Method and Apparatus for Data Encryption

This invention relates to data encryption and decryption. More specifically, it relates to computer programs used to encrypt and decrypt binary data.

The necessity of coding information prior to transmission over public channels or through public media is well known. Although the military has historically been the driving force behind the development of coding and decoding methods and apparatus, the growing use of computer networks in commercial fields, with confidential corporate data being transmitted over unsecured transmission lines, has created the need for a commercially available system which will be capable of encrypting and decrypting data at high speeds.

One commonly used method to encrypt and decrypt data is the Data Encryption Standard ("DES") announced by the Federal government in January 1977 (Federal Information Processing Standards Publication, January 16, 1977) and originally created by IBM. That algorithm for encrypting and decrypting binary information is incorporated herein

DES relies heavily on permutations of the inputted data and various "S-boxes" In DES and in this application an "S-Box" is used as an abbreviation of "Substitution Box". In such boxes, a number of preselected length is used to enter the "S-box" and a number of preselected length is outputted. Each number in a DES S-Box is carefully chosen to help randomize the data. Faster implementations of DES implement permutations by table look-ups using several bits simultaneously. In these implementations, the 32-to-32 bit permutation P which comprises an important part of the DES algorithm is effected by looking up several bits at the same time in a table. This permutation is often merged with the preceding S-box lookup. Each individual S-box in DES provides only 64 entries of 4 bits each, or 32 bytes per S-box. DES uses 8 S-boxes realized in hardware and operating in parallel to look up 8 different values simultaneously. Although this type of operation can be performed efficiently with parallel memory hardware, when and if the algorithm is "realized" in software on a conventional sequential processor, the table look-ups must occur serially, making DES exceedingly cumbersome and slow.

Another problematic aspect of DES is that the criteria used to design the S-boxes have been kept secret. Although no reason exists to believe that the S-boxes conceal a "trap door" which would enable the creators of DES to decipher DES encoded messages, it would be preferable to have a system wherein the criteria for S-box selection are made explicitly.

Finally, the size of the key used in DES has been criticized as being too small (only 56 bits) and the key schedule has been criticized for not providing adequate key mixing.

There is therefore a need for a data encryption/decryption method and apparatus which executes efficiently in software, which uses known criteria for selecting its S-boxes, and which precomputes the key.

Two methods for encrypting and decrypting data are described herein. The first performs fast encryption of large amounts of data. To achieve high speed, the S-boxes used in the encryption process are precomputed. The second method involves no precomputation and is used to encrypt small amounts of data. Both methods provide a method and apparatus for data encryption and decryption which is optimized for high speed implementation as software, which uses a publicly revealed method to generate its S-boxes and which uses a key size which insures full data security.

The first method is similar to DES in that it is a multi-round encryption function in which the original 64-bit clear text is divided into two 32-bit halves (called L and R for Left and Right) which are used alternately in the computations. Each half is used as input to a function F, which will be described later, whose output is exclusive ORed ("XORed") with the other half. The two halves are then exchanged and the calculations repeated until the pattern generated thereby appears to be completely random. Unlike DES, which uses an F function defined by 8 table lookups and the permutations associated therewith, this method uses a single table lookup in a larger S-box. This larger S-box is precomputed.

The second method differs from the first in that the S-box is not precomputed. Instead, a standard S-box is used. Although this requires a separate mechanism to mix in key material as the standard S-box cannot serve as the key, this mechanism is simple--key material is XORed with the 64-bit clear text data block before the first round and thereafter following every 8 rounds.

Both methods operate much more efficiently than DES when implemented as software, the design of their S-boxes is public, and the key mixing scheme is sufficiently complex to provide proper data security.

FIG. 1 is a flow-chart of the first method for data encryption and decryption;

FIG. 2 shows the encryption/decryption algorithm of FIG. 1 in a notationally clearer form;

FIG. 3 is an example of an S-box; and

FIG. 4 shows the method whereby the standard S-box is created.

Appendix A comprises a listing of a C language computer program which performs the claimed invention.

