Data encryption system for encrypting plaintext data

[0002] The present invention relates to a data encryption system; and, more particularly, to a data encryption system capable of maintaining a high security while effectively encrypting plaintext data.

[0003] One of the widely used data encryption algorithms is the one based on the data encryption standard (DES) adopted by the National Bureau of Standards (NBS). The DES is used for carrying out block encryption using a 56-bit secret key. According to the DES, each of plaintext blocks has a length of 64 bits; and its ciphertext block also has the same bit length as that of each plaintext block. Transmission of the ciphertext blocks is effected via a public network.

[0004] Since, however, the DES employs the smaller number of bits in a secret key to encrypt the 64-bit blocks, it may not be able to provide a data encryption scheme with a high security. Further, since the secret key is not uniformly assigned to all of the 64-bit blocks, it is relatively easy to decrypt a ciphertext block encrypted by employing the conventional cryptanalysis techniques such as the differential cryptanalysis (DC) or the linear cryptanalysis (LC).

[0005] To ameliorate the problems inherent in the DES and develop a more powerful encryption scheme, various candidate algorithms have been proposed to establish the advanced encryption standard (AES) emerged from the National Institute of Standards and Technology (NIST). Among the candidate algorithms, an optimum algorithm will be adopted as the AES in the near future. However, hitherto, there are no known devices and methods implemented on the basis of the algorithms or the proposal requirements of the NIST.

[0006] It is, therefore, a primary object of the present invention to provide a data encryption system capable of maintaining a high security while effectively encrypting input plaintext data.

[0007] In accordance with one aspect of the invention, there is provided a data encryption system for encrypting plaintext data, which comprises: means for receiving and dividing the plaintext data into a plurality of data blocks, each of the data blocks has a same bit length; means for scheduling a preset master key to obtain a set of round subkeys, the preset master key having the same bit length as that of the plaintext data; means for encrypting each of the data blocks by using a corresponding round subkey among the set of round subkeys and combining the encrypted blocks to thereby provide ciphertext data having the same bit length as that of the plaintext data.

[0008] The encryption means includes means for dividing each of the data blocks into a plurality of data subblocks, each of the subblocks having a same bit length; means for adding each of the subblocks to a corresponding round subkey among the set of round subkeys to generate a key added data subblock corresponding to said each subblock; means for dividing each of the key added data subblocks into a pair of key added subblocks, each of the pair of key added subblocks having a same bit length; means for obtaining a key/data added data subblock for each of the pair of data subblocks by using a round subkey corresponding to said each data subblock; and means for processing each of the key/data added data subblocks to provide the ciphertext data.

[0009] The above and other objects and features of the present invention will become apparent from the following description of preferred embodiments given in conjunction with the accompanying drawings, in which:

[0010] FIG. 1 shows a block diagram of a data encryption system in accordance with the present invention;

[0011] FIG. 2 provides a detailed block diagram of an encrypter of a first data encryption device shown in FIG. 1; and

[0012] FIG. 3 offers a detailed block diagram of a key scheduling device shown in FIG. 1.

[0013] Referring to FIG. 1, there is shown a block diagram of a data encryption system 100 for encrypting input plaintext data in accordance with the present invention. As will be described below, the inventive data encryption system effectively encrypts the input plaintext data by using a preset master key to provide ciphertext data. The data encryption system 100 of the invention comprises an input and an output units 200 and 600, a key scheduling device 300 and a plurality of, e.g., 16, data encryption stages 301-316. For the sake of simplicity, only four data encryption stages, 301, 302, 315 and 316, are illustratively shown in FIG. 1.

[0014] Specifically, input plaintext data P(128) of, e.g., 128 bits, is first supplied from a message source, e.g., a first computer (not shown), to the input unit 200. At the input unit 200, the input plaintext data of 128 bits is preferably equally divided into N, e.g., 2, data blocks, P_Land P_R, each of which has a same bit length of, e.g., 64 bits. The former data block P_Lof 64 bits is applied to an exclusive-OR (EX-OR) gate 401 included in the first encryption stage 301, while the latter data block P_Rof 64 bits is delivered as X⁽¹⁾to an encrypter 501 in the first stage 301 and to an EX-OR gate 402 in the second data encryption stage 302. As shown in FIG. 1, each of the sixteen data encryption stages 301-316 includes an EX-OR gate and an encrypter, e.g., the first data encryption stage 301 includes the EX-OR gate 401 and the encrypter 501. Details of the encrypter 501 will be provided with reference to FIG. 2 hereinafter.

