting data. Exemplary symmetric encryption algorithms comprise the DES and AES algorithms. Asymmetric encryption algorithms use two different keys comprising one public key and one private key. The public key may be shared with different users, but the private key must be kept secret so has to be protected. Exemplary asymmetric encryption algorithms comprise the RSA algorithm.
Data encryption may be a bit-wise encryption or a block-wise encryption. A bit-wise encryption consists in encrypting bits comprised in a plaintext one-by-one. A block-wise encryption consists in dividing plaintext into blocks of bits, where the bits comprised in each block are encrypted concurrently. Exemplary bit-wise encryption algorithms comprise stream ciphers where the plaintext bits are encrypted once at a time, each plaintext bit being combined with a pseudorandom cipher bit stream. Exemplary block-wise encryption algorithms comprise block ciphers that operate on fixed-length blocks of bits, each block having a fixed cipher block length.
Disk encryption is a particular case of data encryption which is implemented to protect data stored in sector-addressable embedded or external storage devices such as hard disks, solid-state drive and tape data storage. Disk encryption ensures confidentiality of stored data by preventing unauthorized access to data storage devices. Disk encryption may be implemented at the hardware and/or the software level.
Disk encryption solutions generally aim at ensuring confidentiality of the data stored on a disk, providing a fast retrieval and storage of data independently on the location where the data is stored on the disk, and providing space-saving encryption such that the amount of storage space used for encrypted data is not larger than the size of original data.
In order to meet these properties (data confidentiality, fast retrieval and storage of data, and space-saving encryption), disk encryption relies on dividing the disk space into several sectors which are encrypted and decrypted independently using block-ciphers.
A disk sector (also referred to as âa sectorâ or a âdata unitâ) represents the minimum storage unit of the storage disk/device and constitutes a fixed amount (usually 2 n , n being a natural number, e.g. 512 bytes, 2048 bytes, or 4096 bytes) of user-accessible data. To each sector of the disk is assigned a sector address (also referred to as a âsector numberâ) representing the storage location of the sector within the disk. Each sector is divided into several blocks (also referred to as âdata blocksâ), each block being assigned a block index indicating the position of the block within the sector.
As block ciphers are limited to plaintext blocks of a certain cipher block length, block ciphers-based disk encryption uses modes of operations. Modes of operation are rules that enable the expansion of the encryption block size to cover the whole data in the disk sectors and define how to repeatedly apply a block cipher's single block encryption operation to encrypt data of a larger length.
Existing block-ciphers modes of operation comprise non-tweakable modes of operation and tweakable modes of operation. Tweakable modes of operation provide a different processing to each two different sectors.
Exemplary non-tweakable modes of operation comprise the Electronic Codebook mode (ECB), the Cipher Block Chaining mode (CBC), the Propagating Cipher Block Chaining mode (PCBC), the Cipher Feedback mode (CFB), the Output Feedback mode (OFB), and the Counter mode (CTR).
FIG. 1 is a block diagram illustrating the structure of a conventional encryption device implementing the ECB mode of operation. According to such ECB mode of operation, the original plaintext is divided into m+1 plaintext blocks. Each plaintext block P is encrypted separately using a block cipher encryption unit 11 - j that uses a key and implements a block cipher to generate a ciphertext block in association with each plaintext block.
FIG. 2 is a block diagram illustrating the structure of a conventional encryption device implementing the CBC mode of operation. According to the CBC mode of operation, each plaintext block P is XORed, before being encrypted by a block cipher encryption unit 21 - j , with the ciphertext block generated by encrypting the previous plaintext block P j-1 in the chain. The first plaintext block P 0 is XORed with an initialization vector, a random or a pseudorandom fixed-size input variable required to be unique and unpredictable at encryption time.
FIG. 3 is a block diagram illustrating the structure of a conventional encryption device implementing the CFB mode of operation. According to the CFB mode of operation, each ciphertext block C j is generated as the output of the exclusive OR (XOR) operation applied to:
the plaintext block P j associated with this ciphertext block, and to the result of the encryption, by the block cipher encryption unit 31 - j , of the ciphertext block generated in association with the previous plaintext block P j-1 in the chain.
The first ciphertext block is generated as the output of the XOR operation applied to the plaintext block associated with this ciphertext block and to the result of the encryption of an initialization vector.
FIG. 4 is a block diagram illustrating the structure of a conventional encryption device implementing the OFB mode of operation. According to the OFB mode, each ciphertext block C j is generated as the output of the XOR operation applied to:
the plaintext block P j associated with this ciphertext block, and to the result of the encryption, by the block cipher encryption unit 41 - j , of an intermediate ciphertext generated by the previous block cipher encryption unit 41 - j in the chain.
The first ciphertext block is generated as the output of the XOR operation applied to the first plaintext block associated with this first ciphertext block and to the result of the encryption of an initialization vector.
In addition to the plaintext and the encryption key, tweakable modes of operation take as input a tweak value that plays the same role as the initialization vectors (for example in the CBC mode of operation). Exemplary tweakable modes of operation comprise:
the Liskov, Rivest, and Wagner (LRW) modes such as the Tweak Block Chaining (TBC) disclosed in âM. Liskov, R-L. Rivest, and D. Wagner, âTweakable Block Ciphersâ, CRYPTO 2002, LNCS, volume 2442, 2002â; the XOR-Encrypt-XOR (XEX) mode designed by Rogaway and published in âRogaway, âEfficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMACâ, Dept. of Computer Science, University of California, Davisâ, and the tweakable with ciphertext stealing (XTS) mode (also referred to as the âXTS-AES modeâ), standardized in 2007 as IEEE P1619 for the AES block cipher algorithm.
FIG. 5 is a block diagram illustrating the structure of a conventional encryption device implementing the TBC mode of operation. According to the TBC mode of operation, each plaintext block P j is encrypted into a ciphertext block C j , by a block cipher encryption unit 51 - j , that uses an encryption key and a tweak value during encryption. An initial tweak value T 0 is used for the encryption of the first plaintext block P 0 . The tweak value used for the encryption of each successive plaintext block corresponds to the ciphertext block generated by the previous block cipher encryption unit 51 -( j â1) in the chain.
The XEX and XTS modes of operation use a tweak value which corresponds to the sector address assigned to the data unit or sector containing data to be encrypted. The XEX mode of operation uses a same encryption key for tweak value encryption and plaintext block encryption. The XTS mode of operation uses two different encryption keys. A first encryption key (also referred to as a âtweak encryption keyâ) is used to encrypt the tweak value. A second encryption key (also referred to as âdata encryption keyâ) is used for plaintext blocks encryption.