The basic encryption/decryption method is shown in FIG. 1. Data is processed in 64-bit clear text blocks. The initial 64-bit clear text block is split in half, creating an initial left half L.sub.-1 of 32 bits and an initial right half R.sub.-1 of 32 bits. L.sub.-2 : and R.sub.-1 are XORed with a 32-bit Auxiliary Key 0 and 32 bit Auxiliary Key 1, respectively. This preliminary operation has the effect of thwarting certain subtle types of "code breaking" attacks, especially those attacks where there is some knowledge of the data being transmitted. The output from this operation is an initial left half L.sub.0 and an initial right half R.sub.0, respectively, each 32 bits in length.

The main body of the encryption method begins with the rightmost eight bits of L.sub.0 being used as input to an S-box. The output from the S-box is a 32 bit entry which is then XORed with R.sub.0. L.sub.0, which was unchanged by its use to access the S-box, is then rotated according to a predefined rotation schedule. After its rotation, the 32-bit word is labeled R.sub.1 and used as the right half input in the next iteration of the encryption method. The output from the XOR operation of R.sub.0 and the S-box entry is labeled L.sub.1 and used as the left half input in the next iteration of the encryption method.

This simple process is the basic building block of the encryption method. In each succeeding round the output of the XOR operation is used in the same manner as L.sub.0 was initially--its rightmost 8 bits are used to access the S-box, the output of the S-box is XORed with the current right side 32-bit word and the result labeled as the new left half, the current left half is rotated, becoming the right half and the process repeats. The successive Rs are in turn formed using the rotation schedule as applied to the previous L. Successive iterations continue to operate on the data in the described manner until the pattern of the data, as seen in the output, approaches complete apparent randomness. The method, unlike DES, uses only one table lookup in a large S-box for each round.

In this first method, one S-box is used for each 8 rounds of the encryption process. The S-box contains 256 32-bit units. Each 8-bit byte in the inputted 64-bit clear text unit accesses the S-box once. After these 8 accesses are completed, a new S-box is selected. Thus, for each 16 rounds of the method, 2 S-boxes are required. This method of rotating the 8-bit bytes in the "left" unit and requiring a new S-box every 8 rounds eliminates the possibility that the same 32-bit unit from a given S-box will be used twice in an XOR operation. If such a double usage or "self cancellation" occurred, it would effectively reduce the number of encryption rounds by 2 each time a 32-bit unit was used a second time.

The process runs for a preselected number of iterations until an acceptable level of randomness (security) is obtained. For most commercial applications, 16 rounds is believed to be adequate. For 16 rounds, 2 pre-computed S-boxes are required. Obviously, for greater security additional rounds of the process could be performed. For such additional rounds, 1 additional S-box would need to be precomputed for every 8 additional rounds. This improves the encryption, as it prevents self-cancellation and also results in more bits in the S-boxes influencing the bits in the output.

After the desired number of rounds is completed, a final XOR operation is performed using the final left and right 32-bit data blocks and 32-bit auxiliary keys 2 and 3.

The data encryption method just described is a block cipher on 64-bit clear text blocks. 64-bit blocks were chosen to conform with DES's 64-bit size. This permits the substitution of this new encryption method for DES with a minimum of difficulty.

The method just described is shown in a notationally clearer form in FIG. 2. The various variables have been indexed to facilitate tracking them through the successive iterations by re-writing the method shown in FIG. 1 in an array format wherein L and R are treated as arrays. The array "i" is added to denote the indices used to access the S-box. As shown in FIG. 2, the plain text is, by definition, denoted L[-1] and R[-1] and the ciphertext is L[N+1] and R[N+1]. Also by definition, round 1 computes L[1] and R[1] from L[0] and R[0], using index 1, or i[1 ].

