Method and system for machine enciphering and deciphering

• US 4,157,454 A
• Filed: 12/19/1977
• Issued: 06/05/1979
• Est. Priority Date: 12/22/1976
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Becker, Wolfram
• Primary Examiner(s): Birmiel, Howard A.
• Application Number:
  US05/862,251
• Time in Patent Office: 533 Days
• Field of Search: 178/22
• US Class Current: 380/37
• CPC Class Codes: H04L 2209/125 Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]

Abstract

Variable length data words are processed segment-by-segment together with corresponding segments of an enciphering key. As a function of the contents of a data segment, one of several modification modes is chosen. In accordance with the chosen modification mode, the enciphering key is changed following each enciphering operation of a segment. The described steps are preferably carried out three times for the full data word. The result of the third cycle represents the enciphered data word. Deciphering is effected in the same manner.

Claims

1. Method for the enciphering and authorized deciphering of multi-digit data, comprising

subjecting successive data segments, under control of corresponding segments of an enciphering key, to a substitution operation generating a modified version of the data segment;

and

in each substitution operation, selecting one of several given modification modes, as a predetermined function of a data segment and the corresponding key segment for changing the enciphering key before the next substitution operation upon the next corresponding segment.

2. Method as recited in claim 1, wherein said data segment and said key segment consist of one binary bit each, and both bits select one of four predetermined modification modes as a modification operation.

3. Method as recited in claim 2, wherein the permutation operation is a symmetrical rotation of the bit positions.

4. Method as recited in claim 1, wherein the deciphering operation differs from the enciphering operation in that the selection of the modification operations is reversed.

5. Method as recited in claim 1, wherein the predetermined key modifications are substitution operations and/or permutation operations of the bits of the enciphering key, and that several different kinds of said operations are provided for selection by the data segments and the key segments.

6. Method as recited in claim 1, wherein the substitution operations and permutation operations extend to all bits of the respective effective part of the enciphering key.

7. Method for the enciphering and authorized deciphering of multi-digit data, comprising

subjecting to a substitution operation a data segment and a key segment of a first key word (first enciphering key half) to generate a modified version of the data segments,

selecting one of several different modification operations by means of which the first key word is modified before the next substitution operation, and

repeating the above steps with the remaining data segments of the data register and the corresponding segments of the repeatedly modified first key word, such that with the modified version of the data a permutation operation is carried out, the result of which again causes a data segment and a key segment of a second key word (second enciphering key half) to be both subjected to a substitution operation which again generates a modified version of the data segment, and to also select one of several different modification operations, by means of which the second key word is modified before the next substitution operation, said last steps being repeated with the remaining segments of the modified data and corresponding segments of the repeatedly modified second key word.

8. Method as recited in claim 7, comprising,

further permutating the repeatedly modified data,

subjecting segment-by-segment to a further substitution operation, the result of said further permutation together with the corresponding segments of the repeatedly modified first key word, supplying the enciphered version of the data segments, and

between every two of said substitution operations, providing a modification operation of the first key word, which is selected jointly by the corresponding data segment and the corresponding key segment.

9. Method as recited in claim 7, wherein said data segment and said key segment consist of one binary bit each, and both bits select one of four predetermined modification modes as a modification operation.

10. Method as recited in claim 9, wherein the permutation operation is a symmetrical rotation of the bit positions.

11. Method as recited in claim 7, wherein the deciphering operation differs from the enciphering operation in that the selection of the modification operations is reversed.

12. Method as recited in claim 7, wherein the predetermined key modifications are substitution operations and/or permutation operations of the bits of the enciphering key, and that several different kinds of said operations are provided for selection by the data segments and the key segments.

13. Method as recited in claim 7, wherein the substitution operations and/or permutation operations extend to all bits of the respective effective part of the enciphering key.

14. System for the enciphering and authorized deciphering of multi-digit data, comprising:

data register means for storing the data to be enciphered and deciphered;

key register means for storing an enciphering key for operating on said data;

substitution means, connected to said data register means and said key register means, for subjecting successive data segments, under control of corresponding segments of an enciphering key, to a substitution operation generating a modified version of the data segment; and

modification means, connected to the outputs of said data register means and said key register means, for changing, as a function of the data segments and the corresponding key segments, the enciphering key before next substitution operation, said modification means including means for selecting, in each substitution operation, one of several given modification modes.

15. System as recited in claim 14, further comprising,

a substitution stage included in said substitution means that is connected to both one segment output of said data register means and to said key register means,

a buffer register connected to the output of said substituion stage;

said modification means, which can be set to different modes, is connected to an output and to an input of said key register means, and modification means includes a modification mode control circuit receiving selection signals from the segment outputs of said data register means and said key register means, for modifying as a function thereof and of the data, the contents of the key register between two operational cycles of said substitution stage.

16. System as recited in claim 15, wherein said substitution stage is designed as an exclusive-OR circuit to which the bits of said data register means and key register means are serially applied.

17. Systems as recited in claim 15, wherein said data register means as well as said buffer register are designed as shift registers, said buffer register has a direction of shift opposite to that of said data register means, and a feedback line is provided from one parallel output of said buffer register to a parallel input of said data register means.

18. System as recited in claim 15, wherein said modification mode control circuit comprises a decoder to which the input bits of said substitution stage are applied, generating therefrom several modification control signals which set said modification circuit to selectively execute at least one of several different modification steps.

19. System as recited in claim 15, wherein said modification means comprises a permutation circuit and a substitution circuit which are selected and actuated by the segment outputs of said data register means and said key register means, either individually or jointly for different modifications of the enciphering key.

20. System as recited in claim 15, wherein said modification means comprises an arithmetic unit for arithmetically combining key fields, as well as a logic circuit for executing logical operations, both said arithmetic unit and said logic circuit being operated between two operational cycles of said substitution stage by means of control signals generated by said modifiction mode control circuit.

21. System as recited in claim 20, wherein said modification means comprises an adder connected with one input to the output of a first partial register (KR1) and with the other input to a second partial register (KR2) of said key register means, the result signals of said adder being fed back to the first partial register (KR1), and said modification means also comprises shift means for the execution of different rotational position shifts on at least a part of the contents of said key register means, whereby a modification operation optionally comprises one addition and/or one of several different rotational position shifts.

22. System as recited in claim 15, wherein said key register means is designed at least in part as a feedback shift register, and the series output of said feedback shift register is connected both to said substitution stage and to said modification mode control circuit.

23. System as recited in claim 15, comprising a clock control circuit providing clock signals for the execution of three data substitution cycles via the bit positions of a variable length data field to be processed, said clock control circuit additionally providing between two substitution cycles at least two clock signal phases for actuating the enciphering key modification means, and after each of the first two data substitution cycles, actuating a gate circuit for feeding the modified data from said buffer register back to said data register means.

24. System as recited in claim 23, wherein said clock control circuit includes a data field length control circuit which limits the number of segment processing cycles to the position number of the data field stored in data register.

25. System as recited in claim 23, wherein said clock control circuit includes a counter adjustable to the position number of the variable length data field to be processed, thereby determining within the data substitution cycles the number of substitution cycles, the number of shift cycles in the registers, and the enciphering key modification cycles according to the position number of the data field to be processed.