The processing of each single plaintext block according to the XEX and XTS modes is similar and comprises two phases. The first phase aims at generating a tweak block by applying an encryption of the tweak value using a block cipher and the tweak encryption key followed by a combinatorial function (e.g. modular multiplication) over a finite field involving a primitive element over a given finite field and the block index associated with the processed plaintext block. The second phase aims at generating a ciphertext block in association with the processed plaintext block and consists of plaintext block encryption using a block cipher and the data encryption key, where the input and output of the block cipher encryption unit are XORed with the tweak block generated at the first phase. The repetition of the single plaintext block encryption to the remaining plaintext blocks in the chain is defined by the mode of operation.
FIG. 6 is a block diagram illustrating the structure of a conventional encryption device implementing the XEX mode of operation. Accordingly, the tweak encryption unit 61 generates an encrypted tweak value stored in a storage unit 63 - 0 (e.g. a register). Then, along the chain, successive combinatorial functions (e.g. modular multiplications) over a Galois field are performed by combinatorial function units 65 - j , each combinatorial function producing a tweak block T j stored in a storage unit 63 - j . The encryption device further comprises m+1 block cipher encryption units 67 - j for j=0, . . . , m, the j th block cipher encryption unit 67 - j being configured to determine a j th intermediate ciphertext block IC j by encrypting the output of the XOR operation applied to the j th plaintext block P j and the tweak block T j stored in the j th storage unit 63 - j . Then, the j th ciphertext block C j is determined by applying an XOR operation to the j th intermediate ciphertext block IC j and the tweak block T j stored in the j th storage unit 63 - j.
FIG. 7 is a block diagram illustrating the structure of a conventional encryption device implementing the XTS mode of operation. The XTS mode uses ciphertext stealing to provide support and encryption of data units/sectors with a size that is not divisible by the cipher block-length. In case units/sectors size is divisible by the cipher block length, ciphertext blocks are generated in a similar way as they are being generated by the XEX mode of operation except for tweak and data encryption keys being different. Accordingly, the data unit is divided into m+1 plaintext blocks among which the first m plaintext blocks P 0 , P 1 , . . . , P m-1 have the cipher block-length (for example 128 bits for the AES block-cipher), and the last plaintext block P m has a length lower or equal to the cipher block length (for example less than or equal to 128 bits for the AES block-cipher). The (mâ2) first ciphertext blocks are generated in a similar way as ciphertext blocks are generated in the XEX mode of operation. The m th ciphertext block C m is generated from the processing of the (mâ1) th plaintext block P m-1 . The determination of the (mâ1) th ciphertext block consists of two processing steps. At a first step, full-length plaintext block Pâ² m is generated by filling the original m th plaintext block P m with the last digits of the m th ciphertext block C m such that the plaintext block P m is of length equal to the cipher block-length. At a second step, a first XOR operation, a block cipher encryption, and a second XOR operation are applied to the determined full-length plaintext block Pâ² m and the tweak block stored in the m th storage unit to generate the (mâ1) th ciphertext block C m-1 .
Tweakable operation modes provide stronger data protection and security than non-tweakable modes. The use of the tweak blocks provides an additional security layer and adds a difficulty to malicious parties who plan to recover the tweak blocks and the data encryption key for recovering the original data stored on a protected device. However, recent studies revealed that tweakable modes of operation, in particular the AES-XTS mode, are prone to side-channel attacks. Some power side-channel attacks against the AES-XTS mode use the side-channel information leaked through the modular multiplications for recovering the tweak blocks, as disclosed in âC. Luo, Y. Fei, and A-A. Ding, âSide-Channel Power Analysis on XTS-AESâ, In Proceedings of the Design, Automation & Test in Europe Conference & Exhibition, 2017â. Such attacks show that in spite of using encrypted tweaks, the XTS-AES mode and in general tweakable modes of operation are still vulnerable to side-channel attacks.
There is accordingly a need for protecting tweakable modes of operation for block ciphers used for data encryption.
SUMMARY
In order to address these and other problems, there is provided a block cipher encryption device for encrypting a data unit plaintext into blocks of ciphertexts, the data unit plaintext being assigned a tweak value and being divided into one or more plaintext blocks. The block cipher encryption device comprises a combinatorial function unit associated with each plaintext block (P j ), the combinatorial function unit being configured to determine a tweak block value (T j ) by applying a combinatorial function between a value derived from the tweak value and a function of a block index assigned to the plaintext block. The block cipher encryption device further comprises, in association with each plaintext block (P j ), a first masking unit configured to determine a masked value M j (T j ) by applying a data masking algorithm to the tweak block value (T j ) determined by the combinatorial function unit associated with the plaintext block.
According to some embodiments, the block cipher encryption device may further comprise:
a tweak encryption unit configured to determine an encrypted tweak value by encrypting the tweak value using a block cipher and a tweak encryption key, the value derived from the tweak value being given by the encrypted tweak value; a first XOR unit configured to determine an intermediate plaintext block (IP j ) by applying an XOR operation between the masked value M j (T j ) and the plaintext block (P j ); a block cipher encryption unit configured to determine an intermediate ciphertext block (IC j ) by encrypting the intermediate plaintext block using the block cipher and a data encryption key; a second XOR unit configured to determine a ciphertext block (C j ) by applying an XOR operation between the masked value M j (T j ) and the intermediate ciphertext block (IC j ).
According to some embodiments, the tweak block value (T j ) may determine by applying a combinatorial function between the encrypted tweak value and a function of a block index assigned to the plaintext block, the function being an exponentiation function represented by a base value and an exponent value, the base value being a primitive element over a given finite field, the exponent value being equal to said block index.
According to some embodiments, the data masking algorithm may be an additive masking algorithm or a multiplicative masking algorithm.
According to some embodiments, the block cipher may implement a block cipher masking algorithm, the block cipher masking algorithm being an additive masking algorithm or a multiplicative masking algorithm.
According to some embodiments, the block cipher applied by the block cipher encryption unit may implement an iterated additive block cipher masking algorithm that performs several masking iterations, a mask value being used at each masking iteration. In such embodiments, the first masking unit may be configured to apply a data masking algorithm that uses as a mask value the mask value implemented by the block cipher encryption unit at the last masking iteration, the block cipher encryption device comprising, in association with each plaintext block (P j ):
a second masking unit configured to apply the data masking algorithm to the masked value determined by the first masking unit, and a third masking unit configured to apply the data masking algorithm to the intermediate plaintext block (IP j ) before being encrypted by the block cipher encryption unit.