[0015] At the key scheduling device 300, sixteen sets of round subkeys, to be used in encrypting the input plaintext data in each of sixteen rounds, are derived by using the preset master key K of 128 bits the bit length of which is identical to that of the input plaintext data. For the sake of simplicity, hereinafter, only a series of processes to derive the first set of round subkeys, SK₁, SK₂, SK_3,1and SK_3,2to be used in the first round are provided in detail. The first set of round subkeys, as shown in FIG. 1, are fed to the encrypter 501 as RSK^(l). Also four constant values, Q₁-Q₄, whose values depend on the preset master key at the key scheduling device 300 are obtained.

[0016] Referring to FIG. 3, there is provided a detailed block diagram of the key scheduling device 300 shown in FIG. 1, wherein the device 300 includes a key scheduling circuit 310, a first and a second key dividers 320 and 330, and a constant value generator 340. At the key scheduling circuit 310, the preset master key K of 128 bits is received first; and a plurality of, e.g., 16, round keys, SK⁽¹⁾-SK⁽¹⁶⁾, are obtained by combining the preset master key of 128 bits, each of the round keys having a same bit length of, e.g., 96 bits. It should be noted that not only avalanche effect can be maximized but one-wayness is satisfied since it is designed that the preset master key of 128 bits is uniformly assigned to all of the sixteen rounds to obtain the sixteen round keys. The one-wayness characteristic prevents the original preset master key from being reconstructed by using some of the sixteen round keys, and also prevents the remaining round keys also from being be reconstructed by using said some of the sixteen round keys.

[0017] Each of the sixteen round keys SK⁽¹⁾-SK⁽¹⁶⁾is supplied to a corresponding key divider. In FIG. 3, for the sake of simplicity, there is illustratively shown a block drawing to generate only the first set of round subkeys, SK₁, SK₂, SK_3,1and SK_3,2, by using the first round key SK⁽¹⁾at the key scheduling circuit 310. The first round key SK⁽¹⁾of 96 bits is applied to the first key divider 320, wherein SK⁽¹⁾of 96 bits is divided into three round subkeys, SK₁-SK₃, each of the round subkeys having a same bit length of 32 bits.

[0018] Thereafter, the first and the second round subkeys SK₁and SK₂are delivered to the encrypter 501, shown in the FIG. 1 whereas the third round subkey SK₃is fed to the second key divider 330 for further division. At the second key divider 330, the third round subkey SK₃is further divided into two round subkeys, SK_3,1and SK_3,2, each having a same bit length of 16 bits. The first set of round subkeys, SK₁, SK₂, SK_3,1and SK_3,2, are then provided to the encrypter 501 as SK⁽¹⁾as shown in FIG. 1.

[0019] Using the first set of round subkeys, SK₁, SK₂, SK_3,1, SK_3,2, provided from the key scheduling device 300, the encrypter 501 encrypts the data block X⁽¹⁾applied thereto, to thereby output an encrypted data block Y⁽¹⁾of 64 bits. A detailed description of the encrypter 501 will be given with reference to FIG. 2 hereinafter.

[0020] Turning now to FIG. 2, there is depicted a detailed block diagram of the encrypter 501 shown in FIG. 1 in accordance with the invention. The encrypter 501 has a first and a second division units 510 and 525, three key adding circuits 520, 530 and 540, a data adding circuit 550, a substitution (S) box 560, a constant value adding circuit 570, a linear transformer 580 and a combining unit 590.