As discussed earlier, the purpose of the rotation schedule (step 50) is to bring new bytes of the input into position so that all 8 bytes of input are used in the first 8 rounds. Thus, any given single change in any single input byte is guaranteed to force a different S-box selection within 8 rounds. This forced change in turn initiates the cascade of unpredictable changes needed to encode the input. A secondary purpose of using rotation to select different bytes as opposed to some other method is to maximize the number of rotates by 16 used to perform this method as such "Rotates" tend to run faster on most microprocessors. For example, the Motorola 68000 has a SWAP instruction which is equivalent to rotating a 32-bit register by 16 bits. Also, rotation by 16 tends to be very fast on microprocessors with 16 bit registers. Indeed, by switching one's viewpoint about which register contains the lower 16-bits and which contains the upper 16 bits, it is possible to perform this operation with no instruction at all.

Both the first and second method described herein can be implemented efficiently on different computer architectures. The methods function equally well regardless of whether the computer supports shift instructions (either left/right shifts), or rotate instructions. Generally, the most efficient implementation of these methods will be achieved by preselecting either shift or rotate instructions, depending upon which instruction is supported by the computer. However, if the computer is equipped with a very sophisticated compiler, these methods will be translated into lower level code using the instruction supported by the particular machine without affecting the result computed by the method. This feature is called architectural invariance.

The parameter `N` is used because encryption must continue for enough rounds to obscure and conceal the data. It is left as a parameter so that users who wish greater security can require more rounds, while those who are satisfied with fewer rounds can encrypt and decrypt data more rapidly. A minimum of 8 rounds and a maximum of 64 are considered reasonable. Typical applications will use 16, 24 or 32 rounds. For reasons of implementation efficiency, values of `N` that are not multiples of 8 are not acceptable.

The computation of the S-box is obviously important to the encryption/decryption method. FIG. 3 shows an S-box comprised of 4 columns and 256 rows, each entry in the rows being 8 bits wide.

Unlike DES no explicit step for mixing in key material is used as the entire S-box is pre-computed from a user-supplied key. The key is presumed to be relatively short. Although S-box generation is complex, its essential idea is simple. The S-box is generated in a pseudo-random fashion from a user supplied key so that it (the S-box) satisfies one property: all four of the one-byte (8-bit) columns in the S-box must be permutations of one another. This is shown clearly in FIG. 3. As a given, the selection of a different S-box entry changes all four bytes generated by the S-box. As stated earlier, the rotation schedule insures that the S-box is accessed no more than once by any 8-bit byte in the original 64-bit clear text unit. Every 2 rounds of the process rotates each 32-bit word once. After 8 rounds both 32-bit words have returned to their original position. To prevent any repeated use of the same S-box entry after the 32-bit words return to their original position, a new S-box is used. Thus, every different input to an S-box must produce an output whose every byte differs from every byte in any other possible output. In other words, for any 2 32-bit entries in an S-box which are indexed by different indices, the entries differ in all 4 bytes.

The pre-computation of a pseudo-random S-box satisfying the desired properties can be divided into two stages. First, a stream of pseudo-random bytes is generated. Second, the stream of pseudo-random bytes is used to generate four pseudo-random permutations that map 8 bits to 8 bits. These four pseudo-random permutations are the generated S-box.

A stream of pseudo-random bytes could be generated by an encryption function. The obvious circularity problem caused thereby requires the use of a `standard` S-box. This standard S-box is particularly useful in conjunction with the second method described herein (the second method, as it is only used to encrypt small amounts of data, cannot spend time pre-computing S-boxes). The creation of this standard S-box will be described subsequently.

Assuming the existence of an S-box, a 64-byte `state` value for the pseudo-random byte-stream generator is adopted. A user-provided key is used to initialize a 64-byte block (thereby limiting the key size to 512 bits). This 64-byte block is then encrypted using the first method, using the standard S-box instead of an S-box generated from a key, in a cipher block chaining mode, known in the art. This generates 64 pseudo-random bytes. After these 64 bytes have been used, the 64-byte block is once again encrypted, providing an additional 64 pseudo-random bytes. This process may be repeated as often as necessary to provide additional pseudo random bytes.