According to some embodiments, in which the block cipher applied by the block cipher encryption unit implements an iterated additive block cipher masking algorithm that performs several masking iterations, a mask value being used at each masking iteration, the first masking unit may be configured to apply a data masking algorithm that uses, as a mask value, an affine function of the mask value implemented by the block cipher encryption unit at the last masking iteration. The block cipher encryption device may further comprise, in association with each plaintext block (P j ):
a second masking unit configured to apply the data masking algorithm to the intermediate plaintext block (IP j ) before being encrypted by the block cipher encryption unit;
the affine function being represented by a slope coefficient and a constant value, the slope coefficient being a predefined primitive element over a given finite field, the constant value corresponding to the mask value implemented by the block cipher encryption unit at the last masking iteration of the iterated additive block cipher masking algorithm.
According to some embodiments, the block cipher encryption device may comprise, in association with each plaintext block (P j ):
a second masking unit configured to apply the data masking algorithm to the masked value determined by the first masking unit and corresponding to the mask value implemented by the block cipher encryption unit ( 86 - j ) and ( 86 - j +1), and a third masking unit configured to apply the data masking algorithm to the intermediate plaintext block (IP j ) before being encrypted by the block cipher encryption unit ( 86 - j ); a fourth masking unit configured to apply the data masking algorithm to the ciphertext block determined by the second XOR unit;
the data masking algorithm being an additive masking algorithm using a predefined mask value selected from a set of predefined mask values.
According to some embodiments, the block cipher encryption device may comprise, in association with each plaintext block (P j ):
a second masking unit configured to apply the data masking algorithm to the intermediate plaintext block (IP j ) before being encrypted by the block cipher encryption unit; a third masking unit configured to apply the data masking algorithm to the ciphertext block determined by the second XOR unit;
the masking algorithm being an additive masking algorithm using an affine function of a predefined mask value, the affine function being represented by a slope coefficient and a constant value, the slope coefficient being a predefined primitive element over a given finite field, the constant value being a predefined mask value selected from a predefined set of predefined mask values.
According to some embodiments, the block cipher encryption device may comprise, in association with each plaintext block (P j ), a second masking unit configured to apply the data masking algorithm to the masked value determined by the first masking unit, the data masking algorithm being a multiplicative masking using predefined invertible mask values.
According to some embodiments, the block cipher may be chosen in a group comprising the AES block cipher, the DES block cipher, the TDEA block cipher, the SEED block cipher, the SM4 block cipher, Camellia block cipher, the Blowfish block cipher, the Simon block cipher, the IDEA block cipher, and the RC5.
According to some embodiments, the block cipher encryption device may be configured to encrypt the data unit plaintext according to a tweakable mode of operation chosen in a group comprising the XEX mode of operation and the XTS mode of operation.
There is also provided a block cipher decryption device for decrypting a data unit ciphertext into blocks of plaintexts, the data unit ciphertext being previously encrypted using the block cipher encryption device according to any preceding feature, the data unit ciphertext being assigned a tweak value and being divided into one or more ciphertext blocks, the block cipher decryption device comprising:
a combinatorial function unit associated with each ciphertext block (C j ), the combinatorial function unit being configured to determine a tweak block value (T j ) by applying a combinatorial function between a value derived from the tweak value and a function of a block index assigned to the plaintext block.
The block cipher decryption device comprises, in association with each ciphertext block (C j ):
a masking unit configured to determine a masked value M j (T j ) by applying a data masking algorithm to the tweak block value (T j ) determined by the combinatorial function unit associated with the ciphertext block.
There is also provided a method for encrypting a data unit plaintext into blocks of ciphertexts, the data unit plaintext being assigned a tweak value and being divided into one or more plaintext blocks, the method comprising:
determining a tweak block value (T j ) in association with each plaintext block by applying a combinatorial function between a value derived from the tweak value and a function of a block index assigned to the plaintext block.
The method comprises, in association with each plaintext block (P j ), determining a masked value M j (T j ) by applying a data masking algorithm to the tweak block value (T j ) determined in association with the plaintext block.
There is also provided a method for decrypting a data unit ciphertext into blocks of plaintexts, the data unit ciphertext being assigned a tweak value and being divided into one or more ciphertext blocks, the decryption method comprising:
determining a tweak block value (T j ) in association with each ciphertext block (C j ) by applying a combinatorial function between a value derived from the tweak value and a function of a block index assigned to the ciphertext block.
The method comprises, in association with each ciphertext block (C j ), determining a masked value M j (T j ) by applying a data masking algorithm to the tweak block value (T j ) determined in association with the ciphertext block.
Advantageously, the various embodiments of the invention provide efficient and low cost (particularly in terms of area footprint and power consumption) security mechanisms enabling a partial or an end-to-end masking of data in the encryption/decryption chain, such as masking countermeasures providing protection of tweak blocks and sensitive data against side-channel attacks.
Advantageously, the various embodiments of the disclosure provide a secure XTS operation mode for the AES algorithm. This makes it resistant to attacks that target the tweak block value for gaining knowledge about the cryptosystem.
Advantageously, the various embodiments of the disclosure provide secure tweakable chained modes of operation for block ciphers used in disk encryption/decryption.
BRIEF DESCRIPTION OF DRAWINGS
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate various embodiments of the invention.
FIG. 1 is a block diagram illustrating the structure of an encryption device implementing the EBC mode of operation of the prior art;
FIG. 2 is a block diagram illustrating the structure of an encryption device implementing the CBC mode of operation of the prior art;
FIG. 3 is a block diagram illustrating the structure of an encryption device implementing the CFB mode of operation of the prior art;
FIG. 4 is a block diagram illustrating the structure of an encryption device implementing the OFB mode of operation of the prior art;
FIG. 5 is a block diagram illustrating the structure of an encryption device implementing the TBC mode of operation of the prior art;
FIG. 6 is a block diagram illustrating the structure of an encryption device implementing the XEX mode of operation of the prior art;
FIG. 7 is a block diagram illustrating the structure of an encryption device implementing the XTS mode of operation of the prior art;
FIG. 8 is a block diagram illustrating the structure of a single cipher's plaintext block encryption unit according to some embodiments of the invention;
FIG. 9 is a block diagram illustrating the structure of a single cipher's plaintext block encryption unit according to some embodiments of the invention in which additive masking is applied;
FIG. 10 is a block diagram illustrating the structure of a single cipher's plaintext block encryption unit according to embodiments of the invention in which additive masking is applied;
FIG. 11 is a block diagram of a single cipher's plaintext block encryption unit according to embodiments of the invention in which predefined mask values are used;
FIG. 12 is a block diagram of a single cipher's plaintext block encryption unit according to embodiments of the invention;
FIG. 13 is a block diagram of a single cipher's plaintext block encryption unit according to embodiments of the invention in which multiplicative masking is used;
FIG. 14 is a block diagram of an encryption device implementing the XTS mode of operation according to embodiments of the invention in which an additive masking algorithm is considered;
FIG. 15 is a block diagram of an encryption device implementing the XTS mode of operation according to embodiments of the invention in which an additive masking algorithm is considered;
FIG. 16 is a block diagram of an encryption device implementing the XTS mode of operation according to other embodiments of the invention;
FIG. 17 is a block diagram of an encryption device implementing the XTS mode of operation according to an embodiment;
FIG. 18 is a block diagram of an encryption device implementing the XTS mode of operation according to an embodiment in which a multiplicative masking algorithm is used;
FIG. 19 is a block diagram of a cipher's block decryption according to some embodiments;
FIG. 20 is a flowchart depicting a method for encrypting a data unit plaintext using block ciphers based on tweakable modes of operation according to some embodiments, and
FIG. 21 is a flowchart depicting a method for decrypting a data unit ciphertext using block ciphers based on tweakable modes of operation, according to some embodiments.