[0021] At the first division unit 510, the data block X⁽¹⁾of 64-bits from the input unit 200 shown in FIG. 1 is divided into two data subblocks, X₁and X₂, each of which has a same bit length of 32 bits. Each of the two data subblocks is then coupled to a corresponding one of two EX-OR gates 522 and 524 contained in the first key adding circuit 520. As shown in FIG. 2, inputs to the first EX-OR gate 522 are the former data subblock X₁and the first subkey SK₁of 32 bits from the first key divider 320 shown in FIG. 3. The first EX-OR gate 522, as is well known in the art, performs a bitwise EX-OR operation on the two inputs applied thereto; and then the EX-OR operated output is delivered to the second division unit 525 as a first key added data subblock. Similarly, the second EX-OR gate 524 accepts the latter data subblock X₂from the first division unit 510 and the second subkey SK₂from the first key divider 320 show in FIG. 3 and also carries out a bitwise EX-OR operation on the above two inputs thereto. The EX-OR operated output from the second EX-OR gate 524 is provided as a second key added data subblock to the second division unit 525.

[0022] At the second division unit 525, each of the first and the second key added data subblocks is further divided into two data subblocks. To be more specific, the first key added data subblock is divided into two data subblocks, A₁and A₂, and the second key added data subblock is divided into two data subblocks, A₃and A₄, each of the four data subblocks having a same bit length of 16 bits. As shown in FIG. 2, the first data subblock A₁is coupled to the second key adding circuit 530 and the data adding circuit 550; and the second data subblock A₂is coupled to the third key adding circuit 540 and the data adding circuit 550. And, the third data subblock A₃is coupled to the second key adding circuit 530 and the data adding circuit 550; and the fourth data subblock A₄is coupled to the third key adding circuit 540 and the data adding circuit 550.

[0023] At the second key adding circuit 530 containing an addition modulo 2¹⁶unit 532 and a multiplication modulo 2¹⁶+1 unit 534, a key/data added data subblock U₁for the first data subblock A₁is obtained by using the third data subblock A₃and the round subkey SK_3,1from the second key divider 330 shown in FIG. 3. It should be noted that the number of the addition modulo 2 units is decided based on the division number of each of the first and the second key added data subblocks from the second division unit 525.

[0024] Specifically, the addition modulo 2¹⁶unit 532 performs an addition modulo 2¹⁶operation on inputs coupled thereto, i.e., the first and the third data subblocks A₁and A₃from the second division unit 525. The multiplication modulo 2¹⁶+1 unit 534 carries out a multiplication modulo 2¹⁶+1 operation on inputs coupled thereto, i.e., the output from the addition modulo 2¹⁶unit 532 and the round subkey SK_3,1from the second key divider 330 shown in FIG. 3, thereby obtaining the first key/data added data subblock U₁for the first data subblock A₁. Details of the addition modulo 2¹⁶operation and the multiplication modulo 2¹⁶+1 operation are omitted here for the sake of simplicity since they are well known in the art.

[0025] Meanwhile, the third key adding circuit 540, which contains an addition modulo 2¹⁶unit 542 and a multiplication modulo 2¹⁶+1 unit 544, is substantially identical to the second key adding circuit 530 except that inputs thereto are different from each other. Therefore, details of the third key adding circuit 540 are omitted here for the sake of simplicity. Accordingly, an output from the third key adding circuit 540 will be a second key/data added data subblock U₂for the fourth data subblock A₄. The first key/data added data subblock U₁is coupled to EX-OR gates 554 and 558 in the data adding circuit 550, while the second key/data added data subblock U₂is coupled to EX-OR gates 552 and 556.

[0026] In accordance with the present invention, since the data subblocks from the second division unit 525 affect the first and the second key/data added data subblocks by performing the addition modulo 2¹⁶operation, it is possible to derive a diffusion effect and an avalanche effect as can be inferred from the above. Further, by carrying out the nonlinear multiplication modulo 2¹⁶+1 operation on the output from the addition modulo 2¹⁶unit and the corresponding round subkey, it is very difficult to decrypt ciphertext data by using conventional cryptanalysis techniques, e.g., a differential cryptanalysis (DC) and a linear cryptanalysis (LC).