Once the stream of pseudo-random bytes is available, they are converted into the needed permutations. A known algorithm is used for this purpose and it is found in Knuth, Seminumerical Algorithms, Vol II, Addison-Wesley Publishing Co., 1969, p. 125. The algorithm starts with a pre-existing, but not necessarily random, permutation. In this invention, the standard S-box is the starting point. Each element (byte) in the initial permutation is then interchanged with some other randomly chosen element, thereby providing a random permutation. The general concept for generating a random permutation from a pseudo-random or random sequence is shown in FIG. 4. The specific routine is given in the routine "SBoxFromRandomArray." The specific method used to generate pseudo-random numbers is not critical to this invention. Any one of several algorithms known in the art can be used.

A standard S-box is needed for two reasons. It is used with the first method to generate a pseudo-random stream of bytes. The second method relies on the standard S-box to reduce overall computation time. As a design objective, the generation of this S-box must be public, thereby avoiding a criticism of DES, where S-box generation is secret, fueling speculation that "trap doors" might allow decryption by the DES creators. It has been decided that the program which generates the standard S-box from a stream of random numbers will be made public and the stream of random numbers which is used as input to the program will be selected in such a manner as to eliminate the possibility of a "trap door" or other weakness having been inserted.

These criteria are met by publishing the algorithm used to generate the standard S-box and by using a set of random numbers published in 1955 by the RAND Corp ("A Million Random Digits with 100,000 Normal Deviates"). This standard algorithm is shown in FIG. 4. This algorithm is the same as the Knuth algorithm discussed previously.

The second method of data encryption is similar to the first method except that the S-box is not precomputed. Rather, this method uses the standard S-box, which allows the method to encrypt a single 64-bit block of data without lengthy pre-computation. However, this means that some new mechanism for mixing in key material must be adopted because the standard S-box cannot serve as the key. The mechanism of key-mixing is simple. Key material is XORed with the 64-bit data block before the first round of the algorithm and thereafter following every 9th round. A consequence of this method is that the key must be a multiple of 64 bits. For commercial applications 64-bit and 128-bit keys will be acceptable. Although larger keys can be used, this slows down the encryption.

The details of this second method are shown in the appended C code routine "Khafre." The flow chart of FIG. 1 illustrates "Khafre" except that in "Khafre" the S-box is fixed, publicly known and does not change, and 64-bits of key material are exclusive-ORed prior to the first round and thereafter following every 8 rounds. In contrast, the first method exclusive-ORs 64-bits of key material prior to the first round and 64-bits of key material following the last round only.

The somewhat complex termination criteria for the WHILE loops in routine "Khafre" means that all 64-bit blocks of key material are used the same number of times. Although this has only a small cryptographic value, it does simplify decryption. If all of the 64-bit key blocks are used exactly once, then decryption proceeds by using the last key block (Key [enoughKey-1] and working backwards. If this were not the case, decryption would have to begin at a key block computed as: enoughkey-enough/8 MOD enoughkey. Although not difficult to compute, the `MOD` operation is often time consuming on microprocessors, which would unnecessarily slow down decryption. The MOD operation within the loop can be eliminated if the loop is unrolled 8 times--this will increase speed for other reasons. It is expected that most implementations will unroll the inner loop 8 times.

This second method will probably require more rounds than the first method to reach the same level of security due to the use of a fixed S-box. Additionally, each round of the second method is somewhat more complex than each round of the first method. Consequently, the second method takes longer than the first to encrypt each 64-bit block. On the other hand, the second method does not require pre-computation of the S-box and so will encrypt small amounts of data more quickly than the first.

In the foregoing specification, the invention has been described with reference to a specific exemplary embodiment thereof. It will, however, be evident that various modifications and changes may be made thereunto without departing from the broader spirit and scope of the invention as set forth in the appended claims. For example, the number of encryption rounds can be readily changed to increase the security level. Other methods to generate permutations for the S-boxes might be used. Many such changes or modifications are readily envisioned. The specification and drawings are, accordingly, to be regarded in an illustrative rather than in an restrictive manner. ##SPC1##