DETAILED DESCRIPTION
Embodiments of the present disclosure provide devices and methods for secure tweakable block ciphers used for encryption and decryption. The various embodiments of the invention provide low-complexity and secure tweakable modes of operation implemented in block ciphers for encrypting/decrypting data stored in sector-addressable storage media.
Devices and methods according to the embodiments of the disclosure may be implemented to protect and secure data stored in block-oriented storage devices, such as disk drives used in or in combination with several data storage devices applied to various applications.
A disk drive may be any disk capable of holding data/information temporarily or permanently.
The disk drive may be for example a magnetic storage device such as a floppy disk, a hard disk drive, a solid state memory, a magnetic strip, a super disk, a tape cassette, and a zip diskette.
Alternatively, the disk drive may be an optical storage device such as a Blu-Ray⢠disc, a CD-ROM disc, a CD-R disc, a CD-RW disc, a DVD-R disc, a DVD+R disc, a DVD-RW disc, and a DVD+RW disc.
The disk drive may be removable (e.g., CDs, USB keys) or embedded in the device (e.g. hard disk drive containing non-removable disk). More generally, the disk drive may be any internal or external storage device that enables data storage and/or data back-up and/or or data transfer.
The disk drive may be implemented in several storage and/or computing devices and/or computing systems such as IoT devices, smartphone, desktop computers, laptops and mobile computers, multimedia storage systems used for example in multimedia servers or the like.
Exemplary applications of disk drives comprise with no limitation audio and video recording (e.g. magnetic and optical recording), computer storage, consumer electronic storage used for example in multimedia applications such as real-time video-on-demand (VoD), interactive VoD, interactive action games, learning on demand, and e-learning.
Data stored in the disk drive may contain text, and/or graphics, and/or audio data, and/or video data, and/or pictures, and/or binary data, or mixed-data containing any combination thereof.
A disk drive is a sector-based storage disk (also referred to as a âsector-based storage deviceâ) in which data is stored in a plurality of disk sectors or data units. A disk sector represents the minimum storage unit of the storage disk of a given length such as for example 512 bytes, 2048 bytes, or 4096 bytes. Each sector of the disk is assigned a sector address representing the storage location of the sector within the disk. Each sector is divided into several blocks or data blocks, each block being assigned a block index indicating the position of the block within the sector.
Embodiments of the disclosure provide data encryption/decryption based on the use of block ciphers, and more specifically on the use of tweakable block ciphers. The block ciphers according to the embodiments of the invention take as input the plaintext/ciphertext which is to be encrypted/decrypted, the data encryption/decryption key used to encrypt/decrypt, and a tweak value.
The various embodiments of the disclosure provide secure tweakable block cipher modes of operation for a secure tweakable block cipher encryption device (also referred to as âa block cipher encryption deviceâ) configured to encrypt a data unit plaintext to be stored for example on a disk drive. More specifically, the data unit plaintext corresponds to the data to be stored, after encryption, in a disk sector.
Data encryption using tweakable block ciphers relies on the division of the data unit plaintext into at least one plaintext block, with its size being the same as for the block cipher. In case the data unit can be divided in more than one block, let the last block be lower than or equal to the block-length (in terms of bits) of the block cipher, i.e. the length of the block of data encrypted/decrypted by the block cipher. Tweakable block ciphers also use a tweak value, a tweak encryption key, and a data encryption key.
To facilitate the understanding of some embodiments of the invention, there follows notations and definitions used hereinafter:
designates a block cipher used for tweak encryption, plaintext block encryption, and ciphertext decryption; l designates the block-length of a block cipher
, i.e. the number of bits in a plaintext block/ciphertext block to be encrypted/decrypted using the block cipher
. For example, for the AES block cipher, I=128 bits; k designates the bit-size of the last plaintext block/ciphertext block, k takes l if the plaintext/ciphertext block is complete or the useful number of bits in the plaintext/ciphertext block otherwise; α stands for the primitive element of the Galois Field GF(2 l ) that corresponds to a polynomial; â designates the bit-wise exclusive-OR (XOR) operator; â designates a combinatorial function (e.g. modular multiplication of two polynomials over the binary Galois Field GF(2)). In embodiments in which the block cipher
is the AES block cipher, modular multiplications of two polynomials are performed over GF(2) modulo x 128 +x 7 +x 2 +x+1; (.|.) stands for a concatenation operator which provides, from two or more input scalars or vectors, a list in the form of a vector, the elements of the list being equal to the concatenated inputs; P=(P 0 |P 1 |, . . . , |P m ) designates a data unit plaintext divided into (m+1) plaintext blocks P j for j=0, . . . , m such that m is the largest integer such that lÃm+k is no more than the bit-size of the data unit plaintext. Accordingly, the first m plaintext blocks P j for j=0, . . . , mâ1 are all exactly l-bits long, and the last plaintext block P m has a bit-length between 0 and (kâ1)-bit long; j designates a block index assigned to the plaintext block P j (respectively the ciphertext block C j ) and representing the position of the plaintext block P j (respectively the ciphertext block C j ) within the data unit plaintext (respectively the data unit ciphertext). The first plaintext block P 0 (respectively the first ciphertext block P 0 ) is assigned the block index j=0; i refers to a tweak value assigned to the data unit plaintext P and the data unit ciphertext C. The tweak value may be any non-negative integer value indicating/representing the sector position/address assigned to the sector/data unit containing the data unit plaintext and the data unit ciphertext; Key K T refers to a first encryption key (also referred to as a âtweak encryption keyâ) used for the tweak value encryption; Key K P refers to a second encryption key (also referred to as a âplaintext encryption keyâ or âciphertext decryption keyâ) used for plaintext data encryption and ciphertext data decryption; E
,K
T (i) refers to an encrypted tweak value obtained by encrypting the tweak value i using the block cipher
and the tweak encryption key K T ; T j for j=0, . . . , m refers to a tweak block generated from a combinatorial function applied to a value derived from the tweak value (e.g. the encrypted tweak value E
,K
T (i)) and a function Æ(j) of the block index assigned to the j th plaintext block P; IP j refers to an intermediate plaintext block determined from the processing/in association of/with the j th plaintext block P j ; IC j refers to an intermediate ciphertext block determined from the processing/in association of/with the j th ciphertext block C j ; C j for j=0, . . . , m refers to the j th ciphertext block determined in association with the j th plaintext block P; C=(C 0 |C 1 |, . . . , |C m ) designates a data unit ciphertext obtained by the concatenation of the ciphertext blocks C j for j=0, . . . , m.