[0027] As shown in FIG. 2, the data adding circuit 550 contains four EX-OR gates 552, 554, 556 and 558. Inputs to the first EX-OR gate 552 are the first data subblock A₁from the second division unit 525 and the second key/data added data subblock U₂from the third data/key adding circuit 540; and inputs to the second EX-OR gate 554 are the second data subblock A₂from the second division unit 525 and the first key/data added data subblock U₁from the second key/data adding circuit 530. Further, inputs to the third EX-OR gate 556 are the third data subblock A₃and the second key/data added data subblock U₂; and inputs to the fourth EX-OR gate 558 are the fourth data subblock A₄and the first key/data added data subblock U₁. Each of the four EX-OR gates performs a bitwise EX-OR operation on the inputs coupled thereto to provide an EX-OR operated data block. Each of the four EX-OR operated data blocks from the four EX-OR gates is coupled to a corresponding S-box among four 16×16 bit S-boxes 562, 564, 566 and 568 contained in the S-box unit 560.

[0028] Each of the four S-boxes, known to be as a substitution box in the art, is provided with an S-box table having a set of predetermined inverse data blocks and chooses one of the set of the inverse data blocks, which corresponds to the input applied thereto. The sets of inverse data blocks are obtained in advance by performing an inverse mapping over GF(Galois Field) (2¹⁶) and by carrying out an affine transformation which adds a predetermined value to an inverse mapped one to remove a fixed point (e.g., 0 or 1) in the inverse mapped data block which corresponds to any input bit. By performing both the inverse mapping and the affine transformation, it is very difficult to decrypt ciphertext data by using a conventional cryptanalysis technique, e.g., the differential cryptanalysis, thereby improving the security of ciphertext data.

[0029] Thereafter, each of the data blocks chosen by the four S-boxes 562, 564, 566 and 568 is then delivered to a corresponding EX-OR gate of four EX-OR gates 572, 574, 576 and 578 in the constant value adding unit 570. Also the four constant values from the constant value generator 340 shown in FIG. 3 are coupled to the respective corresponding EX-OR gates 572, 574, 576 and 578. Each of the four EX-OR gates performs a bitwise EX-OR operation on the inputs coupled thereto and issues four EX-OR operated data blocks, C₁-C₄, to the linear transformer 580.

[0030] The linear transformer 580, which may include a plurality of addition modulo 2¹⁶units (not shown), performs a linear transformation which carries out an addition modulo 2¹⁶operation on each of the four EX-OR operated data blocks. For instance, a linear transformed data block on the first EX-OR operated data block C₁is obtained by performing an addition modulo 2¹⁶operation on the remaining data blocks C₂-C₄excepting itself data block C₁; and a linear transformed data block on the third EX-OR operated data block C₃is derived by performing an addition modulo 2¹⁶operation on the remaining data blocks C₁, C₂and C₄excepting itself block C₃. The linear transformed data blocks are then fed to the combining unit 590 which combines them to output a combined data y⁽¹⁾of 64 bits. The data so combined, y⁽¹⁾, is applied to the EX-OR gate 401 shown in FIG. 1

[0031] Referring back to FIG. 1, the EX-OR gate 401, which receives the first data block P_Lfrom the input unit 200 and the combined data y⁽¹⁾from the combining unit 590 shown in FIG. 2, performs a bitwise EX-OR operation on them and provides the EX-OR operated data block to an encrypter 502 in the second data encryption stage 302 as X⁽²⁾. As is described above, the rest of the sixteen data encryption stages 302-316 include the same components as in the first data encryption stage 301; and, therefore, details thereof are omitted here for the sake of simplicity. Outputs of the last data encryption stage 316, i.e., C_Land C_R, are delivered to the output unit 600, wherein the outputs are converted in such a manner that it can be transferred, as ciphertext data C(128), to a destination, e.g., a second computer (not shown) via a transmission line.

[0032] While the present invention has been shown and described with respect to the particular embodiment, it will be apparent to those skilled in the art that many changes and modifications may be made without departing from the spirit and scope of the invention as defined in the appended claims.