The various embodiments of the disclosure provide security mechanisms implemented in tweakable block cipher encryption and decryption devices for securing the used modes of operations.
FIG. 8 is a block diagram illustrating the structure of a block cipher encryption device for encrypting a data unit plaintext P=(P 0 |P 1 |, . . . , |P m ) according to a secure tweakable block cipher operation mode according to the disclosed solution. The data unit plaintext is assigned a tweak value i and is divided into one or more (m+1; m+1â¥1) plaintext blocks P j for j=0, . . . , m. FIG. 8 illustrates the processing of a single plaintext block, the j th plaintext block of block index j, for determining the j th ciphertext block associated with the j th plaintext block. The repetition of the single block processing to cover all the plaintext blocks is defined by the mode of operation of the block cipher encryption device. As depicted in FIG. 8 , the block cipher encryption device may comprise:
a tweak encryption unit 81 configured to determine an encrypted tweak value E
,K
T (i) by encrypting the tweak value i using a block cipher
and a tweak encryption key K T , and a combinatorial function unit 82 - j associated with each plaintext block P for j=0, . . . , m, the j th combinatorial function unit 82 - j being configured to determine a tweak block value T j by applying a combinatorial function between a value derived from the tweak value i, for instance the encrypted tweak value E
,K
T (i), and a function Æ(j) of the block index j assigned to the plaintext block P j according to:
T j =E
K T ( i )âÆ( j )ââ(1)
According to some embodiments, the function Æ(j) may be an exponentiation function represented by a base value and an exponent value, the base value being a primitive element α over a given finite field and the exponent value being equal to the block index j according to:
Æ( j )=α j ââ(2)
For the first plaintext block P 0 , the combinatorial function unit 82 - 0 is configured to determine the tweak block T 0 =E
,K
T (i)âÆ(0)=E
,K
T (i) given that Æ(0)=α 0 =1 for any non-zero primitive element αâ 0.
In some embodiments, the combinatorial function may be a modular multiplication.
The security mechanisms according to the embodiments of the invention are based on the use of masking algorithms to protect the tweak value and the tweak blocks T obtained from the encrypted tweak value E
,K
T (i) through combinatorial functions (e.g. modular multiplications). Accordingly, the block cipher encryption device comprises, in association with each plaintext block P j for j=0, . . . , m, a first masking unit 83 - j configured to determine a masked value M j (T j ) by applying a data masking algorithm to the tweak block value T j determined by the combinatorial function unit 82 - j associated with the j th plaintext block P j .
The application of the masking countermeasures advantageously enables protecting the tweak blocks such that the masked value M j (T j ) is stored in a storage unit (e.g. a register) 84 - j rather than storing the tweak block itself. Such protection provides security against attacks that target recovering the tweak blocks usually stored in the registers 84 - j for j=0, . . . , m.
The block cipher encryption device may be configured to determine the j th ciphertext block associated with the j th plaintext block by applying a first XOR operation, a data encryption, and a second XOR operation. With reference to <f
CLAIMS
Claims ( 14 )
The invention claimed is:
1. A block cipher encryption device for encrypting a data unit plaintext into blocks of ciphertexts, said data unit plaintext being assigned a tweak value and being divided into one or more plaintext blocks, the block cipher encryption device comprising:
a combinatorial function unit ( 82 - j ) associated with each plaintext block (P j ), said combinatorial function unit ( 82 - j ) being configured to determine a tweak block value (T j ) by applying a combinatorial function between a value derived from said tweak value and a function of a block index assigned to said plaintext block,
wherein the block cipher encryption device, in association with each plaintext block (P j ), comprises:
a first masking unit ( 83 - j ) configured to determine a masked value M j (T j ) by applying a data masking algorithm to the tweak block value (T j ) determined by the combinatorial function unit ( 82 - j ) associated with said plaintext block,
wherein the block cipher encryption device further comprises:
a tweak encryption unit configured to determine an encrypted tweak value by encrypting said tweak value using a block cipher and a tweak encryption key, said value derived from the tweak value being given by said encrypted tweak value;
a first XOR unit ( 85 - j ) configured to determine an intermediate plaintext block (IP j ) by applying an XOR operation between said masked value M j (T j ) and said plaintext block (P j );
a block cipher encryption unit ( 86 - j ) configured to determine an intermediate ciphertext block (IC j ) by encrypting said intermediate plaintext block using said block cipher and a data encryption key;
a second XOR unit ( 87 - j ) configured to determine a ciphertext block (C j ) by applying an XOR operation between said masked value M j (T j ) and said intermediate ciphertext block (IC j ).
2. The block cipher encryption device of claim 1 , wherein said tweak block value (T j ) is determined by applying a combinatorial function between said encrypted tweak value and a function of a block index assigned to said plaintext block, said function being an exponentiation function represented by a base value and an exponent value, said base value being a primitive element over a given finite field, said exponent value being equal to said block index.
3. The block cipher encryption device of claim 1 , wherein said data masking algorithm is an additive masking algorithm or a multiplicative masking algorithm.
4. The block cipher encryption device of claim 1 , wherein said block cipher implements a block cipher masking algorithm, said block cipher masking algorithm being an additive masking algorithm or a multiplicative masking algorithm.
5. The block cipher encryption device of claim 1 , wherein said block cipher applied by the block cipher encryption unit ( 86 - j ) implements an iterated additive block cipher masking algorithm that performs several masking iterations, a mask value being used at each masking iteration, said first masking unit ( 83 - j ) being configured to apply a data masking algorithm that uses as a mask value the mask value implemented by said block cipher encryption unit ( 86 - j ) at the last masking iteration, the block cipher encryption device comprising, in association with each plaintext block (P j ):
a second masking unit ( 98 - j ) configured to apply said data masking algorithm to the masked value determined by said first masking unit ( 83 - j ), and
a third masking unit ( 99 - j ) configured to apply said data masking algorithm to said intermediate plaintext block (IP j ) before being encrypted by said block cipher encryption unit ( 86 - j ).
6. The block cipher encryption device of claim 1 , wherein said block cipher applied by the block cipher encryption unit ( 86 - j ) implements an iterated additive block cipher masking algorithm that performs several masking iterations, a mask value being used at each masking iteration, said first masking unit ( 83 - j ) being configured to apply a data masking algorithm that uses, as a mask value, an affine function of the mask value implemented by said block cipher encryption unit ( 86 - j ) at the last masking iteration, the block cipher encryption device comprising, in association with each plaintext block (P j ):
a second masking unit ( 109 - j ) configured to apply said data masking algorithm to said intermediate plaintext block (IP j ) before being encrypted by said block cipher encryption unit ( 86 - j );
said affine function being represented by a slope coefficient and a constant value, said slope coefficient being a predefined primitive element over a given finite field, said constant value corresponding to the mask value implemented by the block cipher encryption unit ( 86 - j ) at the last masking iteration of the iterated additive block cipher masking algorithm.
7. The block cipher encryption device of claim 1 , wherein the block cipher encryption device comprises, in association with each plaintext block (P j ):
a second masking unit ( 111 - j ) configured to apply said data masking algorithm to the masked value determined by said first masking unit ( 83 - j ) and corresponding to the mask value implemented by the block cipher encryption unit ( 86 - j ) and ( 86 - j +1), and
a third masking unit ( 113 - j ) configured to apply said data masking algorithm to said intermediate plaintext block (IP j ) before being encrypted by said block cipher encryption unit ( 86 - j );
a fourth masking unit ( 115 - j ) configured to apply said data masking algorithm to said ciphertext block determined by the second XOR unit ( 87 - j );
said data masking algorithm being an additive masking algorithm using a predefined mask value selected from a set of predefined mask values.
8. The block cipher encryption device of claim 1 , wherein the block cipher encryption device comprises, in association with each plaintext block (P j ):
a second masking unit ( 121 - j ) configured to apply said data masking algorithm to said intermediate plaintext block (IP j ) before being encrypted by said block cipher encryption unit ( 86 - j );
a third masking unit ( 123 - j ) configured to apply said data masking algorithm to said ciphertext block determined by the second XOR unit ( 87 - j );
said masking algorithm being an additive masking algorithm using an affine function of a predefined mask value, said affine function being represented by a slope coefficient and a constant value, said slope coefficient being a predefined primitive element over a given finite field, said constant value being a predefined mask value selected from a predefined set of predefined mask values.
9. The block cipher encryption device of claim 1 , wherein the block cipher encryption device comprises, in association with each plaintext block (P j ), a second masking unit ( 131 - j ) configured to apply said data masking algorithm to the masked value determined by said first masking unit ( 83 - j ), said data masking algorithm being a multiplicative masking using predefined invertible mask values.
10. The block cipher encryption device of claim 1 , wherein said block cipher is chosen in a group comprising the AES block cipher, the DES block cipher, the TDEA block cipher, the SEED block cipher, the SM4 block cipher, Camellia block cipher, the Blowfish block cipher, the Simon block cipher, the IDEA block cipher, and the RC5.
11. The block cipher encryption device of claim 1 , wherein the block cipher encryption device is configured to encrypt said data unit plaintext according to a tweakable mode of operation chosen in a group comprising the XEX mode of operation and the XTS mode of operation.
12. A block cipher decryption device for decrypting a data unit ciphertext into blocks of plaintexts, said data unit ciphertext being previously encrypted using the block cipher encryption device according to claim 1 , said data unit ciphertext being assigned a tweak value and being divided into one or more ciphertext blocks, the block cipher decryption device comprising:
a combinatorial function unit ( 192 - j ) associated with each ciphertext block (C j ), said combinatorial function unit ( 192 - j ) being configured to determine a tweak block value (T j ) by applying a combinatorial function between a value derived from said tweak value and a function of a block index assigned to said plaintext block,
wherein the block cipher decryption device, in association with each ciphertext block (C j ), comprises:
a masking unit ( 193 - j ) configured to determine a masked value M j (T j ) by applying a data masking algorithm to the tweak block value (T j ) determined by the combinatorial function unit ( 192 - j ) associated with said ciphertext block,
wherein the block cipher decryption device further comprises:
a tweak encryption unit ( 191 ) configured to determine an encrypted tweak value by encrypting said tweak value using a block cipher and a tweak encryption key, said value derived from the tweak value being equal to said encrypted tweak value;
a first XOR unit ( 195 - j ) configured to determine an intermediate ciphertext block (IC j ) by applying an XOR operation between said masked value M j (T j ) and said ciphertext block C j ;
a block cipher decryption unit ( 196 - j ) configured to determine an intermediate intermediate plaintext block IP j by decrypting said intermediate ciphertext block IC j using said block cipher and a data decryption key;
a second XOR unit ( 197 - j ) configured to determine a plaintext block (P j ) by applying an XOR operation between said masked value M j (T j ) and said intermediate plaintext block (IP j ).
13. A method for encrypting a data unit plaintext into blocks of ciphertexts, said data unit plaintext being assigned a tweak value and being divided into one or more plaintext blocks, the method comprising:
determining a tweak block value (T j ) in association with each plaintext block by applying a combinatorial function between a value derived from said tweak value and a function of a block index assigned to said plaintext block,
wherein the method comprises, in association with each plaintext block (P j ), determining a masked value M j (T j ) by applying a data masking algorithm to the tweak block value (T j ) determined in association with said plaintext block,
wherein the method further comprises:
determining ( 202 ) an encrypted tweak value by encrypting said tweak value using a block cipher and a tweak encryption key, said value derived from the tweak value being equal to said encrypted tweak value;
determining ( 208 ) an intermediate plaintext block (IP j ) by applying an XOR operation between said masked value M j (T j ) and said plaintext block (P j );
determining ( 210 ) an intermediate ciphertext block (IC j ) by encrypting said intermediate plaintext block using said block cipher and a data encryption key;
determining ( 212 ) a ciphertext block (C j ) by applying an XOR operation between said masked value M j (T j ) and said intermediate ciphertext block (IC j ).
14. A method for decrypting a data unit ciphertext into blocks of plaintexts, said data unit ciphertext being assigned a tweak value and being divided into one or more ciphertext blocks, the decryption method comprising:
determining a tweak block value (T j ) in association with each ciphertext block (C j ) by applying a combinatorial function between a value derived from said tweak value and a function of a block index assigned to said ciphertext block,
wherein the method comprises, in association with each ciphertext block (C j ), determining a masked value M j (T j ) by applying a data masking algorithm to the tweak block value (T j ) determined in association with said ciphertext block,
wherein the method further comprises:
determining ( 213 ) an encrypted tweak value by encrypting said tweak value using a block cipher and a tweak encryption key, said value derived from the tweak value being equal to said encrypted tweak value;
determining ( 217 ) an intermediate ciphertext block (IC j ) by applying an XOR operation between said masked value M j (T j ) and said ciphertext block (IC j );
determining ( 219 ) an intermediate plaintext block (IP j ) by decrypting said intermediate ciphertext block (IC j ) using said block cipher and a data decryption key;
determining ( 221 ) a plaintext block (P j ) by applying an XOR operation between said masked value M j (T j ) and said intermediate plaintext block (IP j ).
US17/251,154
2018-06-18
2019-06-05
Tweakable block ciphers for secure data encryption
Active
2040-03-11
US11689353B2
( en )
Applications Claiming Priority (4)
Application Number
Priority Date
Filing Date
Title
EP18305754.6
2018-06-18
EP18305754
2018-06-18
EP18305754.6A
EP3584989B1
( en )
2018-06-18
2018-06-18
Tweakable block ciphers for secure data encryption
PCT/EP2019/064613
WO2019243047A1
( en )
2018-06-18
2019-06-05
Tweakable block ciphers for secure data encryption
Publications (2)
Publication Number
Publication Date
US20210266143A1
US20210266143A1 ( en )
2021-08-26
US11689353B2
true
US11689353B2 ( en )
2023-06-27
Family
ID=63579292
Family Applications (1)
Application Number
Title
Priority Date
Filing Date
US17/251,154
Active
2040-03-11
US11689353B2
( en )
2018-06-18
2019-06-05
Tweakable block ciphers for secure data encryption
Country Status (3)
Country
Link
US
( 1 )
US11689353B2
( en )
EP
( 1 )
EP3584989B1
( en )
WO
( 1 )
WO2019243047A1
( en )
Cited By (2)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US12255981B2
( en )
*
2023-06-15
2025-03-18
Hangzhou Hikvision Digital Technology Co., Ltd.
Methods and apparatuses for implementing high-speed cryptographic computation based on software-hardware collaboration, and electronic devices
US20250392442A1
( en )
*
2024-06-21
2025-12-25
International Business Machines Corporation
Protection of cryptographic parameters used in cryptographic processing
Families Citing this family (17)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
CN109804596B
( en )
*
2016-12-09
2023-05-09
å¯ç ç ç©¶å ¬å¸
Programmable block cipher with masked input
US20220311596A1
( en )
*
2019-05-13
2022-09-29
Pii Guard Aps
A computer-implemented method of performing feistel-network-based block-cipher encryption of plaintext
US11507699B2
( en )
*
2019-09-27
2022-11-22
Intel Corporation
Processor with private pipeline
DE102019128528A1
( en )
*
2019-10-22
2021-04-22
Infineon Technologies Ag
DATA CRYPTOGRAPHY DEVICES AND STORAGE SYSTEMS
WO2021157003A1
( en )
*
2020-02-06
2021-08-12
ä¸è±é»æ©æ ªå¼ä¼ç¤¾
Encryption device, decryption device, encryption method, decryption method, encryption program, and decryption program
WO2022147349A1
( en )
*
2020-12-31
2022-07-07
Meta Platforms Technologies, Llc
High throughput storage encryption
US11755747B2
( en )
2020-12-31
2023-09-12
Meta Platforms Technologies, Llc
High throughput storage encryption
CN114186226B
( en )
*
2021-12-08
2025-08-01
æµæ±å¤§å¦
Cache side channel attack defense method based on hybrid randomization mapping
US12627467B2
( en )
2022-03-08
2026-05-12
Axiado Corporation
Memory transaction protection methods and circuitry
KR20230135253A
( en )
*
2022-03-16
2023-09-25
ì¼ì±ì ì주ìíì¬
Electronic device and method therefor
US12381711B2
( en )
2022-05-25
2025-08-05
Microsoft Technology Licensing, Llc
Encryption system and method
US12111774B2
( en )
*
2022-05-25
2024-10-08
Microsoft Technology Licensing, Llc
System and method for incremental encryption
CN117061092B
( en )
*
2023-10-12
2023-12-15
ä»°æ©å¤§å¦
A reversible circuit construction method for Simon encryption algorithm
CN117421747A
( en )
*
2023-10-24
2024-01-19
ä¸æµ·å è¯éæçµè·¯è¡ä»½æéå ¬å¸
Computer system and system memory encryption and decryption method
CN117421749A
( en )
2023-10-24
2024-01-19
ä¸æµ·å è¯éæçµè·¯è¡ä»½æéå ¬å¸
Computer system and system memory encryption and decryption method
CN119814281B
( en )
*
2024-11-25
2025-10-31
å京计ç®æºææ¯ååºç¨ç 究æ
A design method for a highly adjustable block cipher working mode
CN119254407B
( en )
*
2024-12-05
2025-03-07
ä¸æ±½ç 软件æµè¯(天津)æéå ¬å¸
Security assessment method and equipment for SM4-XTS high-order side channel analysis resistance capability
Citations (7)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US20110211691A1
( en )
*
2007-08-06
2011-09-01
Nec Corporation
Common key block encryption device, common key block encryption method, and program
US20120314857A1
( en )
*
2010-02-24
2012-12-13
Kazuhiko Minematsu
Block encryption device, block decryption device, block encryption method, block decryption method and program
US20150200772A1
( en )
*
2014-01-14
2015-07-16
Canon Kabushiki Kaisha
Information processing apparatus and method therefor
US20160364343A1
( en )
*
2015-06-10
2016-12-15
Freescale Semiconductor, Inc.
Systems and methods for data encryption
US20170054550A1
( en )
*
2015-08-20
2017-02-23
Samsung Electronics Co., Ltd.
Crypto devices, storage devices having the same, and encryption and decryption methods thereof
US20170104586A1
( en )
2015-10-08
2017-04-13
The Boeing Company
Scrambled tweak mode of blockciphers for differential power analysis resistant encryption
US20170364704A1
( en )
*
2016-06-20
2017-12-21
Netapp, Inc.
Per-volume tenant encryption and external key manager
2018
2018-06-18
EP
EP18305754.6A
patent/EP3584989B1/en
active
Active
2019
2019-06-05
US
US17/251,154
patent/US11689353B2/en
active
Active
2019-06-05
WO
PCT/EP2019/064613
patent/WO2019243047A1/en
not_active
Ceased
Patent Citations (7)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US20110211691A1
( en )
*
2007-08-06
2011-09-01
Nec Corporation
Common key block encryption device, common key block encryption method, and program
US20120314857A1
( en )
*
2010-02-24
2012-12-13
Kazuhiko Minematsu
Block encryption device, block decryption device, block encryption method, block decryption method and program
US20150200772A1
( en )
*
2014-01-14
2015-07-16
Canon Kabushiki Kaisha
Information processing apparatus and method therefor
US20160364343A1
( en )
*
2015-06-10
2016-12-15
Freescale Semiconductor, Inc.
Systems and methods for data encryption
US20170054550A1
( en )
*
2015-08-20
2017-02-23
Samsung Electronics Co., Ltd.
Crypto devices, storage devices having the same, and encryption and decryption methods thereof
US20170104586A1
( en )
2015-10-08
2017-04-13
The Boeing Company
Scrambled tweak mode of blockciphers for differential power analysis resistant encryption
US20170364704A1
( en )
*
2016-06-20
2017-12-21
Netapp, Inc.
Per-volume tenant encryption and external key manager
Non-Patent Citations (7)
* Cited by examiner, â Cited by third party
Title
Avanzi, " The QARMA Block Cipher FamilyâAlmost MDS Matrices Over Rings With Zero Divisors, Nearly Symmetric Even-Mansour Constructions With Non-Involutory Central Rounds, and Search Heuristics for Low-Latency S-Boxes ", IACR Transactions on Symmetric Cryptology, p. 1-40, 2017.
Granger ,et al., " Improved Masking for Tweakable Blockciphers with Applications to Authenticated Encryption ", International Conference on Simulation, Modeling, and Programming for Autonomous Robots, pp. 263-293, Apr. 28, 2016.
Hatzidimitriou, et al., " Implementation of a P1619 crypto-core for Shared Storage Media ", Melecon 2010-2010 15th IEEE Mediterranean Electrotechnical Conference, pp. 597-601, 2010.
Jean, et al., " Tweaks and Keys for Block Ciphers: the TWEAKEY Framework ", International Conference on the Theory and Application of Cryptology and Information Security, vol. 8874, pp. 274-288, Jan. 31, 2014.
Liskov, et al., " Tweakable Block Ciphers ", CRYPTO 2002, LNCS, vol. 2442, pp. 21-46, 2002.
Luo, et al., " Side-Channel Power Analysis on XTS-AES ", Proceedings of the Design, Automation & Test in Europe Conference & Exhibition, pp. 1330-1335, 2017.
Rogaway, " Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC ", Dept. of Computer Science, University of California, Davis, 2004.
Cited By (2)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US12255981B2
( en )
*
2023-06-15
2025-03-18
Hangzhou Hikvision Digital Technology Co., Ltd.
Methods and apparatuses for implementing high-speed cryptographic computation based on software-hardware collaboration, and electronic devices
US20250392442A1
( en )
*
2024-06-21
2025-12-25
International Business Machines Corporation
Protection of cryptographic parameters used in cryptographic processing
Also Published As
Publication number
Publication date
EP3584989A1
( en )
2019-12-25
US20210266143A1
( en )
2021-08-26
WO2019243047A1
( en )
2019-12-26
EP3584989B1
( en )
2023-09-27
Similar Documents
Publication
Publication Date
Title
EP3584989B1
( en )
2023-09-27
Tweakable block ciphers for secure data encryption
US12101415B2
( en )
2024-09-24
Method of RSA signature or decryption protected using a homomorphic encryption
US8358781B2
( en )
2013-01-22
Nonlinear feedback mode for block ciphers
US7177424B1
( en )
2007-02-13
Cryptographic apparatus and method
US11153068B2
( en )
2021-10-19
Encryption device, encryption method, decryption device and decryption method
US9443091B2
( en )
2016-09-13
Method and system for protecting execution of cryptographic hash functions
US10320554B1
( en )
2019-06-11
Differential power analysis resistant encryption and decryption functions
US6804354B1
( en )
2004-10-12
Cryptographic isolator using multiplication
US9515818B2
( en )
2016-12-06
Multi-block cryptographic operation
US20080084996A1
( en )
2008-04-10
Authenticated encryption method and apparatus
EP2197144A1
( en )
2010-06-16
Methods and devices for a chained encryption mode
US20060023875A1
( en )
2006-02-02
Enhanced stream cipher combining function
US9692592B2
( en )
2017-06-27
Using state reordering to protect against white box attacks
CN102099780B
( en )
2015-08-12
index fuzzy
Asaad et al.
2017
Advanced encryption standard enhancement with output feedback block mode operation
WO2011026134A1
( en )
2011-03-03
Encryption method and apparatus using composition of ciphers
CN114826590B
( en )
2023-03-24
A packet mode encryption method, decryption method, device and equipment thereof
KR101187854B1
( en )
2012-10-08
Permutation Data Transformation to Enhance Security
EP1807965B1
( en )
2019-01-30
Method, server and computer readable medium for obfuscating a cryptographic function
Huang et al.
2015
Differential-linear cryptanalysis of ICEPOLE
US20020001383A1
( en )
2002-01-03
Cryptosystem using multivariable polynomials
US6961427B1
( en )
2005-11-01
Methods and apparatus for keystream generation
CN109714154B
( en )
2021-10-29
An implementation method of a white-box cryptographic algorithm under the white-box security model with difficult code size
US20200342787A1
( en )
2020-10-29
Method and apparatus for decrypting cryptogram using auxiliary secret key
Renas et al.
2017
Advanced Encryption Standard Enhancement with Output Feedback Block Mode Operation
Legal Events
Date
Code
Title
Description
2020-12-10
FEPP
Fee payment procedure
Free format text : ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY
2021-03-21
AS
Assignment
Owner name : SECURE-IC SAS, FRANCE
Free format text : ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:BOUE, THEOPHILE;DUGARDIN, MARGAUX;LE PROVOST, YANNICK;AND OTHERS;SIGNING DATES FROM 20210208 TO 20210309;REEL/FRAME:055660/0940
2021-08-23
STPP
Information on status: patent application and granting procedure in general
Free format text : DOCKETED NEW CASE - READY FOR EXAMINATION
2022-11-22
STPP
Information on status: patent application and granting procedure in general
Free format text : NON FINAL ACTION MAILED
2023-06-07
STCF
Information on status: patent grant
Free format text : PATENTED CASE
2023-08-22
CC
Certificate of correction